negotium 0.2.8 → 0.2.10

package/dist/main.js

@@ -253,7 +253,7 @@ function resolveDefaultModel(agent, registryDefaultModel) {
 function codexAuthFilePath() {
   return process.env.NEGOTIUM_CODEX_AUTH_FILE || join(process.env.CODEX_HOME || join(homedir(), ".codex"), "auth.json");
 }
-var HOME, PROJECT_ROOT, STATE_DIR_ENV, STATE_DIR, WORKSPACE_DIR, TOPIC_WORKSPACE_DIR, SHARED_WIKI_DIR, CRON_WORKSPACE_DIR, BROWSER_DIR, BROWSER_PROFILES_DIR, BINARIES_DIR, SECRETS_DIR, DM_WORKSPACE_DIR, SESSION_WORKSPACE_DIR, CLAUDE_EXECUTABLE_ENV, CLAUDE_EXECUTABLE, DEFAULT_OUTPUT_LANGUAGE = "English", BROWSER_RS_VERSION = "v0.1.17", BROWSER_RS_MIN_SECURE_VERSION = "0.1.15", BROWSER_RS_BIN, PLAYWRIGHT_MCP_BIN, TSX_BIN, TSX_LOADER, TSCONFIG_PATH, SESSION_COMM_SERVER, TASK_SERVER, BROWSER_MCP_SSE_PROXY_SERVER, CANONICAL_MCP_PROXY_SERVER, WIKI_SERVER, TOKEN_STATS_SERVER, COMPACTION_LOG_SERVER, SYSTEM_HEALTH_SERVER, AGENT_HEALTH_SERVER, BACKGROUND_BASH_SERVER, VAULT_SERVER, BG_BASH_BASE_PORT, BG_BASH_MAX_PORT, RUNTIME_MCP_SECRET, NODE_CONTROL_TOKEN, VAULT_MASTER_KEY, NEGOTIUM_PORT, hostname, DATA_DIR, LOG_DIR, UPLOADS_DIR, VAULT_DIR, SESSIONS_DB, DEBUG_FILE, USERS_LOG_DIR, RUN_DIR, PROGRESS_DIR, DM_CMD_DIR, DM_RESP_DIR, SESSION_INBOX_DIR, SESSION_ASKS_DIR, PLAYWRIGHT_BASE_PORT, PLAYWRIGHT_MAX_PORT, PLAYWRIGHT_PORTS_DIR, ACTIVE_QUERY_STALE_MS, AGENTS_PROMPTS_DIR, RESOURCES_DIR, FILE_TAG_REGEX, MODEL_SONNET = "claude-sonnet-5", MODEL_OPUS = "claude-opus-5", MODEL_FABLE = "claude-fable-5", FALLBACK_AGENT, SESSION_AGENT, GATEWAY_AGENT, FALLBACK_MODEL, SESSION_MODEL, GATEWAY_MODEL, FFMPEG_BIN, FFPROBE_BIN, PYTHON_BIN, FASTER_WHISPER_WRAPPER, WHISPER_MODEL, TESSERACT_BIN, PDFTOTEXT_BIN, _envMaxTellDepth, MAX_TELL_DEPTH;
+var HOME, PROJECT_ROOT, STATE_DIR_ENV, STATE_DIR, WORKSPACE_DIR, TOPIC_WORKSPACE_DIR, SHARED_WIKI_DIR, CRON_WORKSPACE_DIR, BROWSER_DIR, BROWSER_PROFILES_DIR, BINARIES_DIR, SECRETS_DIR, DM_WORKSPACE_DIR, SESSION_WORKSPACE_DIR, CLAUDE_EXECUTABLE_ENV, CLAUDE_EXECUTABLE, DEFAULT_OUTPUT_LANGUAGE = "English", BROWSER_RS_VERSION = "v0.1.17", BROWSER_RS_MIN_SECURE_VERSION = "0.1.15", SNIPPETS_API_URL, BROWSER_RS_BIN, PLAYWRIGHT_MCP_BIN, TSX_BIN, TSX_LOADER, TSCONFIG_PATH, SESSION_COMM_SERVER, TASK_SERVER, BROWSER_MCP_SSE_PROXY_SERVER, CANONICAL_MCP_PROXY_SERVER, WIKI_SERVER, TOKEN_STATS_SERVER, COMPACTION_LOG_SERVER, SYSTEM_HEALTH_SERVER, AGENT_HEALTH_SERVER, BACKGROUND_BASH_SERVER, VAULT_SERVER, BG_BASH_BASE_PORT, BG_BASH_MAX_PORT, RUNTIME_MCP_SECRET, NODE_CONTROL_TOKEN, VAULT_MASTER_KEY, NEGOTIUM_PORT, hostname, DATA_DIR, LOG_DIR, UPLOADS_DIR, VAULT_DIR, SESSIONS_DB, DEBUG_FILE, USERS_LOG_DIR, RUN_DIR, PROGRESS_DIR, DM_CMD_DIR, DM_RESP_DIR, SESSION_INBOX_DIR, SESSION_ASKS_DIR, PLAYWRIGHT_BASE_PORT, PLAYWRIGHT_MAX_PORT, PLAYWRIGHT_PORTS_DIR, ACTIVE_QUERY_STALE_MS, AGENTS_PROMPTS_DIR, RESOURCES_DIR, FILE_TAG_REGEX, MODEL_SONNET = "claude-sonnet-5", MODEL_OPUS = "claude-opus-5", MODEL_FABLE = "claude-fable-5", FALLBACK_AGENT, SESSION_AGENT, GATEWAY_AGENT, FALLBACK_MODEL, SESSION_MODEL, GATEWAY_MODEL, FFMPEG_BIN, FFPROBE_BIN, PYTHON_BIN, FASTER_WHISPER_WRAPPER, WHISPER_MODEL, TESSERACT_BIN, PDFTOTEXT_BIN, _envMaxTellDepth, MAX_TELL_DEPTH;
 var init_config = __esm(() => {
   init_config_helpers();
   init_logger();
@@ -274,6 +274,7 @@ var init_config = __esm(() => {
   SESSION_WORKSPACE_DIR = resolve(STATE_DIR, "data", "sessions");
   CLAUDE_EXECUTABLE_ENV = envText("NEGOTIUM_CLAUDE_EXECUTABLE");
   CLAUDE_EXECUTABLE = CLAUDE_EXECUTABLE_ENV ? resolve(CLAUDE_EXECUTABLE_ENV) : undefined;
+  SNIPPETS_API_URL = (envText("NEGOTIUM_SNIPPETS_API_URL") ?? envText("SNIPPETS_API_URL") ?? "").replace(/\/+$/, "");
   BROWSER_RS_BIN = resolveBrowserRsBin(envText("NEGOTIUM_BROWSER_RS_BIN"));
   PLAYWRIGHT_MCP_BIN = resolveBrowserMcpBin(envText("NEGOTIUM_BROWSER_MCP_BIN"));
   TSX_BIN = resolveDependencyBin("tsx");
@@ -1560,7 +1561,7 @@ var exports_version = {};
 __export(exports_version, {
   NEGOTIUM_VERSION: () => NEGOTIUM_VERSION
 });
-var NEGOTIUM_VERSION = "0.2.8";
+var NEGOTIUM_VERSION = "0.2.10";
 
 // ../../packages/core/src/agents/codex-native-multi-agent.ts
 import { spawn } from "child_process";
@@ -3633,6 +3634,9 @@ function existingCreatedAt(path) {
     return;
   }
 }
+function nonEmptyTurnText(text) {
+  return text.trim().length > 0 ? text : BLANK_TURN_PLACEHOLDER;
+}
 function writeRollout(options) {
   const sessionId = options.reuseSessionId ?? randomUUID3();
   assertUuidLike("sessionId", sessionId);
@@ -3640,8 +3644,8 @@ function writeRollout(options) {
   const path = maestroSessionPath(sessionId);
   mkdirSync6(maestroSessionsDir(), { recursive: true });
   const messages = extractChatPairs(options.entries).flatMap((pair) => [
-    { role: "user", content: pair.userText },
-    { role: "assistant", content: pair.assistantText }
+    { role: "user", content: nonEmptyTurnText(pair.userText) },
+    { role: "assistant", content: nonEmptyTurnText(pair.assistantText) }
   ]);
   const lines = [
     {
@@ -3661,7 +3665,7 @@ function writeRollout(options) {
   });
   return { sessionId, rolloutPath: path };
 }
-var ALIAS_MAP2, VALID_MODELS, VALID_EFFORTS3, maestroRegistry, maestroRegistryOperations;
+var ALIAS_MAP2, VALID_MODELS, VALID_EFFORTS3, maestroRegistry, BLANK_TURN_PLACEHOLDER = "(no text content in this turn)", maestroRegistryOperations;
 var init_maestro_registry = __esm(() => {
   init_shared();
   init_logger();
@@ -18530,10 +18534,9 @@ function startAiTurn(params) {
     ].join(`
 `);
   }
+  const turnReminders = [];
   if (params.from === FROM_AUTO_CONTINUE) {
-    systemPrompt += `
-
-<system-reminder>\uC774 \uD134\uC740 \uC124\uC815 \uC790\uB3D9 \uC870\uC815(effort/model/agent) \uD6C4 \uC790\uB3D9 \uC7AC\uAC1C\uB41C \uD134\uC774\uB2E4. effort/model/agent \uB09C\uC774\uB3C4 \uC7AC\uD3C9\uAC00 \uBC0F \uC124\uC815 \uBCC0\uACBD \uC5C6\uC774 \uC989\uC2DC \uC791\uC5C5\uC744 \uC2DC\uC791\uD560 \uAC83.</system-reminder>`;
+    turnReminders.push("<system-reminder>\uC774 \uD134\uC740 \uC124\uC815 \uC790\uB3D9 \uC870\uC815(effort/model/agent) \uD6C4 \uC790\uB3D9 \uC7AC\uAC1C\uB41C \uD134\uC774\uB2E4. effort/model/agent \uB09C\uC774\uB3C4 \uC7AC\uD3C9\uAC00 \uBC0F \uC124\uC815 \uBCC0\uACBD \uC5C6\uC774 \uC989\uC2DC \uC791\uC5C5\uC744 \uC2DC\uC791\uD560 \uAC83.</system-reminder>");
   }
   if (!silent && !sessionRetried) {
     const promptsToRecord = userConversationPromptsToRecord(renderedUserPrompts, loggedUserMessageCount, agentPrompt);
@@ -18616,26 +18619,24 @@ function startAiTurn(params) {
         logger.warn({ topicId, err: err2 }, "ai: ensureBgBash failed \u2014 proceeding without background bash tools");
       }
     }
-    let effectiveSystemPrompt = systemPrompt;
     if (playwrightRequested && !browserProfileOwner) {
-      const ownerOnlyNote = "<system-reminder>Browser tools are unavailable in this turn because browser profiles are private to the topic owner. Do not attempt browser calls or ask to reuse the owner's login state.</system-reminder>";
-      effectiveSystemPrompt = `${effectiveSystemPrompt}
-
-${ownerOnlyNote}`;
+      turnReminders.push("<system-reminder>Browser tools are unavailable in this turn because browser profiles are private to the topic owner. Do not attempt browser calls or ask to reuse the owner's login state.</system-reminder>");
     }
     if (consumePlaywrightUnavailable(userId, topic.title)) {
-      const playwrightNote = "<system-reminder>Playwright browser tools are UNAVAILABLE this turn. The `mcp__playwright__*` tools have been removed from this turn's catalog because the long-lived browser MCP could not be prepared. Do not attempt to call browser tools. If browser interaction is required, ask the user to retry shortly or use a non-browser alternative.</system-reminder>";
-      effectiveSystemPrompt = `${effectiveSystemPrompt}
-
-${playwrightNote}`;
+      turnReminders.push("<system-reminder>Playwright browser tools are UNAVAILABLE this turn. The `mcp__playwright__*` tools have been removed from this turn's catalog because the long-lived browser MCP could not be prepared. Do not attempt to call browser tools. If browser interaction is required, ask the user to retry shortly or use a non-browser alternative.</system-reminder>");
     }
+    const effectivePrompt = turnReminders.length > 0 ? `${agentPrompt}
+
+${turnReminders.join(`
+
+`)}` : agentPrompt;
     try {
       yield* runAgent({
         agent: agentKind,
-        prompt: agentPrompt,
+        prompt: effectivePrompt,
         attachments: promptAttachments,
         cwd: workspaceCwd,
-        systemPrompt: effectiveSystemPrompt,
+        systemPrompt,
         sessionId,
         userId,
         vaultUserId,
@@ -22366,6 +22367,253 @@ var init_node_host = __esm(async () => {
   ]);
 });
 
