negotium 0.4.0 → 0.4.2

package/dist/agent-helpers.js

@@ -828,7 +828,8 @@ var init_mcp_catalog_policy = __esm(() => {
     "system-health": { scopes: ["dm", "forum", "manager", "cron"], forumRequired: true },
     "background-bash": { scopes: ["forum"], forumRequired: true },
     "agent-health": { scopes: ["forum", "manager", "cron"], forumRequired: true },
-    vault: { scopes: ["dm", "forum", "manager", "cron"], forumRequired: true }
+    vault: { scopes: ["dm", "forum", "manager", "cron"], forumRequired: true },
+    "cua-rs": { scopes: ["dm", "forum", "fork"], forumRequired: false }
   };
 });
 
@@ -840,6 +841,9 @@ function browserOwnerCapability(capability, owner) {
 var init_capability = () => {};
 
 // ../../packages/core/src/platform/mcp-config.ts
+import { accessSync as accessSync2, constants as fsConstants } from "fs";
+import { homedir as homedir2 } from "os";
+import { join as join2 } from "path";
 function buildStdioMcpServer(agent, serverFile, serverArgs, env) {
   if (agent === "codex") {
     return {
@@ -952,6 +956,27 @@ function backgroundBashTransport(agent, port, userId, topic) {
   }
   return { type: "sse", url: `http://127.0.0.1:${port}/sse`, headers };
 }
+function cuaRsArgs() {
+  const raw = envText("NEGOTIUM_CUA_RS_ALLOW_HID")?.trim().toLowerCase();
+  const on = raw === "1" || raw === "true" || raw === "yes";
+  return on ? ["--allow-hid"] : [];
+}
+function resolveCuaRsBinary(platform = process.platform) {
+  if (platform !== "darwin")
+    return null;
+  const candidates = [
+    envText("NEGOTIUM_CUA_RS_BIN"),
+    join2(homedir2(), ".local", "bin", "cua-rs"),
+    "/usr/local/bin/cua-rs"
+  ].filter((p) => Boolean(p));
+  for (const candidate of candidates) {
+    try {
+      accessSync2(candidate, fsConstants.X_OK);
+      return candidate;
+    } catch {}
+  }
+  return null;
+}
 function refreshForumCatalogViews() {
   const { all, required, optional } = classifyForumMcpServers(MCP_CATALOG);
   allForumMcpServerNames.splice(0, allForumMcpServerNames.length, ...all);
@@ -1385,6 +1410,15 @@ var init_mcp_config = __esm(() => {
           args.push("--list-only=true");
         return buildBuiltinMcpServer("vault", { ...ctx, userId: vaultUserId ?? userId }, () => buildStdioMcpServer(agent, VAULT_SERVER, args));
       }
+    },
+    "cua-rs": {
+      ...commonRuntimeMcpPolicy("cua-rs"),
+      build() {
+        const bin = resolveCuaRsBinary();
+        if (!bin)
+          return null;
+        return { command: bin, args: cuaRsArgs() };
+      }
     }
   };
   allForumMcpServerNames = [];
@@ -1450,8 +1484,8 @@ var init_sqlite = __esm(async () => {
 
 // ../../packages/core/src/storage/storage-host.ts
 import { mkdirSync as mkdirSync2 } from "fs";
-import { homedir as homedir2 } from "os";
-import { dirname as dirname2, join as join2, resolve as resolve3 } from "path";
+import { homedir as homedir3 } from "os";
+import { dirname as dirname2, join as join3, resolve as resolve3 } from "path";
 function storageState() {
   const holder = globalThis;
   const existing = holder[STORAGE_HOST_STATE];
@@ -1479,23 +1513,23 @@ function envPath(name, fallback) {
   return resolve3(value || fallback);
 }
 function defaultStateDir() {
-  return envPath("NEGOTIUM_STATE_DIR", join2(homedir2(), ".negotium"));
+  return envPath("NEGOTIUM_STATE_DIR", join3(homedir3(), ".negotium"));
 }
 function defaultDataDir() {
-  return envPath("NEGOTIUM_DATA_DIR", join2(defaultStateDir(), "data"));
+  return envPath("NEGOTIUM_DATA_DIR", join3(defaultStateDir(), "data"));
 }
 function defaultLogDir() {
-  return envPath("NEGOTIUM_LOG_DIR", join2(defaultStateDir(), "logs"));
+  return envPath("NEGOTIUM_LOG_DIR", join3(defaultStateDir(), "logs"));
 }
 function defaultWorkspaceDir() {
-  return envPath("NEGOTIUM_WORKSPACE_DIR", join2(defaultStateDir(), "workspace"));
+  return envPath("NEGOTIUM_WORKSPACE_DIR", join3(defaultStateDir(), "workspace"));
 }
 function defaultSessionAsksDir() {
-  const runDir = envPath("NEGOTIUM_RUN_DIR", join2(defaultStateDir(), "runtime"));
-  return join2(runDir, "session-asks");
+  const runDir = envPath("NEGOTIUM_RUN_DIR", join3(defaultStateDir(), "runtime"));
+  return join3(runDir, "session-asks");
 }
 function defaultSessionsDatabasePath() {
-  return envPath("SESSIONS_DB_PATH", join2(resolveStorageDataDir(), "sessions.db"));
