negotium 0.3.13 → 0.4.0

package/dist/runtime/src/mcp/factories/vault.ts

@@ -1,44 +1,21 @@
 import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
-import { z } from "zod";
-import { executeVaultHttpRequest, type VaultHttpRequest } from "#mcp/vault-http";
-import { executeVaultRun, type VaultRunRequest } from "#mcp/vault-run";
-import { mcpError, mcpOk } from "../mcp-helpers";
-import type { VaultCredentialHost } from "./vault-host";
+import type { VaultEntry } from "#storage/vault";
+import { mcpOk } from "../mcp-helpers";
 
 export interface VaultMcpContext {
   userId?: string;
-  listOnly?: boolean;
-  httpOnly?: boolean;
-  cwd?: string;
 }
 
-export interface VaultMcpExecutors {
-  run?(
-    userId: string,
-    request: VaultRunRequest,
-    host: VaultCredentialHost,
-  ): ReturnType<typeof executeVaultRun>;
-  http?(
-    userId: string,
-    request: VaultHttpRequest,
-    host: VaultCredentialHost,
-  ): ReturnType<typeof executeVaultHttpRequest>;
+export interface VaultMcpHost {
+  list(userId: string): readonly VaultEntry[];
 }
 
-export function createVaultMcpServer(
-  context: VaultMcpContext,
-  host: VaultCredentialHost,
-  executors: VaultMcpExecutors = {},
-): McpServer {
+export function createVaultMcpServer(context: VaultMcpContext, host: VaultMcpHost): McpServer {
   const server = new McpServer({ name: "vault", version: "1.0.0" });
-  const run = executors.run ?? executeVaultRun;
-  const http = executors.http ?? executeVaultHttpRequest;
 
   server.tool(
     "vault_list",
-    context.httpOnly
-      ? "List the user's Vault keys and descriptions without exposing values. Use vault_http_request for HTTPS APIs that need a credential."
-      : "List the user's Vault keys and descriptions without exposing values. Use vault_http_request for APIs and vault_run for shell/CLI work that needs a credential.",
+    "List the user's Vault keys and descriptions without exposing values. Use {{KEY}} placeholders directly in supported transient tool inputs.",
     {},
     () => {
       if (!context.userId) return mcpOk("(vault unavailable: no user context)");
@@ -51,80 +28,5 @@ export function createVaultMcpServer(
     },
   );
 
-  if (!context.listOnly && !context.httpOnly) {
-    server.tool(
-      "vault_run",
-      "Run a shell command containing {{KEY}} references inside Otium's credential broker. Expanded command input never reaches the model/provider, and stdout/stderr are redacted before return. Prefer vault_http_request for HTTP APIs.",
-      {
-        command: z
-          .string()
-          .min(1)
-          .max(64 * 1024),
-        timeout_ms: z.number().int().min(1_000).max(600_000).optional(),
-        max_output_bytes: z
-          .number()
-          .int()
-          .min(1_024)
-          .max(2 * 1024 * 1024)
-          .optional(),
-      },
-      async ({ command, timeout_ms, max_output_bytes }) => {
-        if (!context.userId) return mcpError("Vault unavailable: no user context");
-        const result = await run(
-          context.userId,
-          {
-            command,
-            timeoutMs: timeout_ms,
-            maxOutputBytes: max_output_bytes,
-            cwd: context.cwd,
-          },
-          host,
-        );
-        return result.error && result.exitCode === null
-          ? mcpError(result.error)
-          : mcpOk(JSON.stringify(result, null, 2));
-      },
-    );
-  }
-
-  if (!context.listOnly)
-    server.tool(
-      "vault_http_request",
-      "Make an HTTPS request with {{KEY}} references resolved inside Otium. Put secrets in headers or body, never in the URL. The expanded request is not returned; the response is redacted before the model sees it.",
-      {
-        method: z.enum(["GET", "POST", "PUT", "PATCH", "DELETE"]).default("GET"),
-        url: z.string().url().describe("Absolute HTTPS URL without Vault placeholders"),
-        headers: z.record(z.string(), z.string()).optional(),
-        body: z.string().optional(),
-        timeout_ms: z.number().int().min(1_000).max(120_000).optional(),
-        max_response_bytes: z
-          .number()
-          .int()
-          .min(1_024)
-          .max(1024 * 1024)
-          .optional(),
-      },
-      async ({ method, url, headers, body, timeout_ms, max_response_bytes }) => {
-        if (!context.userId) return mcpError("Vault unavailable: no user context");
-        const result = await http(
-          context.userId,
-          {
-            method,
-            url,
-            headers,
-            body,
-            timeoutMs: timeout_ms,
-            maxResponseBytes: max_response_bytes,
-          },
-          host,
-        );
-        return result.error ? mcpError(result.error) : mcpOk(JSON.stringify(result, null, 2));
-      },
-    );
-
   return server;
 }
-
-export type { VaultHttpRequest, VaultHttpResult } from "#mcp/vault-http";
-export type { VaultRunRequest, VaultRunResult } from "#mcp/vault-run";
-export type { VaultCredentialHost } from "./vault-host";