+// ../../packages/core/src/agents/mcp-tools/inline-assets.ts
+import { existsSync as existsSync24, readFileSync as readFileSync20, statSync as statSync13 } from "fs";
+import { extname as extname2, isAbsolute as isAbsolute6, resolve as resolve16 } from "path";
+function isNonLocal(ref) {
+  return /^(?:[a-z][a-z0-9+.-]*:|\/\/|#)/i.test(ref.trim());
+}
+function stripSuffix(ref) {
+  return ref.replace(/[?#].*$/, "");
+}
+function inlineLocalAssets(html, options) {
+  const { baseDir, maxAssetBytes, maxTotalBytes } = options;
+  const inlined = [];
+  const unresolved = [];
+  const skipped = [];
+  const cache = new Map;
+  let budget = maxTotalBytes - Buffer.byteLength(html, "utf-8");
+  function toDataUri(rawRef) {
+    const ref = rawRef.trim();
+    if (!ref || isNonLocal(ref))
+      return null;
+    const cached = cache.get(ref);
+    if (cached !== undefined)
+      return cached;
+    const relPath = stripSuffix(ref);
+    if (!relPath)
+      return null;
+    const abs = isAbsolute6(relPath) ? relPath : resolve16(baseDir, relPath);
+    let bytes;
+    try {
+      if (!existsSync24(abs) || !statSync13(abs).isFile()) {
+        unresolved.push(ref);
+        cache.set(ref, null);
+        return null;
+      }
+      bytes = statSync13(abs).size;
+    } catch {
+      unresolved.push(ref);
+      cache.set(ref, null);
+      return null;
+    }
+    if (bytes > maxAssetBytes) {
+      skipped.push({ ref, bytes, reason: "asset-too-large" });
+      cache.set(ref, null);
+      return null;
+    }
+    const encodedCost = Math.ceil(bytes / 3) * 4;
+    if (encodedCost > budget) {
+      skipped.push({ ref, bytes, reason: "document-too-large" });
+      cache.set(ref, null);
+      return null;
+    }
+    let uri;
+    try {
+      const mime = MIME_BY_EXT[extname2(abs).toLowerCase()] ?? "application/octet-stream";
+      uri = `data:${mime};base64,${readFileSync20(abs).toString("base64")}`;
+    } catch {
+      unresolved.push(ref);
+      cache.set(ref, null);
+      return null;
+    }
+    budget -= uri.length;
+    inlined.push({ ref, bytes });
+    cache.set(ref, uri);
+    return uri;
+  }
+  function rewriteSrcset(value) {
+    return value.split(",").map((candidate) => {
+      const trimmed = candidate.trim();
+      if (!trimmed)
+        return candidate;
+      const [url, ...descriptor] = trimmed.split(/\s+/);
+      const uri = url ? toDataUri(url) : null;
+      if (!uri)
+        return candidate;
+      return [uri, ...descriptor].join(" ");
+    }).join(", ");
+  }
+  let out = html;
+  out = out.replace(/(\b(?:src|poster)\s*=\s*)(["'])([^"']*)\2/gi, (match, prefix, quote, ref) => {
+    const uri = toDataUri(ref);
+    return uri ? `${prefix}${quote}${uri}${quote}` : match;
+  });
+  out = out.replace(/(\bsrcset\s*=\s*)(["'])([^"']*)\2/gi, (match, prefix, quote, value) => {
+    const rewritten = rewriteSrcset(value);
+    return rewritten === value ? match : `${prefix}${quote}${rewritten}${quote}`;
+  });
+  out = out.replace(/<link\b[^>]*>/gi, (tag) => tag.replace(/(\bhref\s*=\s*)(["'])([^"']*)\2/i, (match, prefix, quote, ref) => {
+    const uri = toDataUri(ref);
+    return uri ? `${prefix}${quote}${uri}${quote}` : match;
+  }));
+  out = out.replace(/url\(\s*(["']?)([^"')]+)\1\s*\)/gi, (match, quote, ref) => {
+    const uri = toDataUri(ref);
+    return uri ? `url(${quote}${uri}${quote})` : match;
+  });
+  return { html: out, inlined, unresolved, skipped };
+}
+var MIME_BY_EXT;
+var init_inline_assets = __esm(() => {
+  MIME_BY_EXT = {
+    ".apng": "image/apng",
+    ".avif": "image/avif",
+    ".bmp": "image/bmp",
+    ".css": "text/css",
+    ".gif": "image/gif",
+    ".ico": "image/x-icon",
+    ".jpeg": "image/jpeg",
+    ".jpg": "image/jpeg",
+    ".mp3": "audio/mpeg",
+    ".mp4": "video/mp4",
+    ".otf": "font/otf",
+    ".png": "image/png",
+    ".svg": "image/svg+xml",
+    ".ttf": "font/ttf",
+    ".wav": "audio/wav",
+    ".webm": "video/webm",
+    ".webp": "image/webp",
+    ".woff": "font/woff",
+    ".woff2": "font/woff2"
+  };
+});
+
+// ../../packages/core/src/agents/mcp-tools/publish-html.ts
+import { z as z5 } from "zod";
+function formatPublishBytes(bytes) {
+  if (bytes < 1024)
+    return `${bytes}B`;
+  if (bytes < 1024 * 1024)
+    return `${(bytes / 1024).toFixed(0)}KB`;
+  return `${(bytes / 1024 / 1024).toFixed(1)}MB`;
+}
+function parseSnippetId(input) {
+  const trimmed = input.trim();
+  const fromUrl = trimmed.match(/\/snippets\/([A-Za-z0-9-]+)/)?.[1];
+  const id = fromUrl ?? trimmed;
+  return /^[A-Za-z0-9-]+$/.test(id) ? id : null;
+}
+async function snippetRequest(baseUrl, path, init = {}) {
+  try {
+    const response = await fetch(`${baseUrl}${path}`, {
+      ...init,
+      signal: AbortSignal.timeout(REQUEST_TIMEOUT_MS)
+    });
+    const body = await response.json().catch(() => null);
+    if (body)
+      return body;
+    return { ok: false, error: `snippet service returned ${response.status}` };
+  } catch (error) {
+    const message = error instanceof Error ? error.message : "snippet service unreachable";
+    return { ok: false, error: message };
+  }
+}
+function createPublishHtmlToolDefinitions(ctx, options = {}) {
+  const apiUrl = (options.apiUrl ?? SNIPPETS_API_URL)?.replace(/\/+$/, "");
+  if (!apiUrl)
+    return [];
+  const getCtx = typeof ctx === "function" ? ctx : () => ctx;
+  return [
+    {
+      name: "publish_html",
+      description: [
+        "Publish an HTML document and return a public, shareable https link that",
+        "stays live for 72 hours. Use this when the user should be able to open,",
+        "keep, or send the result \u2014 a report, dashboard, or styled table \u2014 rather",
+        "than only glance at it in the side panel.",
+        "Pass a complete standalone document and inline the CSS and JS.",
+        "For charts and diagrams prefer inline <svg>: it stays sharp at any zoom",
+        "and is far smaller than an image file.",
+        "Images may be remote URLs, data: URIs, or paths to local files you",
+        "created \u2014 local files are embedded automatically, so the page keeps",
+        "working after your workspace is gone."
+      ].join(" "),
+      schema: {
+        html: z5.string().describe("Complete standalone HTML document to publish. Inline the CSS and JS."),
+        base_dir: z5.string().optional().describe("Directory that relative image paths resolve against. Defaults to the working directory.")
+      },
+      async handler(input) {
+        const html = input?.html ?? "";
+        if (!html.trim())
+          return errorResult("html is empty \u2014 provide an HTML document.");
+        const baseDir = input.base_dir?.trim() || getCtx().cwd || process.cwd();
+        const report = inlineLocalAssets(html, {
+          baseDir,
+          maxAssetBytes: MAX_PUBLISHED_ASSET_BYTES,
+          maxTotalBytes: MAX_PUBLISHED_BYTES
+        });
+        const bytes = Buffer.byteLength(report.html, "utf-8");
+        if (bytes > MAX_PUBLISHED_BYTES) {
+          return errorResult(`Document is ${formatPublishBytes(bytes)} after embedding images, over the ${formatPublishBytes(MAX_PUBLISHED_BYTES)} limit. Use fewer or smaller images, or switch charts to inline <svg>.`);
+        }
+        const result = await snippetRequest(apiUrl, "/snippets", {
+          method: "POST",
+          headers: { "content-type": "text/html; charset=utf-8" },
+          body: report.html
+        });
+        if (!result.ok || !result.url) {
+          return errorResult(result.error ?? "Failed to publish.");
+        }
+        const notes = [];
+        if (report.inlined.length > 0) {
+          const total = report.inlined.reduce((sum, a) => sum + a.bytes, 0);
+          notes.push(`Embedded ${report.inlined.length} local file(s), ${formatPublishBytes(total)}.`);
+        }
+        if (report.unresolved.length > 0) {
+          notes.push(`WARNING \u2014 these look like local files but were not found, so they will render broken: ${report.unresolved.join(", ")}. Check the paths (relative to ${baseDir}) and republish.`);
+        }
+        for (const s of report.skipped) {
+          notes.push(s.reason === "asset-too-large" ? `WARNING \u2014 ${s.ref} is ${formatPublishBytes(s.bytes)}, over the ${formatPublishBytes(MAX_PUBLISHED_ASSET_BYTES)} per-file limit, and was left as a broken link.` : `WARNING \u2014 ${s.ref} was left out because the document hit the ${formatPublishBytes(MAX_PUBLISHED_BYTES)} limit.`);
+        }
+        const payload = {
+          url: result.url,
+          snippetId: result.snippetId,
+          expiresAt: result.expiresAt,
+          sizeBytes: bytes,
+          ...report.inlined.length > 0 ? { embeddedFiles: report.inlined.length } : {}
+        };
+        return textResult([JSON.stringify(payload, null, 2), ...notes].join(`
+
+`));
+      }
+    },
+    {
+      name: "unpublish_html",
+      description: "Delete a previously published HTML document before its 72-hour expiry. Accepts the URL returned by publish_html, or its id.",
+      schema: {
+        snippet: z5.string().describe("URL returned by publish_html, or the bare id.")
+      },
+      async handler(input) {
+        const id = parseSnippetId(input?.snippet ?? "");
+        if (!id)
+          return errorResult("Could not read a published document id from that value.");
+        const result = await snippetRequest(apiUrl, `/snippets/${id}`, { method: "DELETE" });
+        if (!result.ok)
+          return errorResult(result.error ?? "Failed to delete.");
+        return textResult(`Published document ${id} deleted.`);
+      }
+    }
+  ];
+}
+var REQUEST_TIMEOUT_MS = 30000, MAX_PUBLISHED_BYTES, MAX_PUBLISHED_ASSET_BYTES;
+var init_publish_html = __esm(() => {
+  init_common();
+  init_inline_assets();
+  init_config();
+  MAX_PUBLISHED_BYTES = 10 * 1024 * 1024;
+  MAX_PUBLISHED_ASSET_BYTES = 5 * 1024 * 1024;
+});
+
 // ../../packages/core/src/mcp-runtime-host.ts
 var exports_mcp_runtime_host = {};
 __export(exports_mcp_runtime_host, {
@@ -22397,6 +22645,7 @@ __export(exports_mcp_runtime_host, {
   createSubagentManagementToolDefinitions: () => createSubagentManagementToolDefinitions,
   createSpawnSubagentToolDefinition: () => createSpawnSubagentToolDefinition,
   createSelfConfigToolDefinitions: () => createSelfConfigToolDefinitions,
+  createPublishHtmlToolDefinitions: () => createPublishHtmlToolDefinitions,
   createPrepareSubagentToolDefinition: () => createPrepareSubagentToolDefinition,
   createAskUserToolDefinition: () => createAskUserToolDefinition,
   canSpawnSubagentsFromTopic: () => canSpawnSubagentsFromTopic,
@@ -22420,6 +22669,7 @@ __export(exports_mcp_runtime_host, {
 });
 var init_mcp_runtime_host = __esm(async () => {
   init_common();
+  init_publish_html();
   init_visuals2();
   init_runtime_spec();
   init_config();
@@ -22449,7 +22699,7 @@ var init_mcp_runtime_host = __esm(async () => {
 });
 