+  return envPath("SESSIONS_DB_PATH", join3(resolveStorageDataDir(), "sessions.db"));
 }
 function isSqliteBusy(error) {
   const message = error instanceof Error ? error.message : String(error);
@@ -1552,7 +1586,7 @@ function resolveStorageWorkspaceDir() {
   return storageState().configuredHost.workspaceDir ?? defaultWorkspaceDir();
 }
 function resolveStorageSharedWikiDir() {
-  return storageState().configuredHost.sharedWikiDir ?? join2(resolveStorageWorkspaceDir(), "wiki");
+  return storageState().configuredHost.sharedWikiDir ?? join3(resolveStorageWorkspaceDir(), "wiki");
 }
 function registerStorageSchemaInitializer(initialize, priority = 100) {
   const initializers = storageState().schemaInitializers;
@@ -1662,7 +1696,7 @@ var init_vault_crypto = __esm(() => {
 
 // ../../packages/core/src/storage/vault.ts
 import { chmodSync as chmodSync2, mkdirSync as mkdirSync3 } from "fs";
-import { join as join3 } from "path";
+import { join as join4 } from "path";
 function initializeVaultDatabase(database) {
   database.exec("PRAGMA journal_mode = WAL");
   database.exec("PRAGMA busy_timeout = 5000");
@@ -1697,8 +1731,8 @@ function initializeVaultDatabase(database) {
   }
 }
 function openVaultDatabase(dataDir) {
-  const vaultDir = join3(dataDir, "vault");
-  const path = join3(vaultDir, "vault.db");
+  const vaultDir = join4(dataDir, "vault");
+  const path = join4(vaultDir, "vault.db");
   mkdirSync3(vaultDir, { recursive: true, mode: 448 });
   const database = new Database(path, { create: true });
   chmodSync2(path, 384);
@@ -2205,12 +2239,12 @@ var init_jsonl = __esm(() => {
 // ../../packages/core/src/agents/rollout/claude.ts
 import { randomUUID } from "crypto";
 import { existsSync as existsSync2, readFileSync as readFileSync3, writeFileSync as writeFileSync3 } from "fs";
-import { homedir as homedir3 } from "os";
-import { join as join4 } from "path";
+import { homedir as homedir4 } from "os";
+import { join as join5 } from "path";
 function loadClaudeAttachments() {
   if (_attachmentsCache)
     return _attachmentsCache;
-  const raw = readFileSync3(join4(FIXTURES_DIR, "claude-attachments.jsonl"), "utf8");
+  const raw = readFileSync3(join5(FIXTURES_DIR, "claude-attachments.jsonl"), "utf8");
   const lines = parseJsonlText(raw);
   if (lines.length < 2) {
     throw new Error(`loadClaudeAttachments: expected >=2 entries in claude-attachments.jsonl, got ${lines.length}`);
@@ -2311,8 +2345,8 @@ function writeClaudeRollout(opts) {
     });
     lastUuid = assistantUuid;
   }
-  const projectsDir = join4(homedir3(), ".claude", "projects", encodeClaudeCwd(opts.cwd));
-  const path = join4(projectsDir, `${sessionId}.jsonl`);
+  const projectsDir = join5(homedir4(), ".claude", "projects", encodeClaudeCwd(opts.cwd));
+  const path = join5(projectsDir, `${sessionId}.jsonl`);
   writeJsonlFile(path, lines);
   logger.info({ sessionId, path, pairs: pairs.length }, "writeClaudeRollout: synthetic rollout placed");
   return { sessionId, rolloutPath: path };
@@ -2326,8 +2360,8 @@ var init_claude = __esm(() => {
 
 // ../../packages/core/src/agents/claude-registry.ts
 import { existsSync as existsSync3, mkdirSync as mkdirSync6, readdirSync, renameSync as renameSync2, unlinkSync as unlinkSync3 } from "fs";
-import { homedir as homedir4 } from "os";
-import { join as join5 } from "path";
+import { homedir as homedir5 } from "os";
+import { join as join6 } from "path";
 var ALIAS_MAP, VALID_ALIASES, VALID_EFFORTS, claudeRegistry, claudeRegistryOperations;
 var init_claude_registry = __esm(() => {
   init_claude();
@@ -2374,11 +2408,11 @@ var init_claude_registry = __esm(() => {
       const result = await forkSession(parentSessionId, {
         ...title ? { title } : {}
       });
-      const projectsRoot = join5(homedir4(), ".claude", "projects");
-      const destDir = join5(projectsRoot, encodeClaudeCwd(cwd));
-      const destPath = join5(destDir, `${result.sessionId}.jsonl`);
+      const projectsRoot = join6(homedir5(), ".claude", "projects");
+      const destDir = join6(projectsRoot, encodeClaudeCwd(cwd));
+      const destPath = join6(destDir, `${result.sessionId}.jsonl`);
       if (!existsSync3(destPath)) {
-        const sourcePath = readdirSync(projectsRoot).map((d) => join5(projectsRoot, d, `${result.sessionId}.jsonl`)).find((p) => existsSync3(p));