package/dist/runtime/src/mcp/vault-server.ts

@@ -1,28 +1,12 @@
 #!/usr/bin/env node
 import "./stdio-protect";
-import { createVaultMcpServer, type VaultCredentialHost } from "#mcp/factories/vault";
+import { createVaultMcpServer, type VaultMcpHost } from "#mcp/factories/vault";
 import { connectStdio, parseUserIdArg } from "#mcp/mcp-helpers";
-import { logger } from "#platform/logger";
-import { redactVaultSecrets, vaultList, vaultSubstituteDetailed } from "#storage/vault";
+import { vaultList } from "#storage/vault";
 
 const args = process.argv.slice(2);
-const host: VaultCredentialHost = {
+const host: VaultMcpHost = {
   list: vaultList,
-  substitute: vaultSubstituteDetailed,
-  redact: redactVaultSecrets,
-  log(level, details, message) {
-    logger[level](details, message);
-  },
 };
 
-await connectStdio(
-  createVaultMcpServer(
-    {
-      userId: parseUserIdArg(args),
-      listOnly: args.includes("--list-only=true"),
-      httpOnly: args.includes("--http-only=true"),
-      cwd: process.cwd(),
-    },
-    host,
-  ),
-);
+await connectStdio(createVaultMcpServer({ userId: parseUserIdArg(args) }, host));

package/dist/runtime/src/prompts/sessions/_shared-tools.md

@@ -11,7 +11,7 @@ Use a tool only when it is actually available; otherwise say so instead of prete
 - Voice: user voice arrives transcribed; fix misheard proper nouns from context.
 - Skills: when a task looks unfamiliar, slow, or error-prone, `skill_query` first; save or update a reusable solution with `skill_save`.
 - Memory: when a Memory section is injected, use it for past context; `wiki_query` for deeper recall.
-- Vault: use `{{KEY}}` directly in browser tools and Claude/Maestro tool inputs. For Codex native shell or HTTP, use the Vault broker tools; never ask the user to paste secrets into chat.
+- Vault: use `{{KEY}}` directly in supported transient tool inputs for every provider; never ask the user to paste secrets into chat.
 - Background shell: use background-bash only for independent commands expected to outlive the current turn (typically over 2 minutes). Run ordinary builds, tests, and commands needed for the next step inline and wait for them; do not background work merely to avoid waiting. Results are injected automatically, so do not poll unless live output is required.
 - Scheduled tasks: manage with `cron-manager` tools; scripts must already exist (`cron_list_scripts`). Jobs in one topic share a Cron conversation, so `cron_reset` clears the topic's whole Cron context, not one job.
 - Heavy work (large files, video encode, big crawls, browser automation): check `get_system_health` first and back off under resource pressure.

