negotium 0.3.14 → 0.4.1

package/dist/hosted-agent.js

@@ -503,36 +503,20 @@ function shouldSubstituteVaultToolInput(toolName) {
   const leaf = leafToolName(toolName);
   return leaf.startsWith("browser_") || DIRECT_VAULT_EXECUTION_TOOLS.has(leaf);
 }
-function createVaultToolPolicy(host) {
-  function isVaultBrokerTool(toolName) {
-    return toolName.includes("vault_run") || toolName.includes("vault_http_request");
-  }
-  function referencesRuntimeSecretStorage(value) {
-    if (typeof value === "string") {
-      const lower = value.toLowerCase();
-      if (SENSITIVE_RUNTIME_NAMES.some((name) => lower.includes(name)))
-        return true;
-      return value.startsWith("/") && host.isSensitivePath(value);
-    }
-    if (Array.isArray(value))
-      return value.some(referencesRuntimeSecretStorage);
-    if (value && typeof value === "object") {
-      return Object.values(value).some(referencesRuntimeSecretStorage);
-    }
-    return false;
+function referencesRuntimeSecretStorage(value) {
+  if (typeof value === "string") {
+    const lower = value.toLowerCase();
+    if (SENSITIVE_RUNTIME_NAMES.some((name) => lower.includes(name)))
+      return true;
+    return value.startsWith("/") && isSensitivePath(value);
   }
-  function shouldRedirectVaultTool(userId, toolName, input) {
-    return false;
+  if (Array.isArray(value))
+    return value.some(referencesRuntimeSecretStorage);
+  if (value && typeof value === "object") {
+    return Object.values(value).some(referencesRuntimeSecretStorage);
   }
-  return { isVaultBrokerTool, referencesRuntimeSecretStorage, shouldRedirectVaultTool };
+  return false;
 }
-var defaultVaultToolPolicy = createVaultToolPolicy({
-  isSensitivePath,
-  valueReferencesVaultKey: () => false
-});
-var isVaultBrokerTool = defaultVaultToolPolicy.isVaultBrokerTool;
-var referencesRuntimeSecretStorage = defaultVaultToolPolicy.referencesRuntimeSecretStorage;
-var shouldRedirectVaultTool = defaultVaultToolPolicy.shouldRedirectVaultTool;
 
 // ../../packages/core/src/mcp/runtime-spec.ts
 import { createHash, createHmac, timingSafeEqual } from "crypto";
@@ -1804,7 +1788,6 @@ var defaultHost = {
   redactVaultSecrets,
   substituteVaultSecrets: (userId, value) => vaultSubstituteDetailed(userId, value).text,
   referencesRuntimeSecretStorage,
-  shouldRedirectVaultTool,
   claudeCodeExecutablePath: () => CLAUDE_EXECUTABLE,
   codexAuthFilePath
 };
@@ -2375,9 +2358,9 @@ async function* claudeProvider(opts) {
 
 // ../../packages/core/src/agents/codex-provider.ts
 import { execFileSync as execFileSync4 } from "child_process";
-import { existsSync as existsSync5, readFileSync as readFileSync6, realpathSync as realpathSync3, statSync as statSync3 } from "fs";
+import { existsSync as existsSync6, readFileSync as readFileSync6, realpathSync as realpathSync3, statSync as statSync3 } from "fs";
 import { homedir as homedir3 } from "os";
-import { dirname as dirname7, isAbsolute, join as join6, relative, resolve as resolve6 } from "path";
+import { dirname as dirname8, isAbsolute, join as join7, relative, resolve as resolve7 } from "path";
 import { Codex } from "@openai/codex-sdk";
 
 // ../../packages/core/src/agents/codex-native-multi-agent.ts
@@ -2399,7 +2382,7 @@ import { tmpdir } from "os";
 import { dirname as dirname5, join as join4 } from "path";
 
 // ../../packages/core/src/version.ts
-var NEGOTIUM_VERSION = "0.3.14";
+var NEGOTIUM_VERSION = "0.4.1";
 