+        const sourcePath = readdirSync(projectsRoot).map((d) => join6(projectsRoot, d, `${result.sessionId}.jsonl`)).find((p) => existsSync3(p));
         if (!sourcePath) {
           throw new Error(`claude forkSession: fork rollout ${result.sessionId}.jsonl not found under ${projectsRoot}`);
         }
@@ -2391,10 +2425,10 @@ var init_claude_registry = __esm(() => {
       };
     },
     async cleanupRollouts({ cwd, sessionIds }) {
-      const projectsDir = join5(homedir4(), ".claude", "projects", encodeClaudeCwd(cwd));
+      const projectsDir = join6(homedir5(), ".claude", "projects", encodeClaudeCwd(cwd));
       const failures = [];
       for (const sid of sessionIds) {
-        const path = join5(projectsDir, `${sid}.jsonl`);
+        const path = join6(projectsDir, `${sid}.jsonl`);
         try {
           unlinkSync3(path);
         } catch (e) {
@@ -2412,7 +2446,7 @@ var init_claude_registry = __esm(() => {
 });
 
 // ../../packages/core/src/version.ts
-var NEGOTIUM_VERSION = "0.4.0";
+var NEGOTIUM_VERSION = "0.4.2";
 
 // ../../packages/core/src/agents/codex-native-multi-agent.ts
 import { spawn as spawn2 } from "child_process";
@@ -2430,7 +2464,7 @@ import {
 } from "fs";
 import { createRequire as createRequire2 } from "module";
 import { tmpdir } from "os";
-import { dirname as dirname5, join as join6 } from "path";
+import { dirname as dirname5, join as join7 } from "path";
 function readPackageVersion(packageJsonPath) {
   const parsed = JSON.parse(readFileSync4(packageJsonPath, "utf8"));
   if (typeof parsed.version !== "string" || !parsed.version.trim()) {
@@ -2439,7 +2473,7 @@ function readPackageVersion(packageJsonPath) {
   return parsed.version;
 }
 function codexCliScriptPath() {
-  return join6(dirname5(bundledCodexPackagePath), "bin", "codex.js");
+  return join7(dirname5(bundledCodexPackagePath), "bin", "codex.js");
 }
 function parseCodexModelCache(contents, sourcePath) {
   let parsed;
@@ -2480,7 +2514,7 @@ function writePrivateFileAtomic(path, contents) {
   }
 }
 function bundledCodexModelCachePath(authFilePath) {
-  return join6(dirname5(authFilePath), NEGOTIUM_MODEL_CACHE);
+  return join7(dirname5(authFilePath), NEGOTIUM_MODEL_CACHE);
 }
 async function bootstrapCodexModelCache(codexHome, cachePath) {
   const child = spawn2(process.execPath, [codexCliScriptPath(), "app-server", "--stdio"], {
@@ -2566,15 +2600,15 @@ async function bootstrapCodexModelCache(codexHome, cachePath) {
 }
 async function bootstrapIsolatedCodexModelCache(authFilePath, bootstrap) {
   const sourceHome = dirname5(authFilePath);
-  const isolatedHome = mkdtempSync(join6(tmpdir(), "negotium-codex-models-"));
-  const isolatedCachePath = join6(isolatedHome, "models_cache.json");
+  const isolatedHome = mkdtempSync(join7(tmpdir(), "negotium-codex-models-"));
+  const isolatedCachePath = join7(isolatedHome, "models_cache.json");
   try {
-    const isolatedAuthPath = join6(isolatedHome, "auth.json");
+    const isolatedAuthPath = join7(isolatedHome, "auth.json");
     copyFileSync(authFilePath, isolatedAuthPath);
     chmodSync3(isolatedAuthPath, 384);
-    const sourceConfigPath = join6(sourceHome, "config.toml");
+    const sourceConfigPath = join7(sourceHome, "config.toml");
     if (existsSync4(sourceConfigPath)) {
-      const isolatedConfigPath = join6(isolatedHome, "config.toml");
+      const isolatedConfigPath = join7(isolatedHome, "config.toml");
       copyFileSync(sourceConfigPath, isolatedConfigPath);
       chmodSync3(isolatedConfigPath, 384);
     }
@@ -2595,7 +2629,7 @@ async function ensureCodexModelCache(authFilePath, bootstrap = bootstrapCodexMod
     return configuredCachePath;
   }
   const bundledCachePath = bundledCodexModelCachePath(authFilePath);
-  const sharedCachePath = join6(codexHome, "models_cache.json");
+  const sharedCachePath = join7(codexHome, "models_cache.json");
   if (existsSync4(sharedCachePath)) {
     try {
       const shared = readCompatibleCodexModelCache(sharedCachePath);
@@ -2615,7 +2649,7 @@ async function ensureCodexModelCache(authFilePath, bootstrap = bootstrapCodexMod
 }
 function writeCodexCatalogWithNativeMultiAgentDisabled(authFilePath, sourcePath) {
   const codexHome = dirname5(authFilePath);