package/dist/runtime/src/version.ts

@@ -1 +1 @@
-export const NEGOTIUM_VERSION = "0.3.13";
+export const NEGOTIUM_VERSION = "0.4.0";

package/dist/types/packages/core/src/agents/codex-vault-hook-bridge.d.ts

@@ -0,0 +1,27 @@
+export interface CodexPreToolUseInput {
+    hook_event_name?: string;
+    tool_name: string;
+    tool_input: unknown;
+}
+export type CodexPreToolUseOutput = Record<string, unknown>;
+export interface CodexVaultHookOperations {
+    referencesSensitiveStorage(value: unknown): boolean;
+    substitute(userId: string, value: string): string;
+}
+export declare function evaluateCodexVaultPreToolUse(input: CodexPreToolUseInput, userId: string, operations: CodexVaultHookOperations): CodexPreToolUseOutput;
+export interface CodexVaultHookBridge {
+    codexPathOverride: string;
+    hooks: {
+        PreToolUse: Array<{
+            matcher: string;
+            hooks: Array<{
+                type: string;
+                command: string;
+                timeout: number;
+                statusMessage: string;
+            }>;
+        }>;
+    };
+    close(): Promise<void>;
+}
+export declare function createCodexVaultHookBridge(userId: string): Promise<CodexVaultHookBridge>;

package/dist/types/packages/core/src/agents/execution-host.d.ts

@@ -12,7 +12,6 @@ export interface AgentExecutionHost {
     redactVaultSecrets(userId: string, value: string): string;
     substituteVaultSecrets(userId: string, value: string): string;
     referencesRuntimeSecretStorage(value: unknown): boolean;
-    shouldRedirectVaultTool(userId: string, toolName: string, input: unknown): boolean;
     claudeCodeExecutablePath(): string | undefined;
     codexAuthFilePath(): string;
     transformQueryOptions?(opts: AgentQueryOptions): AgentQueryOptions;
@@ -27,7 +26,6 @@ export declare function hostedMcpServers(opts: AgentQueryOptions): Record<string
 export declare function redactHostedSecrets(userId: string, value: string): string;
 export declare function substituteHostedSecrets(userId: string, value: string): string;
 export declare function referencesHostedSecretStorage(value: unknown): boolean;
-export declare function shouldRedirectHostedVaultTool(userId: string, toolName: string, input: unknown): boolean;
 export declare function transformHostedQueryOptions(opts: AgentQueryOptions): AgentQueryOptions;
 export declare function hostedClaudeCodeExecutablePath(): string | undefined;
 export declare function hostedCodexAuthFilePath(): string;

package/dist/types/packages/core/src/agents/public-helpers.d.ts

@@ -14,4 +14,3 @@ export { createSelfConfigCore, DEFAULT_SELF_CONFIG_PRODUCT, type SelfConfigAgent
 export { resolveTaskEventScope, type TaskEventHost, type TaskEventScope, withTaskSnapshots, } from "./task-events";
 export { buildNumberedDiffSummary, classifyShellToolName, formatToolUse, type NumberedDiffSummary, summarizeDisplayText, summarizeShellCommand, summarizeToolInput, type ToolCallSummaryInput, type ToolCallSummaryValue, } from "./tool-format";
 export { cleanupTopicRollouts, cleanupTopicRolloutsFromEntries, createTopicLogMaintenance, type PurgeSessionRef, type PurgeTopicLogsOptions, purgeTopicLogs, type RotateTopicLogsOptions, type RotateTopicLogsResult, rotateTopicLogs, type TopicConversationEntry, type TopicLogMaintenance, type TopicLogMaintenanceHost, } from "./topic-cleanup";
-export { createVaultToolPolicy, isVaultBrokerTool, referencesRuntimeSecretStorage, shouldRedirectVaultTool, VAULT_BROKER_REDIRECT_ERROR, type VaultToolPolicy, type VaultToolPolicyHost, } from "./vault-tool-policy";

package/dist/types/packages/core/src/agents/vault-tool-policy.d.ts

@@ -1,15 +1,2 @@
 export declare function shouldSubstituteVaultToolInput(toolName: string): boolean;
-export declare const VAULT_BROKER_REDIRECT_ERROR = "Vault broker redirection is disabled; use {{KEY}} directly in normal tool inputs.";
-export interface VaultToolPolicyHost {
-    isSensitivePath(path: string): boolean;
-    valueReferencesVaultKey(userId: string, value: unknown): boolean;
-}
-export interface VaultToolPolicy {
-    isVaultBrokerTool(toolName: string): boolean;
-    referencesRuntimeSecretStorage(value: unknown): boolean;
-    shouldRedirectVaultTool(userId: string, toolName: string, input: unknown): boolean;
-}
-export declare function createVaultToolPolicy(host: VaultToolPolicyHost): VaultToolPolicy;
-export declare const isVaultBrokerTool: (toolName: string) => boolean;
-export declare const referencesRuntimeSecretStorage: (value: unknown) => boolean;
-export declare const shouldRedirectVaultTool: (userId: string, toolName: string, input: unknown) => boolean;
+export declare function referencesRuntimeSecretStorage(value: unknown): boolean;