 // ../../packages/mcp/src/node-tools.ts
-import { z as z5 } from "zod";
+import { z as z6 } from "zod";
 function resolveTopicForUser(ctx, ref) {
   const trimmed = ref.trim();
   if (!trimmed)
@@ -22473,11 +22723,11 @@ function describeTopic(topic) {
 }
 function registerNodeTools(server, ctx) {
   server.tool("register_topic", "Create a new topic (agent room) on this negotium node, owned by the calling user. " + "Returns the new topic's id, title, agent, and model. Use the session-comm tell_session " + "tool to hand the new topic work.", {
-    title: z5.string().describe("Unique title for the new topic."),
-    agent: z5.enum(["claude", "codex", "maestro"]).optional().describe("AI backend for the room. Defaults to maestro."),
-    model: z5.string().optional().describe("Model override, must be valid for the agent."),
-    effort: z5.enum(EFFORT_VALUES).optional().describe("Reasoning effort override for the room."),
-    description: z5.string().optional().describe("Short description of the topic's purpose.")
+    title: z6.string().describe("Unique title for the new topic."),
+    agent: z6.enum(["claude", "codex", "maestro"]).optional().describe("AI backend for the room. Defaults to maestro."),
+    model: z6.string().optional().describe("Model override, must be valid for the agent."),
+    effort: z6.enum(EFFORT_VALUES).optional().describe("Reasoning effort override for the room."),
+    description: z6.string().optional().describe("Short description of the topic's purpose.")
   }, async ({ title, agent, model, effort, description }) => {
     try {
       const topic = registerTopic({
@@ -22512,7 +22762,7 @@ function registerNodeTools(server, ctx) {
 `));
   });
   server.tool("abort_topic", "Abort the running turn in another topic on this node. Fire-and-forget: also queues an abort " + "signal in the topic's inbox so a turn that has not started yet is cancelled too. Returns whether an active turn was aborted.", {
-    topic: z5.string().describe("Target topic title or id.")
+    topic: z6.string().describe("Target topic title or id.")
   }, async ({ topic }) => {
     const resolved = resolveTopicForUser(ctx, topic);
     if ("error" in resolved)
@@ -22537,7 +22787,7 @@ function registerNodeTools(server, ctx) {
     return textResult(queued ? `No active turn in "${target.title}"; abort signal queued in its inbox.` : `No active turn in "${target.title}", and the abort signal could NOT be queued ` + `(its inbox is locked). The topic will run its queued work; retry shortly.`);
   });
   server.tool("restart_topic", "Reset another topic's AI context while preserving the topic and its visible message history. " + "The next message starts a fresh provider session. Only the topic owner can restart it.", {
-    topic: z5.string().describe("Target topic title or id.")
+    topic: z6.string().describe("Target topic title or id.")
   }, async ({ topic }) => {
     const resolved = resolveTopicForUser(ctx, topic);
     if ("error" in resolved)
@@ -22553,8 +22803,8 @@ function registerNodeTools(server, ctx) {
     return result.isError ? errorResult(`Error: ${result.text}`) : textResult(result.text);
   });
   server.tool("delete_topic", "Delete a topic owned by the calling user after archiving its conversation history. Deletion is blocked " + "when the archive cannot be written; pass force: true only as an explicit escape hatch that accepts losing history.", {
-    topic: z5.string().describe("Target topic title or id."),
-    force: z5.boolean().optional().describe("Delete even if archiving the conversation history fails. Default false.")
+    topic: z6.string().describe("Target topic title or id."),
+    force: z6.boolean().optional().describe("Delete even if archiving the conversation history fails. Default false.")
   }, async ({ topic, force }) => {
     const resolved = resolveTopicForUser(ctx, topic);
     if ("error" in resolved)
@@ -22600,7 +22850,7 @@ __export(exports_task, {
   createTaskMcpServer: () => createTaskMcpServer
 });
 import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
-import { z as z6 } from "zod";
+import { z as z7 } from "zod";
 function createTaskMcpServer(context, host2 = defaultTaskMcpHost) {
   const scopeKey = context.topic ? taskScopeKey({ topicId: context.topicId, session: context.topic }) : "";
   const server = new McpServer({ name: "task", version: "1.0.0" });
@@ -22610,13 +22860,13 @@ function createTaskMcpServer(context, host2 = defaultTaskMcpHost) {
     }
     return null;
   };
-  const statusEnum = z6.enum(TASK_STATUS_VALUES);
+  const statusEnum = z7.enum(TASK_STATUS_VALUES);
   server.tool("task_create", "Add one or more tasks to this topic's shared Otium task list. Use this instead of provider-native todo/task tools.", {
-    tasks: z6.array(z6.object({
-      subject: z6.string().min(1).describe("Short imperative task description"),
-      active_form: z6.string().optional().describe("Label to show while the task is in progress"),
-      blocked_by: z6.array(z6.string()).optional().describe("Task ids blocking this task"),
-      owner: z6.string().optional().describe("Owner/agent label for multi-agent work")
+    tasks: z7.array(z7.object({
+      subject: z7.string().min(1).describe("Short imperative task description"),
+      active_form: z7.string().optional().describe("Label to show while the task is in progress"),
+      blocked_by: z7.array(z7.string()).optional().describe("Task ids blocking this task"),
+      owner: z7.string().optional().describe("Owner/agent label for multi-agent work")
     })).min(1)
   }, async ({ tasks: inputs }) => {
     const guard = requireContext();
@@ -22640,13 +22890,13 @@ ${renderTaskList(tasks2)}`);
     }
   });
   server.tool("task_update", "Update task status/content in this topic's shared Otium task list. Batch related status changes in one call.", {
-    updates: z6.array(z6.object({
-      id: z6.string().describe("Target task id"),
+    updates: z7.array(z7.object({
+      id: z7.string().describe("Target task id"),
       status: statusEnum.optional().describe("New status"),
-      subject: z6.string().min(1).optional().describe("Replacement task description"),
-      active_form: z6.string().optional().describe("Replacement in-progress label; empty string clears it"),
-      blocked_by: z6.array(z6.string()).optional().describe("Replacement blocker id list"),
-      owner: z6.string().optional().describe("Replacement owner; empty string clears it")
+      subject: z7.string().min(1).optional().describe("Replacement task description"),
+      active_form: z7.string().optional().describe("Replacement in-progress label; empty string clears it"),
+      blocked_by: z7.array(z7.string()).optional().describe("Replacement blocker id list"),
+      owner: z7.string().optional().describe("Replacement owner; empty string clears it")
     })).min(1)
   }, async ({ updates }) => {
     const guard = requireContext();
@@ -22680,7 +22930,7 @@ Missing ids ignored: ${missing.join(", ")}` : "";
       return mcpError(`task_list failed: ${errMsg(error)}`);
     }
   });
-  server.tool("task_get", "Read one task from this topic's shared Otium task list as JSON.", { id: z6.string().describe("Task id") }, async ({ id }) => {
+  server.tool("task_get", "Read one task from this topic's shared Otium task list as JSON.", { id: z7.string().describe("Task id") }, async ({ id }) => {
     const guard = requireContext();
     if (guard)
       return guard;
@@ -22694,8 +22944,8 @@ Missing ids ignored: ${missing.join(", ")}` : "";
     }
   });
   server.tool("task_delete", "Delete tasks from this topic's shared Otium task list. Use all=true only when starting a new plan.", {
-    ids: z6.array(z6.string()).optional().describe("Task ids to delete"),
-    all: z6.boolean().optional().describe("Delete the whole list")
+    ids: z7.array(z7.string()).optional().describe("Task ids to delete"),
+    all: z7.boolean().optional().describe("Delete the whole list")
   }, async ({ ids, all }) => {
     const guard = requireContext();
     if (guard)
@@ -22732,7 +22982,7 @@ __export(exports_token_stats2, {
   createTokenStatsMcpServer: () => createTokenStatsMcpServer
 });
 import { McpServer as McpServer2 } from "@modelcontextprotocol/sdk/server/mcp.js";
-import { z as z7 } from "zod";
+import { z as z8 } from "zod";
 function createTokenStatsMcpServer(context, host2 = defaultTokenStatsMcpHost) {
   if (!context.userId)
     throw new Error("token-stats MCP requires userId");
@@ -22748,9 +22998,9 @@ function createTokenStatsMcpServer(context, host2 = defaultTokenStatsMcpHost) {
     "groupBy: 'session'\uC73C\uB85C \uC124\uC815\uD558\uBA74 \uC138\uC158\uBCC4 \uD1A0\uD070 \uC0AC\uC6A9\uB7C9 \uB7AD\uD0B9\uC744 \uBC18\uD658\uD569\uB2C8\uB2E4."
   ].join(`
 `), {
-    from: z7.string().optional().describe("\uC2DC\uC791 \uC2DC\uAC01 ISO 8601. \uC608: '2026-03-28T09:00:00Z'"),
-    to: z7.string().optional().describe("\uC885\uB8CC \uC2DC\uAC01 ISO 8601. \uC0DD\uB7B5 \uC2DC \uD604\uC7AC"),
-    groupBy: z7.enum(["hour", "session"]).optional().describe("\uC9D1\uACC4 \uAE30\uC900. \uAE30\uBCF8\uAC12: hour")
+    from: z8.string().optional().describe("\uC2DC\uC791 \uC2DC\uAC01 ISO 8601. \uC608: '2026-03-28T09:00:00Z'"),
+    to: z8.string().optional().describe("\uC885\uB8CC \uC2DC\uAC01 ISO 8601. \uC0DD\uB7B5 \uC2DC \uD604\uC7AC"),
+    groupBy: z8.enum(["hour", "session"]).optional().describe("\uC9D1\uACC4 \uAE30\uC900. \uAE30\uBCF8\uAC12: hour")
   }, async ({ from, to, groupBy = "hour" }) => {
     const { total, byHour, bySession, estimatedCostUsd } = host2.getStats(context.userId, from, to);
     const lines = [
@@ -22957,10 +23207,10 @@ __export(exports_agent_health, {
   createAgentHealthMcpServer: () => createAgentHealthMcpServer
 });
 import { spawn as spawn6 } from "child_process";
-import { existsSync as existsSync24, readdirSync as readdirSync8 } from "fs";
+import { existsSync as existsSync25, readdirSync as readdirSync8 } from "fs";
 import { join as join33 } from "path";
 import { McpServer as McpServer4 } from "@modelcontextprotocol/sdk/server/mcp.js";
-import { z as z8 } from "zod";
+import { z as z9 } from "zod";
 function signalProcessTree2(child, signal) {
   try {
     if (child.pid && process.platform !== "win32")
@@ -22974,7 +23224,7 @@ function signalProcessTree2(child, signal) {
   }
 }
 function spawnCapture(cmd, args, timeoutMs, signal, env) {
-  return new Promise((resolve16, reject) => {
+  return new Promise((resolve17, reject) => {
     const child = spawn6(cmd, args, {
       env: env ?? process.env,
       stdio: ["ignore", "pipe", "pipe"],
@@ -23032,7 +23282,7 @@ function spawnCapture(cmd, args, timeoutMs, signal, env) {
       if (killTimer)
         clearTimeout(killTimer);
       if (code === 0)
-        resolve16({ stdout, stderr });
+        resolve17({ stdout, stderr });
       else
         reject(new Error(stderr.trim() || `${cmd} exited with ${code ?? exitSignal}`));
     });
@@ -23110,11 +23360,11 @@ async function checkMaestro(model, timeoutMs, signal) {
       const remaining = deadline - Date.now();
       if (remaining <= 0)
         throw new Error("timeout");
-      const eventResult = await new Promise((resolve16, reject) => {
+      const eventResult = await new Promise((resolve17, reject) => {
         const timeout = setTimeout(() => reject(new Error("timeout")), remaining);
         const onAbort = () => reject(new Error("aborted"));
         signal.addEventListener("abort", onAbort, { once: true });
-        activeIterator.next().then(resolve16, reject).finally(() => {
+        activeIterator.next().then(resolve17, reject).finally(() => {
           clearTimeout(timeout);
           signal.removeEventListener("abort", onAbort);
         });
@@ -23144,7 +23394,7 @@ function getDefaultModel(registry) {
 }
 async function withCheckSlot(operation) {
   if (activeChecks >= MAX_CONCURRENT_CHECKS) {
-    await new Promise((resolve16) => checkWaiters.push(resolve16));
+    await new Promise((resolve17) => checkWaiters.push(resolve17));
   }
   activeChecks += 1;
   try {
@@ -23163,9 +23413,9 @@ function createAgentHealthMcpServer(context) {
     await originalClose();
   };
   server.tool("check_agent", "\uC2E4\uC81C API \uD638\uCD9C\uB85C \uD2B9\uC815 agent+model \uC870\uD569\uC774 \uC815\uC0C1 \uB3D9\uC791\uD558\uB294\uC9C0 \uCCB4\uD06C\uD569\uB2C8\uB2E4.", {
-    agent: z8.enum(["claude", "codex", "maestro"]).describe("\uCCB4\uD06C\uD560 agent"),
-    model: z8.string().optional().describe("\uCCB4\uD06C\uD560 \uBAA8\uB378 (\uC5C6\uC73C\uBA74 agent\uBCC4 default \uC0AC\uC6A9)"),
-    timeoutMs: z8.number().default(30000).describe("\uD0C0\uC784\uC544\uC6C3 (ms), \uAE30\uBCF8 30\uCD08")
+    agent: z9.enum(["claude", "codex", "maestro"]).describe("\uCCB4\uD06C\uD560 agent"),
+    model: z9.string().optional().describe("\uCCB4\uD06C\uD560 \uBAA8\uB378 (\uC5C6\uC73C\uBA74 agent\uBCC4 default \uC0AC\uC6A9)"),
+    timeoutMs: z9.number().default(30000).describe("\uD0C0\uC784\uC544\uC6C3 (ms), \uAE30\uBCF8 30\uCD08")
   }, async ({ agent, model, timeoutMs }) => {
     const entry = AGENTS.find((candidate) => candidate.kind === agent);
     if (!entry)
@@ -23181,7 +23431,7 @@ function createAgentHealthMcpServer(context) {
    latency: ${result.latency}ms
    error: ${result.error}`);
   });
-  server.tool("check_all", "\uBAA8\uB4E0 agent (claude, codex, maestro)\uB97C \uAE30\uBCF8 \uBAA8\uB378\uB85C \uB3D9\uC2DC\uC5D0 \uCCB4\uD06C\uD569\uB2C8\uB2E4.", { timeoutMs: z8.number().default(30000).describe("agent\uBCC4 \uD0C0\uC784\uC544\uC6C3 (ms), \uAE30\uBCF8 30\uCD08") }, async ({ timeoutMs }) => {
+  server.tool("check_all", "\uBAA8\uB4E0 agent (claude, codex, maestro)\uB97C \uAE30\uBCF8 \uBAA8\uB378\uB85C \uB3D9\uC2DC\uC5D0 \uCCB4\uD06C\uD569\uB2C8\uB2E4.", { timeoutMs: z9.number().default(30000).describe("agent\uBCC4 \uD0C0\uC784\uC544\uC6C3 (ms), \uAE30\uBCF8 30\uCD08") }, async ({ timeoutMs }) => {
     const userKey = context.userId ?? "unscoped";
     if (activeCheckAllUsers.has(userKey)) {
       return mcpOk("FAIL check_all is already running for this user");
@@ -23203,7 +23453,7 @@ ${results.every((result) => result.ok) ? "All agents healthy" : "Some agents fai
     if (!context.userId)
       return mcpOk("\uC2E4\uD589 \uC911\uC778 \uCFFC\uB9AC \uC870\uD68C \uBD88\uAC00 (user context \uC5C6\uC74C)");
     const stateDir = join33(USERS_LOG_DIR, context.userId, "active-queries");
-    if (!existsSync24(stateDir))
+    if (!existsSync25(stateDir))
       return mcpOk("\uC2E4\uD589 \uC911\uC778 \uCFFC\uB9AC \uC5C6\uC74C");
     let files;
     try {
@@ -23294,7 +23544,7 @@ __export(exports_session_comm, {
   createSessionCommMcpServer: () => createSessionCommMcpServer
 });
 import { McpServer as McpServer5 } from "@modelcontextprotocol/sdk/server/mcp.js";
-import { z as z9 } from "zod";
+import { z as z10 } from "zod";
 function createSessionCommMcpServer(context, host2, options = {}) {
   const server = new McpServer5({ name: "session-comm", version: "2.0.0" });
   const required = options.requiredMcpServers?.join(", ") || "none";
@@ -23302,28 +23552,28 @@ function createSessionCommMcpServer(context, host2, options = {}) {
   const subagentIdentity = resolveSubagentTellIdentity(context.currentTopicId, context.subagentParentTopicId);
   server.tool("list_sessions", "List available sessions and remote peer sessions for inter-session communication.", {}, async () => host2.listSessions(context));
   server.tool("configure_mcp", `Configure optional MCP servers for the current topic. Required: ${required}. Optional: ${optional}.`, {
-    enabled: z9.array(z9.string()).nullable().optional()
+    enabled: z10.array(z10.string()).nullable().optional()
   }, async ({ enabled }) => host2.configureMcp(context, enabled));
   server.tool("get_mcp_config", "Get the current topic MCP configuration.", {}, async () => host2.getMcpConfig(context));
   if (host2.getBrowserProfile) {
     server.tool("get_browser_profile", "Get this topic's browser profile and the profiles owned by the same user.", {}, async () => host2.getBrowserProfile(context));
   }
   if (host2.setBrowserProfile) {
-    server.tool("set_browser_profile", "Assign this topic to a named shared browser profile. Takes effect next turn.", { profile: z9.string() }, async ({ profile }) => host2.setBrowserProfile(context, profile));
+    server.tool("set_browser_profile", "Assign this topic to a named shared browser profile. Takes effect next turn.", { profile: z10.string() }, async ({ profile }) => host2.setBrowserProfile(context, profile));
   }
   if (host2.deleteBrowserProfile) {
-    server.tool("delete_browser_profile", "Delete an unused named browser profile and its on-disk data. The default or an assigned profile cannot be deleted.", { profile: z9.string() }, async ({ profile }) => host2.deleteBrowserProfile(context, profile));
+    server.tool("delete_browser_profile", "Delete an unused named browser profile and its on-disk data. The default or an assigned profile cannot be deleted.", { profile: z10.string() }, async ({ profile }) => host2.deleteBrowserProfile(context, profile));