-  const outputPath = join6(codexHome, NEGOTIUM_MODEL_CATALOG);
+  const outputPath = join7(codexHome, NEGOTIUM_MODEL_CATALOG);
   const parsed = readCodexModelCache(sourcePath).parsed;
   const models = parsed.models.map((model, index) => {
     if (!model || typeof model !== "object" || Array.isArray(model)) {
@@ -2643,14 +2677,14 @@ var init_codex_native_multi_agent = __esm(() => {
 // ../../packages/core/src/agents/rollout/codex.ts
 import { randomBytes as randomBytes4 } from "crypto";
 import { existsSync as existsSync5, readFileSync as readFileSync5, realpathSync as realpathSync2, statSync as statSync2, unlinkSync as unlinkSync5 } from "fs";
-import { basename, dirname as dirname6, join as join7, resolve as resolve5 } from "path";
+import { basename, dirname as dirname6, join as join8, resolve as resolve5 } from "path";
 function codexSessionsDir() {
-  return join7(hostedCodexHomePath(), "sessions");
+  return join8(hostedCodexHomePath(), "sessions");
 }
 function loadCodexShell() {
   if (_shellCache)
     return _shellCache;
-  const raw = readFileSync5(join7(FIXTURES_DIR, "codex-shell.jsonl"), "utf8");
+  const raw = readFileSync5(join8(FIXTURES_DIR, "codex-shell.jsonl"), "utf8");
   const lines = parseJsonlText(raw);
   if (lines.length < 5) {
     throw new Error(`loadCodexShell: expected >=5 entries in codex-shell.jsonl, got ${lines.length}`);
@@ -2717,8 +2751,8 @@ function codexRolloutPath(threadId, fallback) {
   const hh = String(createdAt.getHours()).padStart(2, "0");
   const min = String(createdAt.getMinutes()).padStart(2, "0");
   const ss = String(createdAt.getSeconds()).padStart(2, "0");
-  const dir = join7(codexSessionsDir(), yyyy, mm, dd);
-  return join7(dir, `rollout-${yyyy}-${mm}-${dd}T${hh}-${min}-${ss}-${threadId}.jsonl`);
+  const dir = join8(codexSessionsDir(), yyyy, mm, dd);
+  return join8(dir, `rollout-${yyyy}-${mm}-${dd}T${hh}-${min}-${ss}-${threadId}.jsonl`);
 }
 function canonicalFilePath(path) {
   const absolute = resolve5(path);
@@ -2726,7 +2760,7 @@ function canonicalFilePath(path) {
     return realpathSync2(absolute);
   } catch {
     try {
-      return join7(realpathSync2(dirname6(absolute)), basename(absolute));
+      return join8(realpathSync2(dirname6(absolute)), basename(absolute));
     } catch {
       return absolute;
     }
@@ -2956,19 +2990,19 @@ function latestCodexRolloutPath(threadId) {
   try {
     if (buckets) {
       for (const bucket of buckets) {
-        const dir = join7(sessionsDir, bucket);
+        const dir = join8(sessionsDir, bucket);
         if (!existsSync5(dir))
           continue;
         const glob = new Bun.Glob(`rollout-*-${threadId}.jsonl`);
         for (const rel of glob.scanSync({ cwd: dir, onlyFiles: true })) {
-          candidates.push(join7(dir, rel));
+          candidates.push(join8(dir, rel));
         }
       }
     }
     if (candidates.length === 0) {
       const glob = new Bun.Glob(`**/rollout-*-${threadId}.jsonl`);
       for (const rel of glob.scanSync({ cwd: sessionsDir, onlyFiles: true })) {
-        candidates.push(join7(sessionsDir, rel));
+        candidates.push(join8(sessionsDir, rel));
       }
     }
     return candidates.sort((a, b) => statSync2(b).mtimeMs - statSync2(a).mtimeMs)[0];
@@ -3089,13 +3123,13 @@ function sweepPriorRolloutsForThread(threadId) {
     return;
   }
   for (const bucket of buckets) {
-    const dir = join7(sessionsDir, bucket);
+    const dir = join8(sessionsDir, bucket);
     if (!existsSync5(dir))
       continue;
     try {
       const glob = new Bun.Glob(`rollout-*-${threadId}.jsonl`);
       for (const rel of glob.scanSync({ cwd: dir, onlyFiles: true })) {
-        const fullPath = join7(dir, rel);
+        const fullPath = join8(dir, rel);
         try {
           unlinkSync5(fullPath);
         } catch (e) {
@@ -3113,7 +3147,7 @@ function sweepPriorRolloutsFullTree(threadId, sessionsDir) {
   try {
     const glob = new Bun.Glob(`**/rollout-*-${threadId}.jsonl`);
     for (const rel of glob.scanSync({ cwd: sessionsDir, onlyFiles: true })) {
-      const fullPath = join7(sessionsDir, rel);
+      const fullPath = join8(sessionsDir, rel);
       try {
         unlinkSync5(fullPath);
       } catch (e) {
@@ -3291,7 +3325,7 @@ var init_codex_app_server = __esm(async () => {
 