package/dist/types/packages/core/src/mcp/factories/index.d.ts

@@ -1,7 +1,5 @@
 export { parseSessionCommContext, type SessionCommContext, type SessionCommContextDefaults, } from "../session-comm/context";
 export { createSessionTargetCatalog, type SessionTarget, type SessionTargetCatalog, type SessionTargetCatalogHost, type SessionTopicEntry, type SessionTopicRow, type ValidateSessionTargetResult, } from "../session-comm/topic-catalog";
-export { executeVaultHttpRequest } from "../vault-http";
-export { executeVaultRun } from "../vault-run";
 export { createWikiMcpServer, type WikiMcpContext, type WikiMcpHost, type WikiSurface, type WikiTopicBrief, } from "../wiki-server";
 export { type AgentHealthMcpContext, createAgentHealthMcpServer, } from "./agent-health";
 export { type CompactionLogMcpContext, createCompactionLogMcpServer, } from "./compaction-log";
@@ -11,4 +9,4 @@ export { type McpStdioProtectionTarget, protectMcpStdio, } from "./stdio-protect
 export { createSystemHealthMcpServer, defaultSystemHealthMcpHost, type SystemHealthMcpHost, type SystemHealthSnapshot, } from "./system-health";
 export { createTaskMcpServer, defaultTaskMcpHost, type TaskMcpContext, type TaskMcpHost, } from "./task";
 export { createTokenStatsMcpServer, defaultTokenStatsMcpHost, type TokenStatsMcpContext, type TokenStatsMcpHost, type TokenStatsSnapshot, } from "./token-stats";
-export { createVaultMcpServer, type VaultCredentialHost, type VaultHttpRequest, type VaultHttpResult, type VaultMcpContext, type VaultMcpExecutors, type VaultRunRequest, type VaultRunResult, } from "./vault";
+export { createVaultMcpServer, type VaultMcpContext, type VaultMcpHost, } from "./vault";

package/dist/types/packages/core/src/mcp/factories/vault.d.ts

@@ -1,18 +1,9 @@
 import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
-import { executeVaultHttpRequest, type VaultHttpRequest } from "../vault-http";
-import { executeVaultRun, type VaultRunRequest } from "../vault-run";
-import type { VaultCredentialHost } from "./vault-host";
+import type { VaultEntry } from "../../storage/vault";
 export interface VaultMcpContext {
     userId?: string;
-    listOnly?: boolean;
-    httpOnly?: boolean;
-    cwd?: string;
 }
-export interface VaultMcpExecutors {
-    run?(userId: string, request: VaultRunRequest, host: VaultCredentialHost): ReturnType<typeof executeVaultRun>;
-    http?(userId: string, request: VaultHttpRequest, host: VaultCredentialHost): ReturnType<typeof executeVaultHttpRequest>;
+export interface VaultMcpHost {
+    list(userId: string): readonly VaultEntry[];
 }
-export declare function createVaultMcpServer(context: VaultMcpContext, host: VaultCredentialHost, executors?: VaultMcpExecutors): McpServer;
-export type { VaultHttpRequest, VaultHttpResult } from "../vault-http";
-export type { VaultRunRequest, VaultRunResult } from "../vault-run";
-export type { VaultCredentialHost } from "./vault-host";
+export declare function createVaultMcpServer(context: VaultMcpContext, host: VaultMcpHost): McpServer;

package/dist/types/packages/core/src/version.d.ts

@@ -1 +1 @@
-export declare const NEGOTIUM_VERSION = "0.3.13";
+export declare const NEGOTIUM_VERSION = "0.4.0";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "negotium",
-  "version": "0.3.13",
+  "version": "0.4.0",
   "type": "module",
   "description": "Install the Negotium multi-agent runtime and CLI with one package",
   "license": "Apache-2.0",