   }
   server.tool("peek_session", "Inspect running and idle sessions, including pending ask_session calls.", {}, async () => host2.peekSession(context));
-  server.tool("set_description", "Set the current session description used as a routing hint.", { description: z9.string() }, async ({ description }) => host2.setDescription(context, description));
+  server.tool("set_description", "Set the current session description used as a routing hint.", { description: z10.string() }, async ({ description }) => host2.setDescription(context, description));
   if (!context.replyOnly) {
     if (!subagentIdentity.restricted) {
-      server.tool("ask_session", "Ask another local or remote session a question and wait for its answer.", { to: z9.string(), message: z9.string() }, async (input) => host2.askSession(context, input));
+      server.tool("ask_session", "Ask another local or remote session a question and wait for its answer.", { to: z10.string(), message: z10.string() }, async (input) => host2.askSession(context, input));
     }
     if (!subagentIdentity.restricted) {
-      server.tool("abort_session", "Abort the active query in another session.", { to: z9.string() }, async ({ to }) => host2.abortSession(context, to));
+      server.tool("abort_session", "Abort the active query in another session.", { to: z10.string() }, async ({ to }) => host2.abortSession(context, to));
     }
-    server.tool("tell_session", "Send a one-way message to another local or remote session.", { to: z9.string(), message: z9.string() }, async (input) => {
+    server.tool("tell_session", "Send a one-way message to another local or remote session.", { to: z10.string(), message: z10.string() }, async (input) => {
       if (subagentIdentity.restricted && !canSubagentTellTargetByName(subagentIdentity, input.to)) {
         return {
           content: [
@@ -23998,7 +24248,7 @@ async function executeVaultRun(userId, request, host2) {
   const stdoutState = { bytes: 0, truncated: false };
   const stderrState = { bytes: 0, truncated: false };
   const startedAt = Date.now();
-  return await new Promise((resolve16) => {
+  return await new Promise((resolve17) => {
     const child = spawn7(process.env.SHELL || "/bin/sh", ["-s"], {
       cwd: request.cwd,
       detached: true,
@@ -24031,7 +24281,7 @@ async function executeVaultRun(userId, request, host2) {
         durationMs: Date.now() - startedAt,
         timedOut
       }, "vault credential command used");
-      resolve16({ ...result, usedKeys: substitution.usedKeys });
+      resolve17({ ...result, usedKeys: substitution.usedKeys });
     };
     child.stdout.on("data", (chunk) => appendBounded(stdoutChunks, chunk, stdoutState, maxOutputBytes));
     child.stderr.on("data", (chunk) => appendBounded(stderrChunks, chunk, stderrState, maxOutputBytes));
@@ -24075,7 +24325,7 @@ __export(exports_vault, {
   createVaultMcpServer: () => createVaultMcpServer
 });
 import { McpServer as McpServer6 } from "@modelcontextprotocol/sdk/server/mcp.js";
-import { z as z10 } from "zod";
+import { z as z11 } from "zod";
 function createVaultMcpServer(context, host2, executors = {}) {
   const server = new McpServer6({ name: "vault", version: "1.0.0" });
   const run = executors.run ?? executeVaultRun;
@@ -24093,9 +24343,9 @@ ${lines.join(`
   });
   if (!context.listOnly && !context.httpOnly) {
     server.tool("vault_run", "Run a shell command containing {{KEY}} references inside Otium's credential broker. Expanded command input never reaches the model/provider, and stdout/stderr are redacted before return. Prefer vault_http_request for HTTP APIs.", {
-      command: z10.string().min(1).max(64 * 1024),
-      timeout_ms: z10.number().int().min(1000).max(600000).optional(),
-      max_output_bytes: z10.number().int().min(1024).max(2 * 1024 * 1024).optional()
+      command: z11.string().min(1).max(64 * 1024),
+      timeout_ms: z11.number().int().min(1000).max(600000).optional(),
+      max_output_bytes: z11.number().int().min(1024).max(2 * 1024 * 1024).optional()
     }, async ({ command, timeout_ms, max_output_bytes }) => {
       if (!context.userId)
         return mcpError("Vault unavailable: no user context");
@@ -24110,12 +24360,12 @@ ${lines.join(`
   }
   if (!context.listOnly)
     server.tool("vault_http_request", "Make an HTTPS request with {{KEY}} references resolved inside Otium. Put secrets in headers or body, never in the URL. The expanded request is not returned; the response is redacted before the model sees it.", {
-      method: z10.enum(["GET", "POST", "PUT", "PATCH", "DELETE"]).default("GET"),
-      url: z10.string().url().describe("Absolute HTTPS URL without Vault placeholders"),
-      headers: z10.record(z10.string(), z10.string()).optional(),
-      body: z10.string().optional(),
-      timeout_ms: z10.number().int().min(1000).max(120000).optional(),
-      max_response_bytes: z10.number().int().min(1024).max(1024 * 1024).optional()
+      method: z11.enum(["GET", "POST", "PUT", "PATCH", "DELETE"]).default("GET"),
+      url: z11.string().url().describe("Absolute HTTPS URL without Vault placeholders"),
+      headers: z11.record(z11.string(), z11.string()).optional(),
+      body: z11.string().optional(),
+      timeout_ms: z11.number().int().min(1000).max(120000).optional(),
+      max_response_bytes: z11.number().int().min(1024).max(1024 * 1024).optional()
     }, async ({ method, url, headers, body, timeout_ms, max_response_bytes }) => {
       if (!context.userId)
         return mcpError("Vault unavailable: no user context");
@@ -24147,17 +24397,17 @@ import { AsyncLocalStorage as AsyncLocalStorage3 } from "async_hooks";
 import { randomUUID as randomUUID21 } from "crypto";
 import {
   closeSync as closeSync3,
-  existsSync as existsSync25,
+  existsSync as existsSync26,
   mkdirSync as mkdirSync24,
   openSync as openSync3,
   readdirSync as readdirSync9,
-  readFileSync as readFileSync20,
+  readFileSync as readFileSync21,
   renameSync as renameSync10,
-  statSync as statSync13,
+  statSync as statSync14,
   unlinkSync as unlinkSync18,
   writeFileSync as writeFileSync17
 } from "fs";
-import { basename as basename7, dirname as dirname16, join as join35, resolve as resolve16 } from "path";
+import { basename as basename7, dirname as dirname16, join as join35, resolve as resolve17 } from "path";
 import { Server } from "@modelcontextprotocol/sdk/server/index.js";
 import { StdioServerTransport as StdioServerTransport2 } from "@modelcontextprotocol/sdk/server/stdio.js";
 import {
@@ -24204,7 +24454,7 @@ function acquireRecoveryGuard(lockPath) {
       return () => {
         closeSync3(fd);
         try {
-          if (readFileSync20(guardPath, "utf-8") === ownerToken)
+          if (readFileSync21(guardPath, "utf-8") === ownerToken)
             unlinkSync18(guardPath);
         } catch {}
       };
@@ -24238,7 +24488,7 @@ function acquireFileLock(path) {
         closeSync3(fd);
         const releaseGuard = acquireRecoveryGuard(lockPath);
         try {
-          if (readFileSync20(lockPath, "utf-8") === ownerToken)
+          if (readFileSync21(lockPath, "utf-8") === ownerToken)
             unlinkSync18(lockPath);
         } catch {} finally {
           releaseGuard();
@@ -24250,8 +24500,8 @@ function acquireFileLock(path) {
       const releaseGuard = acquireRecoveryGuard(lockPath);
       try {
         try {
-          const staleToken = readFileSync20(lockPath, "utf-8");
-          if (Date.now() - statSync13(lockPath).mtimeMs > FILE_LOCK_STALE_MS && readFileSync20(lockPath, "utf-8") === staleToken) {
+          const staleToken = readFileSync21(lockPath, "utf-8");
+          if (Date.now() - statSync14(lockPath).mtimeMs > FILE_LOCK_STALE_MS && readFileSync21(lockPath, "utf-8") === staleToken) {
             unlinkSync18(lockPath);
             continue;
           }
@@ -24314,7 +24564,7 @@ function wikiQuery(args) {
                   continue;
                 const fp = join35(sub, f.name);
                 try {
-                  const text2 = readFileSync20(fp, "utf-8");
+                  const text2 = readFileSync21(fp, "utf-8");
                   scored.push({
                     score: scoreMatch(text2),
                     path: `${label}/${entry.name}/${f.name}`,
@@ -24327,7 +24577,7 @@ function wikiQuery(args) {
         } else if (entry.isFile() && entry.name.endsWith(".md")) {
           const fp = join35(dir, entry.name);
           try {
-            const text2 = readFileSync20(fp, "utf-8");
+            const text2 = readFileSync21(fp, "utf-8");
             scored.push({
               score: scoreMatch(text2),
               path: `${label}/${entry.name}`,
@@ -24433,20 +24683,20 @@ function wikiLastConversation(args) {
     return { content: [{ type: "text", text: "No topic specified." }] };
   }
   const name = slugify(topicNameFrom(rawTopic));
-  const archiveDir = resolve16(runtime().archiveDir, name);
+  const archiveDir = resolve17(runtime().archiveDir, name);
   try {
-    let files = existsSync25(archiveDir) ? readdirSync9(archiveDir).filter((f) => f.endsWith(".jsonl")).sort().reverse() : [];
+    let files = existsSync26(archiveDir) ? readdirSync9(archiveDir).filter((f) => f.endsWith(".jsonl")).sort().reverse() : [];
     if (files.length === 0) {
-      files = existsSync25(runtime().archiveDir) ? readdirSync9(runtime().archiveDir).filter((f) => f.startsWith(name) && f.endsWith(".jsonl")).sort().reverse() : [];
+      files = existsSync26(runtime().archiveDir) ? readdirSync9(runtime().archiveDir).filter((f) => f.startsWith(name) && f.endsWith(".jsonl")).sort().reverse() : [];
     }
     if (files.length === 0) {
       return {
         content: [{ type: "text", text: `No archive found for topic: ${rawTopic}` }]
       };
     }
-    const actualPath = files[0].includes("/") ? files[0] : resolve16(existsSync25(archiveDir) && readdirSync9(archiveDir).includes(files[0]) ? archiveDir : runtime().archiveDir, files[0]);
+    const actualPath = files[0].includes("/") ? files[0] : resolve17(existsSync26(archiveDir) && readdirSync9(archiveDir).includes(files[0]) ? archiveDir : runtime().archiveDir, files[0]);
     try {
-      const raw = readFileSync20(actualPath, "utf-8");
+      const raw = readFileSync21(actualPath, "utf-8");
       const lines = raw.trim().split(`
 `).filter(Boolean);
       const turns2 = [];
@@ -24517,9 +24767,9 @@ function skillQuery(args) {
     })) {
       if (!entry.isDirectory())
         continue;
-      const skillFile = resolve16(runtime().skillsDir, entry.name, "skill.md");
+      const skillFile = resolve17(runtime().skillsDir, entry.name, "skill.md");
       try {
-        const text2 = readFileSync20(skillFile, "utf-8");
+        const text2 = readFileSync21(skillFile, "utf-8");
         const lower = text2.toLowerCase();
         let score = 0;
         for (const w of query2.split(/\s+/).filter(Boolean)) {
@@ -24585,12 +24835,12 @@ ${fresh.join(`
 `)}
 `;
   }
-  const skillDir = resolve16(runtime().skillsDir, name);
+  const skillDir = resolve17(runtime().skillsDir, name);
   ensureDir(skillDir);
-  const skillPath = resolve16(skillDir, "skill.md");
+  const skillPath = resolve17(skillDir, "skill.md");
   let finalContent = content;
   try {
-    const existing = readFileSync20(skillPath, "utf-8");
+    const existing = readFileSync21(skillPath, "utf-8");
     finalContent = mergeGotchas(content, extractGotchas(existing));
   } catch {}
   writeFileSync17(skillPath, finalContent, "utf-8");
@@ -24620,7 +24870,7 @@ function saveWikiEntry(args) {
   let counter = 1;
   while (true) {
     try {
-      writeFileSync17(resolve16(runtime().summariesDir, summaryName), content, {
+      writeFileSync17(resolve17(runtime().summariesDir, summaryName), content, {
         encoding: "utf-8",
         flag: "wx"
       });
@@ -24637,8 +24887,8 @@ function saveWikiEntry(args) {
   let sqliteUpdated = false;
   if (topicId && setTopicBrief2) {
     try {
-      const briefPath = resolve16(runtime().topicsDir, `${fileSlug}.md`);
-      let briefMd = existsSync25(briefPath) ? readFileSync20(briefPath, "utf-8") : undefined;
+      const briefPath = resolve17(runtime().topicsDir, `${fileSlug}.md`);
+      let briefMd = existsSync26(briefPath) ? readFileSync21(briefPath, "utf-8") : undefined;
       if (briefMd === undefined && getTopicBrief2 && !getTopicBrief2(fileSlug)?.briefMd) {
         const legacy = getTopicBrief2(topicId)?.briefMd;
         if (legacy)
@@ -24671,9 +24921,9 @@ function saveTopicBrief(args) {
     return { content: [{ type: "text", text: "Missing content." }] };
   const topicId = runtime().topicId;
   const fileSlug = wikiBriefStorageKey(rawTopic, topicId);
-  const briefPath = resolve16(runtime().topicsDir, `${fileSlug}.md`);
+  const briefPath = resolve17(runtime().topicsDir, `${fileSlug}.md`);
   ensureDir(dirname16(briefPath));
-  const existed = existsSync25(briefPath);
+  const existed = existsSync26(briefPath);
   writeFileSync17(briefPath, content, "utf-8");
   const setTopicBrief2 = runtime().host.setTopicBrief;
   let sqliteUpdated = false;
@@ -24705,17 +24955,17 @@ function indexUpsert(args) {
   const dateStr = date ?? today;
   const indexPath = (() => {
     if (kind === "topic")
-      return resolve16(runtime().wikiDir, "topic-index.md");
+      return resolve17(runtime().wikiDir, "topic-index.md");
     if (kind === "skill")
-      return resolve16(runtime().wikiDir, "skill-index.md");
-    return resolve16(runtime().wikiDir, "article-index.md");
+      return resolve17(runtime().wikiDir, "skill-index.md");
+    return resolve17(runtime().wikiDir, "article-index.md");
   })();
   ensureDir(dirname16(indexPath));
   const releaseLock = acquireFileLock(indexPath);
   try {
     let index;
     try {
-      index = readFileSync20(indexPath, "utf-8");
+      index = readFileSync21(indexPath, "utf-8");
     } catch {
       index = "";
     }
@@ -24789,18 +25039,18 @@ function indexUpsert(args) {
 }
 function createWikiMcpServer(context, host2) {
   const surface = context.surface ?? "all";
-  const wikiDir = resolve16(host2.wikiRoot);
+  const wikiDir = resolve17(host2.wikiRoot);
   const current3 = {
     userId: context.userId,
     topicId: context.topicId,
     surface,
     host: host2,
     wikiDir,
-    skillsDir: resolve16(wikiDir, "skills"),
-    topicsDir: resolve16(wikiDir, "topic"),
-    summariesDir: resolve16(wikiDir, "summaries"),
-    articlesDir: resolve16(wikiDir, "articles"),
-    archiveDir: resolve16(wikiDir, "archive")
+    skillsDir: resolve17(wikiDir, "skills"),
+    topicsDir: resolve17(wikiDir, "topic"),
+    summariesDir: resolve17(wikiDir, "summaries"),
+    articlesDir: resolve17(wikiDir, "articles"),
+    archiveDir: resolve17(wikiDir, "archive")
   };
   const tools = surface === "wiki" ? WIKI_TOOLS : surface === "skills" ? SKILL_TOOLS : [...WIKI_TOOLS, ...SKILL_TOOLS];
   for (const directory of [
@@ -25000,11 +25250,11 @@ __export(exports_activity_log, {
   readSentFilesForTopic: () => readSentFilesForTopic
 });
 import {
-  existsSync as existsSync26,
+  existsSync as existsSync27,
   mkdirSync as mkdirSync25,
   readdirSync as readdirSync10,
   renameSync as renameSync11,
-  statSync as statSync14,
+  statSync as statSync15,
   unlinkSync as unlinkSync19,
   writeFileSync as writeFileSync18
 } from "fs";
@@ -25024,7 +25274,7 @@ function writeLog(entry) {
   const sidShort = entry.sessionId ? entry.sessionId.slice(0, 8) : "new";
   const file = join36(logDir, `${entry.userId}_${safeSession}_${sidShort}.jsonl`);
   try {
-    const stat = statSync14(file);
+    const stat = statSync15(file);
     if (stat.size >= MAX_FILE_SIZE) {
       const rotated = file.replace(/\.jsonl$/, `.${Date.now()}.jsonl`);
       renameSync11(file, rotated);
@@ -25042,7 +25292,7 @@ function rotateOldLogs() {
   try {
     const files = readdirSync10(logDir).filter((f) => f.endsWith(".jsonl")).map((f) => {
       try {
-        const stat = statSync14(join36(logDir, f));
+        const stat = statSync15(join36(logDir, f));
         return { name: f, size: stat.size, mtimeMs: stat.mtimeMs };
       } catch {
         return null;
@@ -25084,7 +25334,7 @@ function entryMatchesTopic(e, topicName) {
 }
 function readSentFilesForTopic(userId, topicName) {
   const file = join36(resolveStorageUsersLogDir(), String(userId), "sent-files.jsonl");
-  if (!existsSync26(file))
+  if (!existsSync27(file))
     return [];
   try {
     return readJsonlLines(file).map((line) => JSON.parse(line)).filter((e) => entryMatchesTopic(e, topicName));
@@ -25095,7 +25345,7 @@ function readSentFilesForTopic(userId, topicName) {
 }
 function removeSentFilesForTopic(userId, topicName) {
   const file = join36(resolveStorageUsersLogDir(), String(userId), "sent-files.jsonl");
-  if (!existsSync26(file))
+  if (!existsSync27(file))
     return;
   try {
     const remaining = readJsonlLines(file).filter((line) => {
@@ -25839,7 +26089,7 @@ var init_storage_public = __esm(async () => {
 });
 