 // ../../packages/core/src/agents/codex-native-multi-agent.ts
 var moduleRequire = createRequire2(import.meta.url);
@@ -2827,19 +2810,170 @@ var withCodexSpawnSerial = manager.withSpawnSerial;
 var killCodexTrees = manager.killTrees;
 var killOwnedCodexTreesForShutdown = manager.killOwnedTreesForShutdown;
 
+// ../../packages/core/src/agents/codex-vault-hook-bridge.ts
+import { randomBytes as randomBytes4 } from "crypto";
+import { existsSync as existsSync4 } from "fs";
+import { chmod, mkdtemp, rm, writeFile } from "fs/promises";
+import { createServer } from "net";
+import { tmpdir as tmpdir2 } from "os";
+import { dirname as dirname6, join as join5, resolve as resolve5 } from "path";
+import { fileURLToPath as fileURLToPath2 } from "url";
+var MAX_HOOK_REQUEST_BYTES = 1024 * 1024;
+var SENSITIVE_STORAGE_DENIAL = "Runtime secret storage access is not permitted";
+var HOOK_SOCKET_ENV = "NEGOTIUM_CODEX_VAULT_HOOK_SOCKET";
+var HOOK_TOKEN_ENV = "NEGOTIUM_CODEX_VAULT_HOOK_TOKEN";
+function evaluateCodexVaultPreToolUse(input, userId, operations) {
+  if (operations.referencesSensitiveStorage(input.tool_input)) {
+    return {
+      hookSpecificOutput: {
+        hookEventName: "PreToolUse",
+        permissionDecision: "deny",
+        permissionDecisionReason: SENSITIVE_STORAGE_DENIAL
+      }
+    };
+  }
+  if (!shouldSubstituteVaultToolInput(input.tool_name))
+    return {};
+  const updatedInput = deepMapStrings(input.tool_input, (value) => operations.substitute(userId, value));
+  if (JSON.stringify(updatedInput) === JSON.stringify(input.tool_input))
+    return {};
+  return {
+    hookSpecificOutput: {
+      hookEventName: "PreToolUse",
+      permissionDecision: "allow",
+      updatedInput
+    }
+  };
+}
+function shellQuote(value) {
+  return `'${value.replaceAll("'", `'"'"'`)}'`;
+}
+function hookClientPath() {
+  const moduleDir = dirname6(fileURLToPath2(import.meta.url));
+  const adjacent = resolve5(moduleDir, "codex-vault-hook.mjs");
+  if (existsSync4(adjacent))
+    return adjacent;
+  const packaged = resolve5(moduleDir, "runtime/src/agents/codex-vault-hook.mjs");
+  if (existsSync4(packaged))
+    return packaged;
+  throw new Error("Codex Vault hook client is missing from this installation");
+}
+function privateCodexWrapper(codexScript, socketPath, token) {
+  return [
+    "#!/bin/sh",
+    `export ${HOOK_SOCKET_ENV}=${shellQuote(socketPath)}`,
+    `export ${HOOK_TOKEN_ENV}=${shellQuote(token)}`,
+    'if [ "$1" = "exec" ]; then',
+    "  shift",
+    `  exec ${shellQuote(process.execPath)} ${shellQuote(codexScript)} exec --dangerously-bypass-hook-trust "$@"`,
+    "fi",
+    `exec ${shellQuote(process.execPath)} ${shellQuote(codexScript)} "$@"`,
+    ""
+  ].join(`
+`);
+}
+async function createCodexVaultHookBridge(userId) {
+  const root = await mkdtemp(join5(tmpdir2(), "negotium-codex-vault-"));
+  await chmod(root, 448);
+  const socketPath = join5(root, "hook.sock");
+  const wrapperPath = join5(root, "codex-with-hooks");
+  const token = randomBytes4(32).toString("hex");
+  const connections = new Set;
+  const server = createServer((socket) => {
+    connections.add(socket);
+    socket.once("close", () => connections.delete(socket));
+    socket.setEncoding("utf8");
+    let request = "";
+    let handled = false;
+    const handleRequest = () => {
+      if (handled)
+        return;
+      handled = true;
+      try {
+        const parsed = JSON.parse(request.trimEnd());
+        if (parsed.token !== token)
+          throw new Error("invalid hook capability");
+        if (!parsed.input || typeof parsed.input !== "object" || typeof parsed.input.tool_name !== "string") {
+          throw new Error("invalid PreToolUse payload");
+        }
+        const output = evaluateCodexVaultPreToolUse(parsed.input, userId, {
+          referencesSensitiveStorage: referencesHostedSecretStorage,
+          substitute: substituteHostedSecrets
+        });