package/dist/runtime/src/mcp/factories/vault-host.ts

@@ -1,8 +0,0 @@
-import type { VaultEntry, VaultSubstitutionResult } from "#storage/vault";
-
-export interface VaultCredentialHost {
-  list(userId: string): readonly VaultEntry[];
-  substitute(userId: string, text: string): VaultSubstitutionResult;
-  redact(userId: string, text: string): string;
-  log?(level: "info" | "warn", details: Record<string, unknown>, message: string): void;
-}

package/dist/runtime/src/mcp/vault-http.ts

@@ -1,235 +0,0 @@
-import type { VaultCredentialHost } from "#mcp/factories/vault-host";
-
-const SAFE_RESPONSE_HEADERS = new Set([
-  "content-type",
-  "content-length",
-  "location",
-  "retry-after",
-  "x-ratelimit-limit",
-  "x-ratelimit-remaining",
-  "x-ratelimit-reset",
-]);
-
-const FORBIDDEN_REQUEST_HEADERS = new Set([
-  "connection",
-  "content-length",
-  "host",
-  "proxy-authorization",
-  "transfer-encoding",
-]);
-
-export interface VaultHttpRequest {
-  method: "GET" | "POST" | "PUT" | "PATCH" | "DELETE";
-  url: string;
-  headers?: Record<string, string>;
-  body?: string;
-  timeoutMs?: number;
-  maxResponseBytes?: number;
-}
-
-export interface VaultHttpResult {
-  ok: boolean;
-  status?: number;
-  statusText?: string;
-  headers?: Record<string, string>;
-  body?: string;
-  truncated?: boolean;
-  error?: string;
-}
-
-function substituteObject(
-  userId: string,
-  values: Record<string, string>,
-  host: VaultCredentialHost,
-): { values: Record<string, string>; usedKeys: string[] } {
-  const used = new Set<string>();
-  const substituted: Record<string, string> = {};
-  for (const [key, value] of Object.entries(values)) {
-    if (FORBIDDEN_REQUEST_HEADERS.has(key.toLowerCase())) {
-      throw new Error(`Header "${key}" is not allowed`);
-    }
-    const result = host.substitute(userId, value);
-    for (const usedKey of result.usedKeys) used.add(usedKey);
-    substituted[key] = result.text;
-  }
-  return { values: substituted, usedKeys: [...used] };
-}
-
-function safeResponseHeaders(
-  userId: string,
-  headers: Headers,
-  host: VaultCredentialHost,
-): Record<string, string> {
-  const output: Record<string, string> = {};
-  for (const [key, value] of headers.entries()) {
-    if (!SAFE_RESPONSE_HEADERS.has(key.toLowerCase())) continue;
-    output[key] = host.redact(userId, value);
-  }
-  return output;
-}
-
-async function readBoundedBody(
-  response: Response,
-  maxBytes: number,
-): Promise<{ bytes: Uint8Array; truncated: boolean }> {
-  if (!response.body) return { bytes: new Uint8Array(), truncated: false };
-  const reader = response.body.getReader();
-  const chunks: Uint8Array[] = [];
-  let keptBytes = 0;
-  let truncated = false;
-  try {
-    while (true) {
-      const next = await reader.read();
-      if (next.done) break;
-      const remaining = maxBytes - keptBytes;
-      if (remaining <= 0) {
-        truncated = true;
-        await reader.cancel();
-        break;
-      }
-      const visible = next.value.subarray(0, remaining);
-      chunks.push(visible);
-      keptBytes += visible.byteLength;
-      if (visible.byteLength < next.value.byteLength) {
-        truncated = true;
-        await reader.cancel();
-        break;
-      }
-    }
-  } finally {
-    reader.releaseLock();
-  }
-
-  const bytes = new Uint8Array(keptBytes);
-  let offset = 0;
-  for (const chunk of chunks) {
-    bytes.set(chunk, offset);
-    offset += chunk.byteLength;
-  }
-  return { bytes, truncated };
-}
-
-/**
- * Execute an HTTPS request inside the credential boundary. The caller supplies
- * only {{KEY}} references; expanded headers/body never leave this function.
- */
-export async function executeVaultHttpRequest(
-  userId: string,