 // ../../packages/core/src/agents/codex-registry.ts
 import { existsSync as existsSync6, unlinkSync as unlinkSync6 } from "fs";
-import { join as join8 } from "path";
+import { join as join9 } from "path";
 var VALID_EFFORTS2, codexRegistry, codexRegistryOperations;
 var init_codex_registry = __esm(async () => {
   await init_codex_app_server();
@@ -3334,7 +3368,7 @@ var init_codex_registry = __esm(async () => {
     async cleanupRollouts({ sessionIds }) {
       if (sessionIds.length === 0)
         return;
-      const sessionsDir = join8(hostedCodexHomePath(), "sessions");
+      const sessionsDir = join9(hostedCodexHomePath(), "sessions");
       if (!existsSync6(sessionsDir))
         return;
       const failures = [];
@@ -3342,7 +3376,7 @@ var init_codex_registry = __esm(async () => {
         try {
           const glob = new Bun.Glob(`**/rollout-*-${tid}.jsonl`);
           for await (const rel of glob.scan({ cwd: sessionsDir, onlyFiles: true })) {
-            const path = join8(sessionsDir, rel);
+            const path = join9(sessionsDir, rel);
             try {
               unlinkSync6(path);
             } catch (e) {
@@ -3367,16 +3401,16 @@ var init_codex_registry = __esm(async () => {
 // ../../packages/core/src/agents/maestro-registry.ts
 import { randomUUID as randomUUID3 } from "crypto";
 import { existsSync as existsSync7, mkdirSync as mkdirSync7, readFileSync as readFileSync6, writeFileSync as writeFileSync5 } from "fs";
-import { homedir as homedir5 } from "os";
-import { join as join9, resolve as resolve6 } from "path";
+import { homedir as homedir6 } from "os";
+import { join as join10, resolve as resolve6 } from "path";
 function maestroSessionsDir() {
-  return join9(process.env.MAESTRO_DATA_DIR ? resolve6(process.env.MAESTRO_DATA_DIR) : join9(homedir5(), ".maestro"), "sessions");
+  return join10(process.env.MAESTRO_DATA_DIR ? resolve6(process.env.MAESTRO_DATA_DIR) : join10(homedir6(), ".maestro"), "sessions");
 }
 function maestroSessionPath(sessionId) {
-  return join9(maestroSessionsDir(), `${sessionId}.jsonl`);
+  return join10(maestroSessionsDir(), `${sessionId}.jsonl`);
 }
 function maestroActiveSessionPath(sessionId) {
-  return join9(maestroSessionsDir(), `${sessionId}.active.jsonl`);
+  return join10(maestroSessionsDir(), `${sessionId}.active.jsonl`);
 }
 function existingCreatedAt(path) {
   if (!existsSync7(path))
@@ -3552,7 +3586,7 @@ function sanitizeId(id) {
 
 // ../../packages/core/src/storage/tasks.ts
 import { existsSync as existsSync8, mkdirSync as mkdirSync8, readFileSync as readFileSync7, renameSync as renameSync4, statSync as statSync3, writeFileSync as writeFileSync6 } from "fs";
-import { dirname as dirname7, join as join10 } from "path";
+import { dirname as dirname7, join as join11 } from "path";
 function safeTaskScopeKey(scopeKey) {
   const safe = sanitizeFileName(scopeKey);
   if (!safe || safe === "." || safe === "..") {
@@ -3564,7 +3598,7 @@ function taskScopeKey(opts) {
   return opts.topicId?.trim() || opts.session || "default";
 }
 function getTaskFilePath(userId, scopeKey) {
-  return join10(resolveStorageDataDir(), "tasks", `${safeTaskScopeKey(scopeKey)}.json`);
+  return join11(resolveStorageDataDir(), "tasks", `${safeTaskScopeKey(scopeKey)}.json`);
 }
 function readTasks(userId, scopeKey) {
   const path = getTaskFilePath(userId, scopeKey);
@@ -3640,16 +3674,16 @@ import {
   unlinkSync as unlinkSync7,
   writeFileSync as writeFileSync7
 } from "fs";
-import { dirname as dirname8, join as join11 } from "path";
+import { dirname as dirname8, join as join12 } from "path";
 function conversationDir(_userId) {
-  return join11(resolveStorageDataDir(), "conversations");
+  return join12(resolveStorageDataDir(), "conversations");
 }
 function topicFilename(topicName) {
   const t = sanitizeTopicName(topicName, true);
   return `${t}.jsonl`;
 }
 function getConversationPath(userId, topicName) {
-  return join11(conversationDir(userId), topicFilename(topicName));
+  return join12(conversationDir(userId), topicFilename(topicName));
 }
 function getActiveConversationPath(userId, topicName) {
   const rawPath = getConversationPath(userId, topicName);
@@ -4583,7 +4617,7 @@ import { existsSync as existsSync11 } from "fs";
 import { chmod, mkdtemp, rm, writeFile } from "fs/promises";