 // ../../packages/mcp/src/hosted-surfaces.ts
-import { resolve as resolve17 } from "path";
+import { resolve as resolve18 } from "path";
 function isActiveHostedMcpSurface(surface) {
   return ACTIVE_HOSTED_MCP_SURFACES.includes(surface);
 }
@@ -25925,7 +26175,7 @@ async function buildHostedSurfaceServer(surface, context) {
         ...topicId ? { topicId } : {},
         surface
       }, {
-        wikiRoot: resolve17(WORKSPACE_DIR2, "wiki"),
+        wikiRoot: resolve18(WORKSPACE_DIR2, "wiki"),
         getTopicBrief: storage.getTopicBrief,
         resolveTopicBrief: accessibleTopicBrief,
         setTopicBrief: storage.setTopicBrief
@@ -26054,11 +26304,11 @@ var init_sse_transport = () => {};
 
 // ../../packages/mcp/src/server.ts
 import { createHash as createHash9, randomUUID as randomUUID23 } from "crypto";
-import { realpathSync as realpathSync6, statSync as statSync15 } from "fs";
-import { basename as basename9, extname as extname2, resolve as resolve18 } from "path";
+import { realpathSync as realpathSync6, statSync as statSync16 } from "fs";
+import { basename as basename9, extname as extname3, resolve as resolve19 } from "path";
 import { McpServer as McpServer7 } from "@modelcontextprotocol/sdk/server/mcp.js";
 import { WebStandardStreamableHTTPServerTransport } from "@modelcontextprotocol/sdk/server/webStandardStreamableHttp.js";
-import { z as z11 } from "zod";
+import { z as z12 } from "zod";
 function requireTopicAccess(ctx) {
   const topic = getTopic(ctx.topicId);
   if (!topic)
@@ -26069,8 +26319,8 @@ function requireTopicAccess(ctx) {
   return { topic };
 }
 function isPathInside2(baseDir, filePath) {
-  const cwd = resolve18(baseDir);
-  const normalized = resolve18(filePath);
+  const cwd = resolve19(baseDir);
+  const normalized = resolve19(filePath);
   try {
     const realCwd = realpathSync6(cwd);
     const real = realpathSync6(normalized);
@@ -26086,18 +26336,18 @@ function localFileInfo(ctx, filePath) {
   if (!isPathInside2(ctx.cwd, filePath)) {
     return { error: "Access denied. File must be within the topic workspace." };
   }
-  const normalizedPath = resolve18(filePath);
+  const normalizedPath = resolve19(filePath);
   if (isSensitivePath(normalizedPath)) {
     return { error: "Access denied. Path matches the sensitive-file blacklist." };
   }
   try {
-    const stats = statSync15(normalizedPath);
+    const stats = statSync16(normalizedPath);
     if (!stats.isFile())
       return { error: `${filePath} is not a file` };
     return {
       normalizedPath,
       name: basename9(filePath),
-      ext: extname2(filePath).toLowerCase(),
+      ext: extname3(filePath).toLowerCase(),
       sizeBytes: stats.size,
       sizeMB: (stats.size / (1024 * 1024)).toFixed(2)
     };
@@ -26183,6 +26433,9 @@ function buildNegotiumMcpServer(ctx) {
       const handler = ctx.peerBridge && (def.name === "show_html" || def.name === "show_mermaid") ? async () => textResult("Visual queued for ordered display on the canonical hub.") : def.handler;
       server.tool(def.name, def.description, def.schema, handler);
     }
+    for (const def of createPublishHtmlToolDefinitions({ cwd: ctx.cwd })) {
+      server.tool(def.name, def.description, def.schema, def.handler);
+    }
   }
   const selfConfigCtx = {
     topicId: ctx.topicId,
@@ -26275,8 +26528,8 @@ function buildNegotiumMcpServer(ctx) {
     }
   }
   if (ctx.fileDeliveryTools === true) {
-    server.tool("send_file", "Send a local file to the user in the chat. Use this when you want to share a file (image, document, PDF, code, etc.) with the user. The file will appear as a downloadable item in the chat.", { file_path: z11.string().describe("Absolute path to the file to send") }, async ({ file_path }) => deliverFile(ctx, file_path));
-    server.tool("send_files", "Send multiple local files to the user in the chat at once.", { file_paths: z11.array(z11.string()).describe("Array of absolute file paths to send") }, async ({ file_paths }) => {
+    server.tool("send_file", "Send a local file to the user in the chat. Use this when you want to share a file (image, document, PDF, code, etc.) with the user. The file will appear as a downloadable item in the chat.", { file_path: z12.string().describe("Absolute path to the file to send") }, async ({ file_path }) => deliverFile(ctx, file_path));
+    server.tool("send_files", "Send multiple local files to the user in the chat at once.", { file_paths: z12.array(z12.string()).describe("Array of absolute file paths to send") }, async ({ file_paths }) => {
       const results = await Promise.all(file_paths.map((filePath) => deliverFile(ctx, filePath)));
       const hasError = results.some((result) => ("isError" in result) && result.isError);
       return {
@@ -26564,37 +26817,37 @@ var init_src2 = __esm(async () => {
 
 // ../../packages/mcp-host/src/paths.ts
 import { homedir as homedir9 } from "os";
-import { resolve as resolve19 } from "path";
+import { resolve as resolve20 } from "path";
 function stateDir() {
   const env = process.env.NEGOTIUM_STATE_DIR?.trim();
-  return env ? resolve19(env) : resolve19(homedir9(), ".negotium");
+  return env ? resolve20(env) : resolve20(homedir9(), ".negotium");
 }
 function defaultPortsDir() {
-  return resolve19(stateDir(), "run", "mcp-ports");
+  return resolve20(stateDir(), "run", "mcp-ports");
 }
 function defaultManifestFile() {
-  return resolve19(stateDir(), "data", "mcp-manifest.json");
+  return resolve20(stateDir(), "data", "mcp-manifest.json");
 }
 var init_paths = () => {};
 