+        socket.end(JSON.stringify({ ok: true, output }));
+      } catch (error) {
+        const message = error instanceof Error ? error.message : String(error);
+        socket.end(JSON.stringify({ ok: false, error: message }));
+      }
+    };
+    socket.on("data", (chunk) => {
+      request += chunk;
+      if (Buffer.byteLength(request) > MAX_HOOK_REQUEST_BYTES)
+        socket.destroy();
+      else if (request.endsWith(`
+`))
+        handleRequest();
+    });
+    socket.on("end", handleRequest);
+  });
+  try {
+    await new Promise((resolveListen, reject) => {
+      server.once("error", reject);
+      server.listen(socketPath, () => {
+        server.off("error", reject);
+        resolveListen();
+      });
+    });
+    await chmod(socketPath, 384);
+    await writeFile(wrapperPath, privateCodexWrapper(codexCliScriptPath(), socketPath, token), {
+      mode: 448
+    });
+    const command = [shellQuote(process.execPath), shellQuote(hookClientPath())].join(" ");
+    return {
+      codexPathOverride: wrapperPath,
+      environment: { [HOOK_SOCKET_ENV]: socketPath, [HOOK_TOKEN_ENV]: token },
+      hooks: {
+        PreToolUse: [
+          {
+            matcher: "*",
+            hooks: [
+              {
+                type: "command",
+                command,
+                timeout: 30,
+                statusMessage: "Resolving Vault placeholders"
+              }
+            ]
+          }
+        ]
+      },
+      async close() {
+        for (const socket of connections)
+          socket.destroy();
+        await new Promise((resolveClose) => server.close(() => resolveClose()));
+        await rm(root, { recursive: true, force: true });
+      }
+    };
+  } catch (error) {
+    server.close();
+    await rm(root, { recursive: true, force: true });
+    throw error;
+  }
+}
+
 // ../../packages/core/src/agents/rollout/codex.ts
-import { existsSync as existsSync4, readFileSync as readFileSync5, realpathSync as realpathSync2, statSync as statSync2, unlinkSync as unlinkSync4 } from "fs";
-import { basename, dirname as dirname6, join as join5, resolve as resolve5 } from "path";
+import { existsSync as existsSync5, readFileSync as readFileSync5, realpathSync as realpathSync2, statSync as statSync2, unlinkSync as unlinkSync4 } from "fs";
+import { basename, dirname as dirname7, join as join6, resolve as resolve6 } from "path";
 function codexSessionsDir() {
-  return join5(hostedCodexHomePath(), "sessions");
+  return join6(hostedCodexHomePath(), "sessions");
 }
 function canonicalFilePath(path) {
-  const absolute = resolve5(path);
+  const absolute = resolve6(path);
   try {
     return realpathSync2(absolute);
   } catch {
     try {
-      return join5(realpathSync2(dirname6(absolute)), basename(absolute));
+      return join6(realpathSync2(dirname7(absolute)), basename(absolute));
     } catch {
       return absolute;
     }
@@ -3069,19 +3203,19 @@ function latestCodexRolloutPath(threadId) {
   try {
     if (buckets) {
       for (const bucket of buckets) {
-        const dir = join5(sessionsDir, bucket);
-        if (!existsSync4(dir))
+        const dir = join6(sessionsDir, bucket);
+        if (!existsSync5(dir))
           continue;
         const glob = new Bun.Glob(`rollout-*-${threadId}.jsonl`);
         for (const rel of glob.scanSync({ cwd: dir, onlyFiles: true })) {
-          candidates.push(join5(dir, rel));
+          candidates.push(join6(dir, rel));
         }
       }
     }
     if (candidates.length === 0) {
       const glob = new Bun.Glob(`**/rollout-*-${threadId}.jsonl`);
       for (const rel of glob.scanSync({ cwd: sessionsDir, onlyFiles: true })) {
-        candidates.push(join5(sessionsDir, rel));
+        candidates.push(join6(sessionsDir, rel));
       }
     }
     return candidates.sort((a, b) => statSync2(b).mtimeMs - statSync2(a).mtimeMs)[0];
@@ -3204,6 +3338,7 @@ function buildNumberedDiffSummary(before, after, startLine = 1) {
 }
 