 import { createServer } from "net";
 import { tmpdir as tmpdir2 } from "os";
-import { dirname as dirname9, join as join12, resolve as resolve7 } from "path";
+import { dirname as dirname9, join as join13, resolve as resolve7 } from "path";
 import { fileURLToPath as fileURLToPath2 } from "url";
 function evaluateCodexVaultPreToolUse(input, userId, operations) {
   if (operations.referencesSensitiveStorage(input.tool_input)) {
@@ -4621,9 +4655,11 @@ function hookClientPath() {
     return packaged;
   throw new Error("Codex Vault hook client is missing from this installation");
 }
-function privateCodexWrapper(codexScript) {
+function privateCodexWrapper(codexScript, socketPath, token) {
   return [
     "#!/bin/sh",
+    `export ${HOOK_SOCKET_ENV}=${shellQuote(socketPath)}`,
+    `export ${HOOK_TOKEN_ENV}=${shellQuote(token)}`,
     'if [ "$1" = "exec" ]; then',
     "  shift",
     `  exec ${shellQuote(process.execPath)} ${shellQuote(codexScript)} exec --dangerously-bypass-hook-trust "$@"`,
@@ -4634,10 +4670,10 @@ function privateCodexWrapper(codexScript) {
 `);
 }
 async function createCodexVaultHookBridge(userId) {
-  const root = await mkdtemp(join12(tmpdir2(), "negotium-codex-vault-"));
+  const root = await mkdtemp(join13(tmpdir2(), "negotium-codex-vault-"));
   await chmod(root, 448);
-  const socketPath = join12(root, "hook.sock");
-  const wrapperPath = join12(root, "codex-with-hooks");
+  const socketPath = join13(root, "hook.sock");
+  const wrapperPath = join13(root, "codex-with-hooks");
   const token = randomBytes5(32).toString("hex");
   const connections = new Set;
   const server = createServer((socket) => {
@@ -4686,15 +4722,13 @@ async function createCodexVaultHookBridge(userId) {
       });
     });
     await chmod(socketPath, 384);
-    await writeFile(wrapperPath, privateCodexWrapper(codexCliScriptPath()), { mode: 448 });
-    const command = [
-      shellQuote(process.execPath),
-      shellQuote(hookClientPath()),
-      shellQuote(socketPath),
-      shellQuote(token)
-    ].join(" ");
+    await writeFile(wrapperPath, privateCodexWrapper(codexCliScriptPath(), socketPath, token), {
+      mode: 448
+    });
+    const command = [shellQuote(process.execPath), shellQuote(hookClientPath())].join(" ");
     return {
       codexPathOverride: wrapperPath,
+      environment: { [HOOK_SOCKET_ENV]: socketPath, [HOOK_TOKEN_ENV]: token },
       hooks: {
         PreToolUse: [
           {
@@ -4723,7 +4757,7 @@ async function createCodexVaultHookBridge(userId) {
     throw error;
   }
 }
-var MAX_HOOK_REQUEST_BYTES, SENSITIVE_STORAGE_DENIAL = "Runtime secret storage access is not permitted";
+var MAX_HOOK_REQUEST_BYTES, SENSITIVE_STORAGE_DENIAL = "Runtime secret storage access is not permitted", HOOK_SOCKET_ENV = "NEGOTIUM_CODEX_VAULT_HOOK_SOCKET", HOOK_TOKEN_ENV = "NEGOTIUM_CODEX_VAULT_HOOK_TOKEN";
 var init_codex_vault_hook_bridge = __esm(async () => {
   init_codex_native_multi_agent();
   await init_execution_host();
@@ -5256,8 +5290,8 @@ __export(exports_codex_provider, {
 });
 import { execFileSync as execFileSync4 } from "child_process";
 import { existsSync as existsSync12, readFileSync as readFileSync11, realpathSync as realpathSync3, statSync as statSync5 } from "fs";
-import { homedir as homedir6 } from "os";
-import { dirname as dirname10, isAbsolute as isAbsolute2, join as join13, relative, resolve as resolve9 } from "path";
+import { homedir as homedir7 } from "os";
+import { dirname as dirname10, isAbsolute as isAbsolute2, join as join14, relative, resolve as resolve9 } from "path";
 import { Codex } from "@openai/codex-sdk";
 function sameCodexUsage(usage, total) {
   return usage.input_tokens === total.inputTokens && usage.output_tokens === total.outputTokens && (usage.cached_input_tokens ?? 0) === total.cachedInputTokens && (usage.cache_write_input_tokens ?? 0) === total.cacheWriteInputTokens;
@@ -5285,7 +5319,7 @@ function codexMcpServerName(name) {
   return CODEX_MCP_SERVER_NAME_OVERRIDES[name] ?? name;
 }
 function globalCodexMcpServerNames(authFilePath) {
-  const configPath = join13(dirname10(authFilePath), "config.toml");
+  const configPath = join14(dirname10(authFilePath), "config.toml");
   if (!existsSync12(configPath))
     return [];
   try {
@@ -5643,7 +5677,7 @@ async function* codexProvider(opts) {