-  request: VaultHttpRequest,
-  host: VaultCredentialHost,
-  fetchImpl: typeof fetch = fetch,
-): Promise<VaultHttpResult> {
-  let parsedUrl: URL;
-  try {
-    parsedUrl = new URL(request.url);
-  } catch {
-    return { ok: false, error: "url must be an absolute HTTPS URL" };
-  }
-  if (parsedUrl.protocol !== "https:") {
-    return {
-      ok: false,
-      error: "Vault credentials may only be sent over HTTPS",
-    };
-  }
-  if (parsedUrl.username || parsedUrl.password || /\{\{[^}]+\}\}/.test(request.url)) {
-    return {
-      ok: false,
-      error: "Keep Vault placeholders out of URLs; put credentials in headers or body",
-    };
-  }
-
-  let headers: Record<string, string>;
-  let headerKeys: string[];
-  try {
-    const substituted = substituteObject(userId, request.headers ?? {}, host);
-    headers = substituted.values;
-    headerKeys = substituted.usedKeys;
-  } catch (error) {
-    return {
-      ok: false,
-      error: error instanceof Error ? error.message : String(error),
-    };
-  }
-
-  const bodyResult =
-    request.body === undefined
-      ? { text: undefined, usedKeys: [] as string[] }
-      : host.substitute(userId, request.body);
-  const usedKeys = [...new Set([...headerKeys, ...bodyResult.usedKeys])].sort();
-  if (usedKeys.length === 0) {
-    return {
-      ok: false,
-      error: "No valid Vault placeholder was found in headers or body",
-    };
-  }
-  if (request.method === "GET" && request.body !== undefined) {
-    return {
-      ok: false,
-      error: "GET requests cannot include a credential-bearing body",
-    };
-  }
-
-  const controller = new AbortController();
-  const timeoutMs = Math.min(Math.max(request.timeoutMs ?? 30_000, 1_000), 120_000);
-  const timeout = setTimeout(() => controller.abort(), timeoutMs);
-  const startedAt = Date.now();
-  try {
-    const response = await fetchImpl(parsedUrl, {
-      method: request.method,
-      headers,
-      body: request.method === "GET" ? undefined : bodyResult.text,
-      redirect: "manual",
-      signal: controller.signal,
-    });
-    const maxBytes = Math.min(Math.max(request.maxResponseBytes ?? 256 * 1024, 1_024), 1024 * 1024);
-    const { bytes, truncated } = await readBoundedBody(response, maxBytes);
-    const contentType = response.headers.get("content-type")?.toLowerCase() ?? "";
-    const textual =
-      contentType.startsWith("text/") ||
-      contentType.includes("json") ||
-      contentType.includes("xml") ||
-      contentType.includes("javascript") ||
-      contentType === "";
-    const body = textual
-      ? host.redact(userId, new TextDecoder().decode(bytes))
-      : `[binary response omitted: ${bytes.byteLength} bytes, ${contentType || "unknown content type"}]`;
-
-    host.log?.(
-      "info",
-      {
-        userId,
-        vaultKeys: usedKeys,
-        host: parsedUrl.hostname,
-        method: request.method,
-        status: response.status,
-        durationMs: Date.now() - startedAt,
-      },
-      "vault credential used",
-    );
-
-    return {
-      ok: response.ok,
-      status: response.status,
-      statusText: response.statusText,
-      headers: safeResponseHeaders(userId, response.headers, host),
-      body,
-      truncated,
-    };
-  } catch (error) {
-    const raw = error instanceof Error ? error.message : String(error);
-    host.log?.(
-      "warn",
-      {
-        userId,
-        vaultKeys: usedKeys,
-        host: parsedUrl.hostname,
-        method: request.method,
-        durationMs: Date.now() - startedAt,
-      },
-      "vault credential request failed",
-    );
-    return { ok: false, error: host.redact(userId, raw) };
-  } finally {
-    clearTimeout(timeout);
-  }
-}