 // ../../packages/core/src/agents/codex-provider.ts
+var CODEX_HOOK_TRUST_BYPASS_NOTICE = "`--dangerously-bypass-hook-trust` is enabled. Enabled hooks may run without review for this invocation.";
 function sameCodexUsage(usage, total) {
   return usage.input_tokens === total.inputTokens && usage.output_tokens === total.outputTokens && (usage.cached_input_tokens ?? 0) === total.cachedInputTokens && (usage.cache_write_input_tokens ?? 0) === total.cacheWriteInputTokens;
 }
@@ -3233,8 +3368,8 @@ function codexMcpServerName(name) {
   return CODEX_MCP_SERVER_NAME_OVERRIDES[name] ?? name;
 }
 function globalCodexMcpServerNames(authFilePath) {
-  const configPath = join6(dirname7(authFilePath), "config.toml");
-  if (!existsSync5(configPath))
+  const configPath = join7(dirname8(authFilePath), "config.toml");
+  if (!existsSync6(configPath))
     return [];
   try {
     const names = new Set;
@@ -3332,13 +3467,13 @@ var CODEX_DIFF_BASELINE_FILE_LIMIT = 200;
 var CODEX_DIFF_BASELINE_BYTE_LIMIT = 16 * 1024 * 1024;
 function canonicalPath(path) {
   try {
-    return realpathSync3(resolve6(path));
+    return realpathSync3(resolve7(path));
   } catch {
-    return resolve6(path);
+    return resolve7(path);
   }
 }
 function textFile(path, maxBytes = CODEX_DIFF_FILE_LIMIT) {
-  if (!existsSync5(path))
+  if (!existsSync6(path))
     return null;
   try {
     const byteLimit = Math.min(CODEX_DIFF_FILE_LIMIT, Math.max(0, maxBytes));
@@ -3378,7 +3513,7 @@ class CodexFilePreviewTracker {
       const code = record.slice(0, 2);
       const path = record.slice(3);
       const remainingBytes = CODEX_DIFF_BASELINE_BYTE_LIMIT - loadedBytes;
-      const content = loadedFiles < CODEX_DIFF_BASELINE_FILE_LIMIT && remainingBytes > 0 ? textFile(resolve6(this.#root, path), remainingBytes) : undefined;
+      const content = loadedFiles < CODEX_DIFF_BASELINE_FILE_LIMIT && remainingBytes > 0 ? textFile(resolve7(this.#root, path), remainingBytes) : undefined;
       this.#baseline.set(path, content);
       if (typeof content === "string") {
         loadedFiles += 1;
@@ -3391,7 +3526,7 @@ class CodexFilePreviewTracker {
   preview(path, succeeded) {
     if (!this.#root || !this.#baselineAvailable || !succeeded)
       return {};
-    const absolute = canonicalPath(isAbsolute(path) ? path : resolve6(this.#cwd, path));
+    const absolute = canonicalPath(isAbsolute(path) ? path : resolve7(this.#cwd, path));
     const relativePath = relative(this.#root, absolute);
     if (!relativePath || relativePath.startsWith("..") || isAbsolute(relativePath))
       return {};
@@ -3426,7 +3561,7 @@ class CodexFilePreviewTracker {
   }
 }
 async function fileChangeEvents(item, previews, cwd, threadId, consumedPatchCallIds) {
-  const expectedPaths = item.changes.map((change) => isAbsolute(change.path) ? change.path : resolve6(cwd, change.path));
+  const expectedPaths = item.changes.map((change) => isAbsolute(change.path) ? change.path : resolve7(cwd, change.path));
   let nativePreview;
   if (threadId && item.status === "completed") {
     await new Promise((resolveDelay) => setTimeout(resolveDelay, 20));
@@ -3551,7 +3686,7 @@ async function* codexProvider(opts) {
   const filePreviews = new CodexFilePreviewTracker(opts.cwd);
   const consumedPatchCallIds = new Set(opts.sessionId ? readCodexPatchCallIds(opts.sessionId) : []);
   const codexAuthPath = hostedCodexAuthFilePath();
-  if (!existsSync5(codexAuthPath)) {
+  if (!existsSync6(codexAuthPath)) {
     yield {
       type: "error",
       content: `Codex auth file not found at ${codexAuthPath}. Run \`codex login\` to authenticate.`
@@ -3590,21 +3725,30 @@ async function* codexProvider(opts) {
     model: opts.model ?? "(sdk default)",
     effort: opts.effort ?? "(off)",
     cwd: opts.cwd,
-    cwdExists: existsSync5(opts.cwd),
+    cwdExists: existsSync6(opts.cwd),
     resume: Boolean(opts.sessionId),
     mcpServerCount: Object.keys(codexMcpServers).length
   }, "codexProvider: starting turn");
   const hostedCodexHome = hostedCodexHomePath();
-  const inheritedCodexHome = process.env.CODEX_HOME || join6(homedir3(), ".codex");
-  const codexEnvironment = scopedBrowserCapability || resolve6(hostedCodexHome) !== resolve6(inheritedCodexHome) ? {