 // ../../packages/mcp-host/src/spec.ts
-import { z as z12 } from "zod";
+import { z as z13 } from "zod";
 var KEY_PATTERN, portSchema, mcpServerSpecSchema;
 var init_spec = __esm(() => {
   KEY_PATTERN = /^[a-zA-Z0-9._-]+$/;
-  portSchema = z12.number().int().min(1).max(65535);
-  mcpServerSpecSchema = z12.object({
-    key: z12.string().min(1).regex(KEY_PATTERN, "key may only contain [a-zA-Z0-9._-]").refine((k) => k !== "." && k !== "..", "key may not be a dot path"),
-    transport: z12.enum(["stdio", "http"]),
-    command: z12.string().min(1),
-    args: z12.array(z12.string()).optional(),
-    env: z12.record(z12.string(), z12.string()).optional(),
-    cwd: z12.string().optional(),
-    portRange: z12.object({ base: portSchema, max: portSchema }).optional(),
-    scope: z12.enum(["node", "instance"]),
-    readyTimeoutMs: z12.number().int().positive().optional(),
-    idleEvictMs: z12.number().int().positive().optional(),
-    healthIntervalMs: z12.number().int().positive().optional()
+  portSchema = z13.number().int().min(1).max(65535);
+  mcpServerSpecSchema = z13.object({
+    key: z13.string().min(1).regex(KEY_PATTERN, "key may only contain [a-zA-Z0-9._-]").refine((k) => k !== "." && k !== "..", "key may not be a dot path"),
+    transport: z13.enum(["stdio", "http"]),
+    command: z13.string().min(1),
+    args: z13.array(z13.string()).optional(),
+    env: z13.record(z13.string(), z13.string()).optional(),
+    cwd: z13.string().optional(),
+    portRange: z13.object({ base: portSchema, max: portSchema }).optional(),
+    scope: z13.enum(["node", "instance"]),
+    readyTimeoutMs: z13.number().int().positive().optional(),
+    idleEvictMs: z13.number().int().positive().optional(),
+    healthIntervalMs: z13.number().int().positive().optional()
   }).superRefine((spec, ctx) => {
     if (spec.transport === "http") {
       if (!spec.portRange) {
@@ -26615,9 +26868,9 @@ var init_spec = __esm(() => {
 });
 
 // ../../packages/mcp-host/src/manifest.ts
-import { existsSync as existsSync27, mkdirSync as mkdirSync26, readFileSync as readFileSync21, renameSync as renameSync12, writeFileSync as writeFileSync19 } from "fs";
+import { existsSync as existsSync28, mkdirSync as mkdirSync26, readFileSync as readFileSync22, renameSync as renameSync12, writeFileSync as writeFileSync19 } from "fs";
 import { dirname as dirname17 } from "path";
-import { z as z13 } from "zod";
+import { z as z14 } from "zod";
 
 class McpManifest {
   file;
@@ -26660,11 +26913,11 @@ class McpManifest {
     return this.entries.get(key)?.enabled ?? false;
   }
   load() {
-    if (!existsSync27(this.file))
+    if (!existsSync28(this.file))
       return;
     let parsed;
     try {
-      parsed = manifestFileSchema.parse(JSON.parse(readFileSync21(this.file, "utf8")));
+      parsed = manifestFileSchema.parse(JSON.parse(readFileSync22(this.file, "utf8")));
     } catch (e) {
       throw new Error(`Invalid MCP manifest at ${this.file}: ${e instanceof Error ? e.message : String(e)}`);
     }
@@ -26691,13 +26944,13 @@ var manifestEntrySchema, manifestFileSchema;
 var init_manifest = __esm(() => {
   init_paths();
   init_spec();
-  manifestEntrySchema = z13.object({
+  manifestEntrySchema = z14.object({
     spec: mcpServerSpecSchema,
-    enabled: z13.boolean()
+    enabled: z14.boolean()
   });
-  manifestFileSchema = z13.object({
-    version: z13.literal(1),
-    servers: z13.array(manifestEntrySchema)
+  manifestFileSchema = z14.object({
+    version: z14.literal(1),
+    servers: z14.array(manifestEntrySchema)
   });
 });
 
@@ -26714,7 +26967,7 @@ import { execFileSync as execFileSync8, spawn as spawn8 } from "child_process";
 import {
   mkdirSync as mkdirSync27,
   readdirSync as readdirSync11,
-  readFileSync as readFileSync22,
+  readFileSync as readFileSync23,
   renameSync as renameSync13,
   unlinkSync as unlinkSync20,
   writeFileSync as writeFileSync20
@@ -26736,16 +26989,16 @@ function resolveInstanceKey(spec, instanceKey) {
   return instanceKey;
 }
 function canBind(port) {
-  return new Promise((resolve20) => {
+  return new Promise((resolve21) => {
     const srv = createServer3();
-    srv.once("error", () => resolve20(false));
+    srv.once("error", () => resolve21(false));
     srv.listen({ port, host: "127.0.0.1", exclusive: true }, () => {
-      srv.close(() => resolve20(true));
+      srv.close(() => resolve21(true));
     });
   });
 }
 function tcpProbe(port, timeoutMs = PROBE_TIMEOUT_MS2) {
-  return new Promise((resolve20) => {
+  return new Promise((resolve21) => {
     const sock = connect({ port, host: "127.0.0.1" });
     let settled = false;
     const done = (ok3) => {
@@ -26753,7 +27006,7 @@ function tcpProbe(port, timeoutMs = PROBE_TIMEOUT_MS2) {
         return;
       settled = true;
       sock.destroy();
-      resolve20(ok3);
+      resolve21(ok3);
     };
     sock.once("connect", () => done(true));
     sock.once("error", () => done(false));
@@ -26781,12 +27034,12 @@ function killProcessTree(pid) {
 function waitExit(proc, timeoutMs) {
   if (proc.exitCode !== null || proc.signalCode !== null)
     return Promise.resolve(true);
-  return new Promise((resolve20) => {
-    const timer = setTimeout(() => resolve20(false), timeoutMs);
+  return new Promise((resolve21) => {
+    const timer = setTimeout(() => resolve21(false), timeoutMs);
     timer.unref?.();
     const settle = () => {
       clearTimeout(timer);
-      resolve20(true);
+      resolve21(true);
     };
     proc.once("exit", settle);
     proc.once("error", settle);
@@ -27022,7 +27275,7 @@ class McpHost {
       if (file.includes(".tmp-"))
         continue;
       try {
-        const port = Number.parseInt(readFileSync22(join37(this.portsDir, file), "utf8").trim(), 10);
+        const port = Number.parseInt(readFileSync23(join37(this.portsDir, file), "utf8").trim(), 10);
         if (!Number.isNaN(port))
           claims.set(file, port);
       } catch {}
@@ -27129,7 +27382,7 @@ var DEFAULT_READY_TIMEOUT_MS = 20000, READY_POLL_MS = 150, KILL_GRACE_MS = 5000,
     fn(`[mcp-host] ${msg}`, ctx);
   else
     fn(`[mcp-host] ${msg}`);
-}, delay2 = (ms) => new Promise((resolve20) => setTimeout(resolve20, ms));
+}, delay2 = (ms) => new Promise((resolve21) => setTimeout(resolve21, ms));
 var init_manager3 = __esm(() => {
   init_manifest();
   init_paths();
@@ -27147,16 +27400,16 @@ var init_src3 = __esm(() => {
 import { randomUUID as randomUUID24 } from "crypto";
 import {
   copyFileSync as copyFileSync4,
-  existsSync as existsSync28,
+  existsSync as existsSync29,
   mkdirSync as mkdirSync28,
-  readFileSync as readFileSync23,
+  readFileSync as readFileSync24,
   rmSync as rmSync8,
-  statSync as statSync16,
+  statSync as statSync17,
   writeFileSync as writeFileSync21
 } from "fs";
-import { basename as basename10, extname as extname3, join as join38 } from "path";
+import { basename as basename10, extname as extname4, join as join38 } from "path";
 function safeExtension(filename) {
-  const extension = extname3(basename10(filename));
+  const extension = extname4(basename10(filename));
   return /^\.[A-Za-z0-9]{1,16}$/.test(extension) ? extension.toLowerCase() : "";
 }
 function attachmentType(mimeType) {
@@ -27185,7 +27438,7 @@ class NodeFileStore {
     if (!FILE_ID_RE.test(fileId))
       return null;
     try {
-      const parsed = JSON.parse(readFileSync23(this.#metadataPath(fileId), "utf8"));
+      const parsed = JSON.parse(readFileSync24(this.#metadataPath(fileId), "utf8"));
       if (typeof parsed.filename !== "string" || typeof parsed.mimeType !== "string" || typeof parsed.sizeBytes !== "number" || typeof parsed.savedName !== "string") {
         return null;
       }
@@ -27208,7 +27461,7 @@ class NodeFileStore {
   hooks = {
     resolveAttachmentByFileId: (fileId) => {
       const metadata = this.#metadata(fileId);
-      if (!metadata || !existsSync28(join38(this.uploadDir, metadata.savedName)))
+      if (!metadata || !existsSync29(join38(this.uploadDir, metadata.savedName)))
         return null;
       return this.#attachment(fileId, metadata);
     },
@@ -27217,7 +27470,7 @@ class NodeFileStore {
       if (!metadata)
         return null;
       const path = join38(this.uploadDir, metadata.savedName);
-      return existsSync28(path) ? path : null;
+      return existsSync29(path) ? path : null;
     },
     storeLocalFileAsUpload: (absPath, access = {}) => this.store(absPath, access),
     deleteFilesForTopic: (topicId) => this.deleteForTopic(topicId)
@@ -27229,12 +27482,12 @@ class NodeFileStore {
     const savedName = `${fileId}${extension}`;
     const savedPath = join38(this.uploadDir, savedName);
     try {
-      const stats = statSync16(absPath);
+      const stats = statSync17(absPath);
       if (!stats.isFile() || stats.size > MAX_UPLOAD_BYTES)
         return null;
       const metadata = {
         filename: basename10(absPath),
-        mimeType: MIME_BY_EXT[extension] ?? "application/octet-stream",
+        mimeType: MIME_BY_EXT2[extension] ?? "application/octet-stream",
         sizeBytes: stats.size,
         savedName,
         ...access.ownerUserId ? { ownerUserId: access.ownerUserId } : {},
@@ -27260,7 +27513,7 @@ class NodeFileStore {
     if (!allowed)
       return null;
     const path = join38(this.uploadDir, metadata.savedName);
-    if (!existsSync28(path))
+    if (!existsSync29(path))
       return null;
     return new Response(Bun.file(path), {
       headers: {
@@ -27283,12 +27536,12 @@ class NodeFileStore {
     }
   }
 }
-var MAX_UPLOAD_BYTES, FILE_ID_RE, MIME_BY_EXT, nodeFileStore;
+var MAX_UPLOAD_BYTES, FILE_ID_RE, MIME_BY_EXT2, nodeFileStore;
 var init_files = __esm(async () => {
   await init_node_host();
   MAX_UPLOAD_BYTES = 2 * 1024 * 1024 * 1024;
   FILE_ID_RE = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
-  MIME_BY_EXT = {
+  MIME_BY_EXT2 = {
     ".csv": "text/csv",
     ".gif": "image/gif",
     ".html": "text/html",
@@ -27430,14 +27683,14 @@ function createPollingSseStream(req, options) {
 import { randomUUID as randomUUID25, timingSafeEqual as timingSafeEqual4 } from "crypto";
 import {
   chmodSync as chmodSync5,
-  existsSync as existsSync29,
+  existsSync as existsSync30,
   mkdirSync as mkdirSync29,
-  readFileSync as readFileSync24,
+  readFileSync as readFileSync25,
   renameSync as renameSync14,
   unlinkSync as unlinkSync21,
   writeFileSync as writeFileSync22
 } from "fs";
-import { dirname as dirname18, resolve as resolve20 } from "path";
+import { dirname as dirname18, resolve as resolve21 } from "path";
 function jsonError(status, error2) {
   return Response.json({ ok: false, error: error2 }, { status });
 }
@@ -27939,10 +28192,10 @@ function writeNodeDaemonInfo(port, startedAt) {
   return info;
 }
 function readNodeDaemonInfo() {
-  if (!existsSync29(NODE_DAEMON_INFO_PATH))
+  if (!existsSync30(NODE_DAEMON_INFO_PATH))
     return null;
   try {
-    const value = JSON.parse(readFileSync24(NODE_DAEMON_INFO_PATH, "utf8"));
+    const value = JSON.parse(readFileSync25(NODE_DAEMON_INFO_PATH, "utf8"));
     if (value?.schemaVersion !== 1 || value.stateDir !== STATE_DIR || !Number.isInteger(value.protocolVersion) || !Number.isInteger(value.pid) || !Number.isInteger(value.port) || value.port <= 0) {
       return null;
     }
@@ -28026,7 +28279,7 @@ var init_control = __esm(async () => {
     init_files()
   ]);
   NODE_RUNTIME_CONTRACT_BASE_PATH = `${NODE_CONTROL_BASE_PATH}/runtime/v1`;
-  NODE_DAEMON_INFO_PATH = resolve20(RUN_DIR, "node-daemon.json");
+  NODE_DAEMON_INFO_PATH = resolve21(RUN_DIR, "node-daemon.json");
   NODE_VERSION = NEGOTIUM_VERSION;
   ControlRequestError = class ControlRequestError extends Error {
     constructor(message) {
@@ -28230,8 +28483,8 @@ var init_schedule = __esm(() => {
 