     mcpServerCount: Object.keys(codexMcpServers).length
   }, "codexProvider: starting turn");
   const hostedCodexHome = hostedCodexHomePath();
-  const inheritedCodexHome = process.env.CODEX_HOME || join13(homedir6(), ".codex");
+  const inheritedCodexHome = process.env.CODEX_HOME || join14(homedir7(), ".codex");
   const codexEnvironment = scopedBrowserCapability || resolve9(hostedCodexHome) !== resolve9(inheritedCodexHome) ? {
     ...Object.fromEntries(Object.entries(process.env).filter((entry) => typeof entry[1] === "string")),
     CODEX_HOME: hostedCodexHome,
@@ -5837,7 +5871,10 @@ async function* codexProvider(opts) {
                   yield fileEvent;
                 }
               } else if (item.type === "error") {
-                yield { type: "error", content: String(item.message ?? "") };
+                const message = String(item.message ?? "");
+                if (message !== CODEX_HOOK_TRUST_BYPASS_NOTICE) {
+                  yield { type: "error", content: message };
+                }
               }
               break;
             }
@@ -5928,7 +5965,7 @@ async function* codexProvider(opts) {
     await vaultHook.close();
   }
 }
-var CODEX_MCP_SERVER_NAME_OVERRIDES, CODEX_DIFF_FILE_LIMIT, CODEX_DIFF_BASELINE_FILE_LIMIT = 200, CODEX_DIFF_BASELINE_BYTE_LIMIT, CODEX_STARTUP_TIMEOUT_MS = 90000;
+var CODEX_HOOK_TRUST_BYPASS_NOTICE = "`--dangerously-bypass-hook-trust` is enabled. Enabled hooks may run without review for this invocation.", CODEX_MCP_SERVER_NAME_OVERRIDES, CODEX_DIFF_FILE_LIMIT, CODEX_DIFF_BASELINE_FILE_LIMIT = 200, CODEX_DIFF_BASELINE_BYTE_LIMIT, CODEX_STARTUP_TIMEOUT_MS = 90000;
 var init_codex_provider = __esm(async () => {
   init_codex_native_multi_agent();
   init_codex_tree_kill();
@@ -6099,8 +6136,8 @@ var init_maestro_provider = __esm(async () => {
 
 // ../../packages/core/src/agents/index.ts
 import { existsSync as existsSync13 } from "fs";
-import { homedir as homedir7 } from "os";
-import { join as join14 } from "path";
+import { homedir as homedir8 } from "os";
+import { join as join15 } from "path";
 async function* dispatchAgent(opts) {
   switch (opts.agent) {
     case "claude": {
@@ -6134,11 +6171,11 @@ async function resolveSessionFileMissing(agent, sessionId, cwd) {
   switch (agent) {
     case "claude": {
       const encodedCwd = encodeClaudeCwd(cwd);
-      const path = join14(homedir7(), ".claude", "projects", encodedCwd, `${sessionId}.jsonl`);
+      const path = join15(homedir8(), ".claude", "projects", encodedCwd, `${sessionId}.jsonl`);
       return !existsSync13(path);
     }
     case "codex": {
-      const sessionsDir = join14(hostedCodexHomePath(), "sessions");
+      const sessionsDir = join15(hostedCodexHomePath(), "sessions");
       const glob = new Bun.Glob(`**/rollout-*-${sessionId}.jsonl`);
       for await (const _rel of glob.scan({ cwd: sessionsDir, onlyFiles: true })) {
         return false;
@@ -7393,9 +7430,9 @@ var init_api_topic_brief = __esm(async () => {
 });
 
 // ../../packages/core/src/storage/wiki.ts
-import { basename as basename2, dirname as dirname11, join as join15 } from "path";
+import { basename as basename2, dirname as dirname11, join as join16 } from "path";
 function getSharedWikiDir(workspaceDir = resolveStorageWorkspaceDir()) {
-  return workspaceDir === resolveStorageWorkspaceDir() ? resolveStorageSharedWikiDir() : join15(workspaceDir, "wiki");
+  return workspaceDir === resolveStorageWorkspaceDir() ? resolveStorageSharedWikiDir() : join16(workspaceDir, "wiki");
 }
 var init_wiki = __esm(async () => {
   await init_storage_host();
@@ -8230,7 +8267,7 @@ var init_personal_general = __esm(async () => {
 // ../../packages/core/src/agents/archiver.ts
 import { randomUUID as randomUUID6 } from "crypto";
 import { existsSync as existsSync14, readdirSync as readdirSync2, readFileSync as readFileSync13, statSync as statSync6 } from "fs";
-import { join as join16 } from "path";
+import { join as join17 } from "path";
 function resolveMemoryLanguage() {
   const override = process.env.NEGOTIUM_MEMORY_LANG?.trim();
   return override && override.length > 0 ? override : resolveOutputLanguage();
@@ -8481,10 +8518,10 @@ function distillOneLine(summaryMd) {
   return "";
 }
 function findSummaryFile(storage, topicTitle, date, sinceMs, topicId) {