+  const inheritedCodexHome = process.env.CODEX_HOME || join7(homedir3(), ".codex");
+  const codexEnvironment = scopedBrowserCapability || resolve7(hostedCodexHome) !== resolve7(inheritedCodexHome) ? {
     ...Object.fromEntries(Object.entries(process.env).filter((entry) => typeof entry[1] === "string")),
     CODEX_HOME: hostedCodexHome,
     ...scopedBrowserCapability ? { [CODEX_BROWSER_CAPABILITY_ENV]: scopedBrowserCapability } : {}
   } : undefined;
+  let vaultHook;
+  try {
+    vaultHook = await createCodexVaultHookBridge(opts.vaultUserId ?? opts.userId ?? "");
+  } catch (err) {
+    yield { type: "error", content: `Failed to initialize Codex Vault hooks: ${errMsg(err)}` };
+    return;
+  }
   const codex = new Codex({
+    codexPathOverride: vaultHook.codexPathOverride,
     ...codexEnvironment ? { env: codexEnvironment } : {},
     config: {
-      features: { multi_agent: false, multi_agent_v2: false, enable_fanout: false },
+      features: { hooks: true, multi_agent: false, multi_agent_v2: false, enable_fanout: false },
+      hooks: vaultHook.hooks,
       model_catalog_json: codexModelCatalogPath,
       mcp_servers: codexMcpServers,
       ...opts.toolPolicy ? { sandbox_permissions: [] } : {}
@@ -3708,7 +3852,7 @@ async function* codexProvider(opts) {
               if (!item)
                 break;
               if (item.type === "command_execution") {
-                const command = String(item.command ?? "");
+                const command = redactHostedSecrets(opts.vaultUserId ?? opts.userId ?? "", String(item.command ?? ""));
                 yield {
                   type: "tool_use",
                   name: "Bash",
@@ -3716,10 +3860,11 @@ async function* codexProvider(opts) {
                   toolUseId: String(item.id ?? "")
                 };
               } else if (item.type === "mcp_tool_call") {
+                const input = item.arguments && typeof item.arguments === "object" ? item.arguments : {};
                 yield {
                   type: "tool_use",
                   name: String(item.tool ?? "unknown"),
-                  input: item.arguments && typeof item.arguments === "object" ? item.arguments : {},
+                  input: deepMapStrings(input, (value) => redactHostedSecrets(opts.vaultUserId ?? opts.userId ?? "", value)),
                   toolUseId: String(item.id ?? "")
                 };
               }
@@ -3762,7 +3907,7 @@ async function* codexProvider(opts) {
                 yield {
                   type: "tool_result",
                   toolUseId: String(item.id ?? ""),
-                  content: summarizeMcpToolCallResult(item),
+                  content: redactHostedSecrets(opts.vaultUserId ?? opts.userId ?? "", summarizeMcpToolCallResult(item)),
                   ...isError ? { isError: true } : {}
                 };
               } else if (item.type === "command_execution") {
@@ -3770,7 +3915,7 @@ async function* codexProvider(opts) {
                 yield {
                   type: "tool_result",
                   toolUseId: String(item.id ?? ""),
-                  content: String(item.aggregated_output ?? "").slice(0, 200),
+                  content: redactHostedSecrets(opts.vaultUserId ?? opts.userId ?? "", String(item.aggregated_output ?? "").slice(0, 200)),
                   ...isError ? { isError: true } : {}
                 };
               } else if (item.type === "file_change") {
@@ -3779,7 +3924,10 @@ async function* codexProvider(opts) {
                   yield fileEvent;
                 }
               } else if (item.type === "error") {
-                yield { type: "error", content: String(item.message ?? "") };
+                const message = String(item.message ?? "");
+                if (message !== CODEX_HOOK_TRUST_BYPASS_NOTICE) {
+                  yield { type: "error", content: message };
+                }
               }
               break;
             }
@@ -3867,6 +4015,7 @@ async function* codexProvider(opts) {
     abortSignal?.removeEventListener("abort", onAbortKill);
     if (trackedPids.pids.length > 0)
       unregisterOwnedCodexPids(trackedPids.pids);
+    await vaultHook.close();
   }
 }
 