 // ../../packages/module-cron/src/scripts.ts
 import { spawn as spawn9 } from "child_process";
-import { existsSync as existsSync30, mkdirSync as mkdirSync30, readdirSync as readdirSync12 } from "fs";
-import { resolve as resolve21, sep as sep2 } from "path";
+import { existsSync as existsSync31, mkdirSync as mkdirSync30, readdirSync as readdirSync12 } from "fs";
+import { resolve as resolve22, sep as sep2 } from "path";
 function validateCronScriptName(script) {
   if (!/^[A-Za-z0-9_][A-Za-z0-9_.-]*\.py$/.test(script) || script.includes("..") || script.includes("/") || script.includes("\\")) {
     return { ok: false, error: `script must be a plain .py filename under ${CRON_JOBS_DIR}` };
@@ -28242,7 +28495,7 @@ function resolveCronScriptPath(script) {
   const valid = validateCronScriptName(script);
   if (!valid.ok)
     throw new Error(valid.error);
-  const path = resolve21(CRON_JOBS_DIR, script);
+  const path = resolve22(CRON_JOBS_DIR, script);
   if (!path.startsWith(`${CRON_JOBS_DIR}${sep2}`))
     throw new Error("script path escaped jobs directory");
   return path;
@@ -28253,7 +28506,7 @@ function listCronScripts() {
 }
 function cronScriptExists(script) {
   try {
-    return existsSync30(resolveCronScriptPath(script));
+    return existsSync31(resolveCronScriptPath(script));
   } catch {
     return false;
   }
@@ -28285,7 +28538,7 @@ async function runCronPromptScript(options) {
   if (options.signal?.aborted)
     throw new CronScriptError("script run aborted");
   const scriptPath = resolveCronScriptPath(options.script);
-  if (!existsSync30(scriptPath))
+  if (!existsSync31(scriptPath))
     throw new CronScriptError(`cron script not found: ${options.script}`);
   const timeoutMs = Math.max(5000, options.timeoutMs ?? DEFAULT_SCRIPT_TIMEOUT_MS);
   const outputLimitBytes = Math.max(1024, options.outputLimitBytes ?? DEFAULT_OUTPUT_LIMIT_BYTES);
@@ -28358,7 +28611,7 @@ async function runCronPromptScript(options) {
 var CRON_JOBS_DIR, DEFAULT_SCRIPT_TIMEOUT_MS, DEFAULT_OUTPUT_LIMIT_BYTES, KILL_GRACE_MS2 = 2500, CronScriptError;
 var init_scripts = __esm(async () => {
   await init_cron_host();
-  CRON_JOBS_DIR = resolve21(process.env.NEGOTIUM_CRON_JOBS_DIR?.trim() || resolve21(WORKSPACE_DIR, "cron", "jobs"));
+  CRON_JOBS_DIR = resolve22(process.env.NEGOTIUM_CRON_JOBS_DIR?.trim() || resolve22(WORKSPACE_DIR, "cron", "jobs"));
   DEFAULT_SCRIPT_TIMEOUT_MS = 10 * 60000;
   DEFAULT_OUTPUT_LIMIT_BYTES = 1024 * 1024;
   CronScriptError = class CronScriptError extends Error {
@@ -29486,7 +29739,7 @@ var init_scheduler = __esm(async () => {
 });
 
 // ../../packages/module-cron/src/module.ts
-import { existsSync as existsSync31 } from "fs";
+import { existsSync as existsSync32 } from "fs";
 import { fileURLToPath as fileURLToPath2 } from "url";
 function envMs(name, fallback) {
   const parsed = Number.parseInt(process.env[name] ?? "", 10);
@@ -29517,7 +29770,7 @@ function createCronModule(options = {}) {
         if (event.type === "topic-deleted")
           trackCleanup(resetCronTopicContext(event.topicId));
       });
-      const mcpServerFile = options.mcpServerFile ?? (existsSync31(SOURCE_MCP_SERVER_FILE) ? SOURCE_MCP_SERVER_FILE : PACKAGED_MCP_SERVER_FILE);
+      const mcpServerFile = options.mcpServerFile ?? (existsSync32(SOURCE_MCP_SERVER_FILE) ? SOURCE_MCP_SERVER_FILE : PACKAGED_MCP_SERVER_FILE);
       const unregisterMcp = host2.registerRuntimeMcpServer("cron-manager", {
         scopes: ["forum", "manager"],
         forumRequired: true,
@@ -29805,7 +30058,7 @@ __export(exports_src3, {
 });
 import { createServer as createServer4 } from "net";
 async function availableLoopbackPort() {
-  return new Promise((resolve22, reject) => {
+  return new Promise((resolve23, reject) => {
     const probe = createServer4();
     probe.unref();
     probe.once("error", reject);
@@ -29816,7 +30069,7 @@ async function availableLoopbackPort() {
         if (error2)
           reject(error2);
         else if (port > 0)
-          resolve22(port);
+          resolve23(port);
         else
           reject(new Error("failed to allocate a loopback port"));
       });
@@ -29953,8 +30206,8 @@ function startNode(opts = {}) {
   const manifest = new McpManifest;
   const stopSweeper = mcpHost.startSweeper();
   let resolveCompleted;
-  const completed = new Promise((resolve22) => {
-    resolveCompleted = resolve22;
+  const completed = new Promise((resolve23) => {
+    resolveCompleted = resolve23;
   });
   let advertised = null;
   try {
@@ -30031,7 +30284,7 @@ async function runNodeDaemon(opts = {}) {
     singleton: true
   });
   await node.completed;
-  await new Promise((resolve22) => setImmediate(resolve22));
+  await new Promise((resolve23) => setImmediate(resolve23));
   process.exit(0);
 }
 var init_src5 = __esm(async () => {
@@ -30191,7 +30444,7 @@ var init_commands = __esm(() => {
 
 // ../../adapters/terminal/src/path-suggest.ts
 import { execFile as execFile3 } from "child_process";
-import { existsSync as existsSync32, readdirSync as readdirSync13, statSync as statSync17 } from "fs";
+import { existsSync as existsSync33, readdirSync as readdirSync13, statSync as statSync18 } from "fs";
 import { homedir as homedir10 } from "os";
 import { basename as basename11, dirname as dirname19, join as join39, sep as sep3 } from "path";
 import { promisify as promisify3 } from "util";
@@ -30374,7 +30627,7 @@ async function warmPathSuggestions(lineText, col, loader = listFilesWithRipgrep)
     return false;
   const { dir } = resolveFragment(token.frag);
   try {
-    if (!statSync17(dir).isDirectory())
+    if (!statSync18(dir).isDirectory())
       return false;
   } catch {
     return false;
@@ -30406,7 +30659,7 @@ function pathSuggestions(lineText, col) {
     let isDir = entry.isDirectory();
     if (!isDir && entry.isSymbolicLink()) {
       try {
-        isDir = statSync17(join39(dir, entry.name)).isDirectory();
+        isDir = statSync18(join39(dir, entry.name)).isDirectory();
       } catch {}
     }
     return {
@@ -30440,7 +30693,7 @@ function fragmentToAbsolutePath(frag) {
 }
 function fragmentResolves(frag) {
   try {
-    return existsSync32(fragmentToAbsolutePath(frag));
+    return existsSync33(fragmentToAbsolutePath(frag));
   } catch {
     return false;
   }
@@ -34942,8 +35195,8 @@ class TerminalApp {
         this.#refreshBackgroundSessions();
       }, 1000);
       this.#backgroundRefreshTimer.unref?.();
-      await new Promise((resolve22) => {
-        this.#finishRun = resolve22;
+      await new Promise((resolve23) => {
+        this.#finishRun = resolve23;
       });
     } finally {
       this.#running = false;
@@ -37606,8 +37859,8 @@ ${caption}` : voiceText : caption;
       return;
     }
     let release;
-    const ready = new Promise((resolve22) => {
-      release = resolve22;
+    const ready = new Promise((resolve23) => {
+      release = resolve23;
     });
     const entry = {
       messages: [msg],
@@ -37729,8 +37982,8 @@ function renderOutbound(text2, maxLen = 4096) {
 }
 
 // ../../adapters/telegram/src/adapter.ts
-import { existsSync as existsSync33 } from "fs";
-import { basename as basename12, extname as extname4 } from "path";
+import { existsSync as existsSync34 } from "fs";
+import { basename as basename12, extname as extname5 } from "path";
 function startTelegramAdapter(opts) {
   const { client, forumChatId } = opts;
   const userId = opts.userId ?? "local";
@@ -37840,7 +38093,7 @@ function startTelegramAdapter(opts) {
           attempt += 1;
           const waitMs = Math.min(5000, 250 * 2 ** Math.min(attempt - 1, 5));
           logger.warn({ err: err2, attempt, waitMs }, "telegram adapter: getMe failed while resolving onboarding identity; retrying");
-          await new Promise((resolve22) => setTimeout(resolve22, waitMs));
+          await new Promise((resolve23) => setTimeout(resolve23, waitMs));
         }
       }
       return;
@@ -38217,7 +38470,7 @@ function startTelegramAdapter(opts) {
       logger.warn({ path, chatId }, "telegram adapter: blocked sensitive file path");
       return { ref: null, delivered: false, error: "path matches the sensitive-file blacklist" };
     }
-    if (!existsSync33(path)) {
+    if (!existsSync34(path)) {
       const sent = await client.sendMessage(chatId, `File: ${path}`, base).catch(() => null);
       const messageId = sentMessageId(sent);
       return {
@@ -38226,7 +38479,7 @@ function startTelegramAdapter(opts) {
         error: "file not found on disk"
       };
     }
-    const ext = extname4(path).slice(1).toLowerCase();
+    const ext = extname5(path).slice(1).toLowerCase();
     const fileOptions = {
       filename: basename12(file.filename) || basename12(path),
       ...file.mimeType ? { contentType: file.mimeType } : {}
@@ -38317,14 +38570,14 @@ function startTelegramAdapter(opts) {
   const sendQueues = new Map;
   function enqueueSend(topicId, task) {
     const prev = sendQueues.get(topicId) ?? Promise.resolve();
-    const next = prev.then(() => new Promise((resolve22) => {
+    const next = prev.then(() => new Promise((resolve23) => {
       const timer = setTimeout(() => {
         logger.warn({ topicId, sendTimeoutMs }, "telegram adapter: send timed out \u2014 abandoning it and continuing the queue");
-        resolve22();
+        resolve23();
       }, sendTimeoutMs);
       task().catch((err2) => logger.warn({ err: err2, topicId }, "telegram adapter: send task failed")).finally(() => {
         clearTimeout(timer);
-        resolve22();
+        resolve23();
       });
     }));
     sendQueues.set(topicId, next);
@@ -38568,7 +38821,7 @@ ${suffix}`;
                 continue;
               }
               if (retryDelayMs > 0) {
-                await new Promise((resolve22) => setTimeout(resolve22, retryDelayMs));
+                await new Promise((resolve23) => setTimeout(resolve23, retryDelayMs));
               }
               try {
                 await client.editMessageText(text2, editOptions);
@@ -39213,8 +39466,8 @@ async function runTelegramCli(args = process.argv.slice(2)) {
   onShutdown("telegram-channel", 100, () => channel.stop());
   onShutdown("telegram-singleton", 90, () => singleton.stop());
   let resolveCompleted;
-  const completed = new Promise((resolve22) => {
-    resolveCompleted = resolve22;
+  const completed = new Promise((resolve23) => {
+    resolveCompleted = resolve23;
   });
   onShutdown("telegram-completed", -100, resolveCompleted);
   process.stdout.write(`negotium Telegram adapter connected to canonical node pid ${initialNode.info?.pid ?? "unknown"}
@@ -39401,22 +39654,22 @@ import { createHash as createHash10, randomUUID as randomUUID27 } from "crypto";
 import {
   chmodSync as chmodSync6,
   closeSync as closeSync4,
-  existsSync as existsSync34,
+  existsSync as existsSync35,
   fsyncSync as fsyncSync2,
   linkSync,
   lstatSync,
   mkdirSync as mkdirSync32,
   openSync as openSync4,
-  readFileSync as readFileSync25,
+  readFileSync as readFileSync26,
   renameSync as renameSync15,
   rmSync as rmSync9,
-  statSync as statSync18,
+  statSync as statSync19,
   unlinkSync as unlinkSync22,
   writeFileSync as writeFileSync23
 } from "fs";
-import { dirname as dirname21, resolve as resolve22 } from "path";
+import { dirname as dirname21, resolve as resolve23 } from "path";
 function joinFilePath() {
-  return resolve22(DATA_DIR, "otium-join.json");
+  return resolve23(DATA_DIR, "otium-join.json");
 }
 function isHttpUrl(value) {
   return /^https?:\/\//.test(value);
@@ -39471,7 +39724,7 @@ function parseInviteCode(code) {
   return normalizeJoin(parsed);
 }
 function joinLockPath() {
-  return resolve22(DATA_DIR, ".otium-join.lock");
+  return resolve23(DATA_DIR, ".otium-join.lock");
 }
 function processIsAlive(pid) {
   if (!Number.isSafeInteger(pid) || pid <= 0)
@@ -39485,7 +39738,7 @@ function processIsAlive(pid) {
 }
 function withJoinCredentialLock(operation) {
   const lockPath = joinLockPath();
-  const ownerPath = resolve22(lockPath, "owner.json");
+  const ownerPath = resolve23(lockPath, "owner.json");
   const owner = { pid: process.pid, token: randomUUID27() };
   mkdirSync32(dirname21(lockPath), { recursive: true });
   for (let attempt = 0;; attempt += 1) {
@@ -39511,11 +39764,11 @@ function withJoinCredentialLock(operation) {
         throw error2;
       let current3 = null;
       try {
-        current3 = JSON.parse(readFileSync25(ownerPath, "utf8"));
+        current3 = JSON.parse(readFileSync26(ownerPath, "utf8"));
       } catch {}
       let ageMs;
       try {
-        ageMs = Date.now() - statSync18(lockPath).mtimeMs;
+        ageMs = Date.now() - statSync19(lockPath).mtimeMs;
       } catch (statError) {
         if (statError.code === "ENOENT")
           continue;
@@ -39541,7 +39794,7 @@ function withJoinCredentialLock(operation) {
     return operation();
   } finally {
     try {
-      const current3 = JSON.parse(readFileSync25(ownerPath, "utf8"));
+      const current3 = JSON.parse(readFileSync26(ownerPath, "utf8"));
       if (current3.pid === owner.pid && current3.token === owner.token) {
         rmSync9(lockPath, { recursive: true, force: true });
       }
@@ -39564,9 +39817,9 @@ function joinCredentialDigest(join41) {
   return createHash10("sha256").update(JSON.stringify(normalizedJoin(join41))).digest("base64url");
 }
 function readPersistedJoin(path = joinFilePath()) {
-  if (!existsSync34(path))
+  if (!existsSync35(path))
     return null;
-  const parsed = JSON.parse(readFileSync25(path, "utf-8"));
+  const parsed = JSON.parse(readFileSync26(path, "utf-8"));
   if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) {
     throw new Error("persisted join credentials are not a JSON object");
   }
@@ -39585,7 +39838,7 @@ function saveJoinWhileLocked(join41, options = {}) {
   const directory = dirname21(path);
   const normalized = normalizedJoin(join41);
   mkdirSync32(directory, { recursive: true });
-  if (existsSync34(path)) {
+  if (existsSync35(path)) {
     if (lstatSync(path).isSymbolicLink()) {
       throw new Error(`refusing to replace symlinked Otium join file at ${path}`);
     }
@@ -39617,7 +39870,7 @@ function saveJoinWhileLocked(join41, options = {}) {
       throw new Error(`this node is already joined${existing ? ` as ${existing.cellId}` : " with an invalid join file"}; pass --replace to replace its credentials`);
     }
   }
-  const temporaryPath = resolve22(directory, `.otium-join.json.${process.pid}.${randomUUID27()}.tmp`);
+  const temporaryPath = resolve23(directory, `.otium-join.json.${process.pid}.${randomUUID27()}.tmp`);
   let fd;
   try {
     fd = openSync4(temporaryPath, "wx", 384);
@@ -39642,7 +39895,7 @@ function saveJoinWhileLocked(join41, options = {}) {
   } catch (error2) {
     if (fd !== undefined)
       closeSync4(fd);
-    if (existsSync34(temporaryPath))
+    if (existsSync35(temporaryPath))
       unlinkSync22(temporaryPath);
     throw error2;
   }
@@ -39654,7 +39907,7 @@ function saveJoin(join41, options = {}) {
 function removeJoin() {
   return withJoinCredentialLock(() => {
     const path = joinFilePath();
-    if (!existsSync34(path))
+    if (!existsSync35(path))
       return false;
     if (lstatSync(path).isSymbolicLink()) {
       throw new Error(`refusing to remove symlinked Otium join file at ${path}`);
@@ -39686,10 +39939,10 @@ function loadJoin() {
     logger.warn("otium: OTIUM_CENTRAL_URL, OTIUM_CELL_ID, OTIUM_CELL_SECRET must be set together \u2014 ignoring partial env");
   }
   const path = joinFilePath();
-  if (!existsSync34(path))
+  if (!existsSync35(path))
     return null;
   try {
-    const parsed = JSON.parse(readFileSync25(path, "utf-8"));
+    const parsed = JSON.parse(readFileSync26(path, "utf-8"));
     if (!parsed || typeof parsed !== "object" || Array.isArray(parsed))
       return null;
     return normalizeJoin(parsed);
@@ -39713,11 +39966,11 @@ var exports_join_status = {};
 __export(exports_join_status, {
   hasConfiguredOtiumJoin: () => hasConfiguredOtiumJoin
 });
-import { existsSync as existsSync35 } from "fs";
-import { resolve as resolve23 } from "path";
+import { existsSync as existsSync36 } from "fs";
+import { resolve as resolve24 } from "path";
 function hasConfiguredOtiumJoin() {
   const envJoin = Boolean(process.env.OTIUM_CENTRAL_URL?.trim() && process.env.OTIUM_CELL_ID?.trim() && process.env.OTIUM_CELL_SECRET?.trim());
-  return envJoin || existsSync35(resolve23(DATA_DIR, "otium-join.json"));
+  return envJoin || existsSync36(resolve24(DATA_DIR, "otium-join.json"));
 }
 var init_join_status = __esm(() => {
   init_config_public();
@@ -40524,7 +40777,7 @@ function createTurnForwarder(opts) {
           logger.warn({ requestId, seq, type: event.type, attempt, error: result.error }, "otium: peer event delivery to hub failed");
           if (attempt < PEER_EVENT_MAX_ATTEMPTS) {
             const delayMs = retryBaseMs * 2 ** (attempt - 1);
-            await new Promise((resolve24) => setTimeout(resolve24, delayMs));
+            await new Promise((resolve25) => setTimeout(resolve25, delayMs));
           }
         }
         forwarder.deliveryBlocked = true;
@@ -40666,8 +40919,8 @@ var init_event_backflow = __esm(async () => {
 