@@ -3874,7 +4023,7 @@ async function* codexProvider(opts) {
 process.env.MAESTRO_SDK_SILENT_BOOTSTRAP ??= "1";
 
 // ../../packages/core/src/agents/maestro-provider.ts
-import { resolve as resolve7 } from "path";
+import { resolve as resolve8 } from "path";
 import { maestroProvider as sdkMaestroProvider, setMcpResolver } from "maestro-agent-sdk";
 var MAESTRO_DEFAULT_MAX_TOKENS = 32768;
 var PROVIDER_ASK_USER_TOOL = "AskUserQuestion";
@@ -3973,7 +4122,7 @@ function buildProviderOwnedToolBlockHook() {
     }
   };
 }
-var MAESTRO_TOOL_OUTPUT_DIR = resolve7(RUN_DIR, "maestro-tool-outputs");
+var MAESTRO_TOOL_OUTPUT_DIR = resolve8(RUN_DIR, "maestro-tool-outputs");
 function buildMaestroToolResultTruncation(opts) {
   if (opts.toolResultTruncation)
     return opts.toolResultTruncation;
@@ -4008,16 +4157,16 @@ function maestroProvider(opts) {
 // ../../packages/core/src/agents/claude-runtime-inspection.ts
 import { readFileSync as readFileSync7 } from "fs";
 import { createRequire as createRequire3 } from "module";
-import { dirname as dirname8, join as join7 } from "path";
+import { dirname as dirname9, join as join8 } from "path";
 var cached;
 function inspectBundledClaudeRuntime() {
   if (cached)
     return cached;
   try {
     const require2 = createRequire3(import.meta.url);
-    const sdkDir = dirname8(require2.resolve("@anthropic-ai/claude-agent-sdk"));
-    const sdkPackage = JSON.parse(readFileSync7(join7(sdkDir, "package.json"), "utf8"));
-    const manifest = JSON.parse(readFileSync7(join7(sdkDir, "manifest.json"), "utf8"));
+    const sdkDir = dirname9(require2.resolve("@anthropic-ai/claude-agent-sdk"));
+    const sdkPackage = JSON.parse(readFileSync7(join8(sdkDir, "package.json"), "utf8"));
+    const manifest = JSON.parse(readFileSync7(join8(sdkDir, "manifest.json"), "utf8"));
     const sdkVersion = typeof sdkPackage.version === "string" ? sdkPackage.version : "";
     const claudeCodeVersion = typeof manifest.version === "string" ? manifest.version : "";
     if (!sdkVersion || !claudeCodeVersion) {
@@ -4090,4 +4239,4 @@ export {
   buildClaudeDisallowedTools
 };
 
-//# debugId=781205E1C0740CD564756E2164756E21
+//# debugId=08FB62E75535D71964756E2164756E21