 // ../../adapters/otium/src/peer-files.ts
 import { randomUUID as randomUUID29 } from "crypto";
-import { copyFileSync as copyFileSync5, mkdirSync as mkdirSync33, rmSync as rmSync10, statSync as statSync19 } from "fs";
-import { basename as basename13, extname as extname5, join as join41 } from "path";
+import { copyFileSync as copyFileSync5, mkdirSync as mkdirSync33, rmSync as rmSync10, statSync as statSync20 } from "fs";
+import { basename as basename13, extname as extname6, join as join41 } from "path";
 function fileType(mimeType) {
   if (mimeType.startsWith("image/"))
     return "image";
@@ -40697,7 +40950,7 @@ function safeFilename(filename) {
   return value || "upload";
 }
 function mimeFromPath(path) {
-  const extension = extname5(path).toLowerCase();
+  const extension = extname6(path).toLowerCase();
   const known = {
     ".png": "image/png",
     ".jpg": "image/jpeg",
@@ -40739,7 +40992,7 @@ function insertLocalFile(args) {
   mkdirSync33(PEER_FILES_DIR, { recursive: true });
   const path = join41(PEER_FILES_DIR, `${id}-${safeFilename(args.filename)}`);
   copyFileSync5(args.sourcePath, path);
-  return recordFile({ id, path, sizeBytes: statSync19(path).size, ...args });
+  return recordFile({ id, path, sizeBytes: statSync20(path).size, ...args });
 }
 function deletePeerFilesForTopic(topicId) {
   const rows = db.query("SELECT path FROM otium_peer_files WHERE topic_id = ?").all(topicId);
@@ -42407,17 +42660,17 @@ import {
 import {
   chmodSync as chmodSync7,
   closeSync as closeSync5,
-  existsSync as existsSync36,
+  existsSync as existsSync37,
   fsyncSync as fsyncSync3,
   linkSync as linkSync2,
   mkdirSync as mkdirSync34,
   openSync as openSync5,
-  readFileSync as readFileSync26,
+  readFileSync as readFileSync27,
   renameSync as renameSync16,
   unlinkSync as unlinkSync23,
   writeFileSync as writeFileSync24
 } from "fs";
-import { dirname as dirname22, resolve as resolve24 } from "path";
+import { dirname as dirname22, resolve as resolve25 } from "path";
 function parseEnrollmentInvite(code) {
   let parsed;
   try {
@@ -42438,14 +42691,14 @@ function parseEnrollmentInvite(code) {
   return { v: 2, central, token };
 }
 function pendingEnrollmentPath() {
-  return resolve24(DATA_DIR, "otium-enrollment-pending.json");
+  return resolve25(DATA_DIR, "otium-enrollment-pending.json");
 }
 function isEnrollmentPending(invite) {
   const path = pendingEnrollmentPath();
-  if (!existsSync36(path))
+  if (!existsSync37(path))
     return false;
   try {
-    const saved = JSON.parse(readFileSync26(path, "utf8"));
+    const saved = JSON.parse(readFileSync27(path, "utf8"));
     return saved.central === invite.central && saved.token === invite.token;
   } catch {
     return false;
@@ -42453,8 +42706,8 @@ function isEnrollmentPending(invite) {
 }
 function loadOrCreatePending(invite, nodeName) {
   const path = pendingEnrollmentPath();
-  if (existsSync36(path)) {
-    const saved = JSON.parse(readFileSync26(path, "utf8"));
+  if (existsSync37(path)) {
+    const saved = JSON.parse(readFileSync27(path, "utf8"));
     if (saved.central === invite.central && saved.token === invite.token)
       return saved;
     throw new Error(`another Otium enrollment is pending at ${path}`);
@@ -42468,7 +42721,7 @@ function loadOrCreatePending(invite, nodeName) {
     ...nodeName ? { nodeName } : {}
   };
   mkdirSync34(dirname22(path), { recursive: true });
-  const temporaryPath = resolve24(dirname22(path), `.otium-enrollment-pending.json.${process.pid}.${randomUUID31()}.tmp`);
+  const temporaryPath = resolve25(dirname22(path), `.otium-enrollment-pending.json.${process.pid}.${randomUUID31()}.tmp`);
   let fd;
   try {
     fd = openSync5(temporaryPath, "wx", 384);
@@ -42489,10 +42742,10 @@ function loadOrCreatePending(invite, nodeName) {
   } catch (error2) {
     if (fd !== undefined)
       closeSync5(fd);
-    if (existsSync36(temporaryPath))
+    if (existsSync37(temporaryPath))
       unlinkSync23(temporaryPath);
-    if (error2.code === "EEXIST" && existsSync36(path)) {
-      const saved = JSON.parse(readFileSync26(path, "utf8"));
+    if (error2.code === "EEXIST" && existsSync37(path)) {
+      const saved = JSON.parse(readFileSync27(path, "utf8"));
       if (saved.central === invite.central && saved.token === invite.token)
         return saved;
     }
@@ -42503,7 +42756,7 @@ function loadOrCreatePending(invite, nodeName) {
 function replacePendingEnrollment(pending2) {
   const path = pendingEnrollmentPath();
   const directory = dirname22(path);
-  const temporaryPath = resolve24(directory, `.otium-enrollment-pending.json.${process.pid}.${randomUUID31()}.tmp`);
+  const temporaryPath = resolve25(directory, `.otium-enrollment-pending.json.${process.pid}.${randomUUID31()}.tmp`);
   let fd;
   try {
     fd = openSync5(temporaryPath, "wx", 384);
@@ -42522,14 +42775,14 @@ function replacePendingEnrollment(pending2) {
   } catch (error2) {
     if (fd !== undefined)
       closeSync5(fd);
-    if (existsSync36(temporaryPath))
+    if (existsSync37(temporaryPath))
       unlinkSync23(temporaryPath);
     throw error2;
   }
 }
 function recordClaimedCredential(pending2, join42) {
   withJoinCredentialLock(() => {
-    const current3 = JSON.parse(readFileSync26(pendingEnrollmentPath(), "utf8"));
+    const current3 = JSON.parse(readFileSync27(pendingEnrollmentPath(), "utf8"));
     if (current3.central !== pending2.central || current3.token !== pending2.token || current3.idempotencyKey !== pending2.idempotencyKey || current3.publicKey !== pending2.publicKey) {
       throw new Error("pending Otium enrollment changed while its claim was in flight");
     }
@@ -42608,7 +42861,7 @@ async function claimEnrollment(invite, nodeName) {
 function commitEnrollment(join42, options = {}) {
   return withJoinCredentialLock(() => {
     const pendingPath = pendingEnrollmentPath();
-    const pending2 = existsSync36(pendingPath) ? JSON.parse(readFileSync26(pendingPath, "utf8")) : null;
+    const pending2 = existsSync37(pendingPath) ? JSON.parse(readFileSync27(pendingPath, "utf8")) : null;
     const digest = joinCredentialDigest(join42);
     if (pending2 && (!pending2.claimed || pending2.claimed.digest !== digest || pending2.claimed.cellId !== join42.cellId)) {
       throw new Error(`pending Otium enrollment at ${pendingPath} does not match these credentials`);
@@ -43868,8 +44121,8 @@ async function runOtiumSidecar(options) {
   }) : null;
   tunnel?.start();
   let resolveCompleted;
-  const completed = new Promise((resolve25) => {
-    resolveCompleted = resolve25;
+  const completed = new Promise((resolve26) => {
+    resolveCompleted = resolve26;
   });
   onShutdown("otium-sidecar-server", 130, () => server?.stop(true));
   onShutdown("otium-sidecar-tunnel", 120, () => tunnel?.stop());
@@ -44677,7 +44930,7 @@ async function runCanonicalNode(port) {
   });
   console.log(`negotium node listening on 127.0.0.1:${node.port} (ctrl-c to stop)`);
   await node.completed;
-  await new Promise((resolve25) => setImmediate(resolve25));
+  await new Promise((resolve26) => setImmediate(resolve26));
   process.exit(0);
 }
 async function stopAdapter(name) {
@@ -44808,4 +45061,4 @@ switch (command) {
   }
 }
 
-//# debugId=111CDA5CA492CAD164756E2164756E21
+//# debugId=17BAA8882823716C64756E2164756E21