-  const dir = join16(storage.getWikiDir(), "summaries");
+  const dir = join17(storage.getWikiDir(), "summaries");
   if (!storage.fileExists(dir))
     return null;
-  const predicted = join16(dir, wikiSummaryFilename(date, topicTitle, topicId));
+  const predicted = join17(dir, wikiSummaryFilename(date, topicTitle, topicId));
   if (storage.fileExists(predicted) && storage.fileModifiedAt(predicted) >= sinceMs)
     return predicted;
   let best = null;
@@ -8492,7 +8529,7 @@ function findSummaryFile(storage, topicTitle, date, sinceMs, topicId) {
     if (!f.startsWith(`${date}-`) || !isTopicSummaryFile(f, topicId ?? "", topicTitle)) {
       continue;
     }
-    const p = join16(dir, f);
+    const p = join17(dir, f);
     try {
       const m = storage.fileModifiedAt(p);
       if (m >= sinceMs && (!best || m > best.mtime))
@@ -8619,8 +8656,8 @@ __export(exports_auth_check, {
 });
 import { execFileSync as execFileSync5 } from "child_process";
 import { existsSync as existsSync15 } from "fs";
-import { homedir as homedir8, platform } from "os";
-import { join as join17 } from "path";
+import { homedir as homedir9, platform } from "os";
+import { join as join18 } from "path";
 function hasMaestroCredential(host, key, userId) {
   if (userId && host.getVaultValue(userId, key)?.trim())
     return true;
@@ -8640,7 +8677,7 @@ function checkAgentAuth(agent, host = defaultAgentAuthHost, userId) {
     case "claude": {
       if (host.environment.ANTHROPIC_API_KEY)
         return { ok: true };
-      const path = join17(host.homeDirectory(), ".claude", ".credentials.json");
+      const path = join18(host.homeDirectory(), ".claude", ".credentials.json");
       if (host.operatingSystem() === "darwin") {
         if (host.hasMacOsCredential("Claude Code-credentials") || host.exists(path)) {
           return { ok: true };
@@ -8693,7 +8730,7 @@ var init_auth_check = __esm(async () => {
     codexAuthFilePath,
     exists: existsSync15,
     environment: process.env,
-    homeDirectory: homedir8,
+    homeDirectory: homedir9,
     operatingSystem: platform,
     hasMacOsCredential(service) {
       try {
@@ -9401,13 +9438,13 @@ function formatTopicArchiveTranscriptRecord(row, topicTitle, index) {
 
 // ../../packages/core/src/storage/topic-archive.ts
 import { mkdirSync as mkdirSync10, writeFileSync as writeFileSync8 } from "fs";
-import { join as join18 } from "path";
+import { join as join19 } from "path";
 function archiveTopicMessages(topicId, topicTitle, options = {}) {
   const rows = options.afterRowid !== undefined ? getMessagesForTopicAfterRowid(topicId, options.afterRowid) : getAllMessagesForTopic(topicId);
   if (rows.length === 0)
     return null;
   const safeTopic = sanitizeTopicName(topicTitle, true);
-  const archiveDir = join18(getSharedWikiDir(), "archive");
+  const archiveDir = join19(getSharedWikiDir(), "archive");
   mkdirSync10(archiveDir, { recursive: true });
   const date = new Date().toISOString().slice(0, 10);
   const reasonSuffix = options.reason && options.reason !== "delete" ? `_${options.reason}` : "";
@@ -9420,7 +9457,7 @@ function archiveTopicMessages(topicId, topicTitle, options = {}) {
   let path;
   while (true) {
     filename = `${safeTopic}_${date}${reasonSuffix}${counter === 1 ? "" : `_${counter}`}.jsonl`;
-    path = join18(archiveDir, filename);
+    path = join19(archiveDir, filename);
     try {
       writeFileSync8(path, body, { flag: "wx" });
       break;
@@ -9465,7 +9502,7 @@ function archiveConversationEvents(topicId, topicTitle, userId, options = {}) {
   const entries = readRawConversation(userId, topicTitle);
   if (entries.length === 0)
     return null;
-  const archiveDir = join18(getSharedWikiDir(), "archive");
+  const archiveDir = join19(getSharedWikiDir(), "archive");
   mkdirSync10(archiveDir, { recursive: true });
   const safeTopic = sanitizeTopicName(topicTitle, true);
   const date = new Date().toISOString().slice(0, 10);
@@ -9493,7 +9530,7 @@ function archiveConversationEvents(topicId, topicTitle, userId, options = {}) {
   let counter = 1;
   while (true) {
     const suffix = counter === 1 ? "" : `_${counter}`;
-    const path = join18(archiveDir, `${safeTopic}_${date}${reasonSuffix}_events${suffix}.jsonl`);
+    const path = join19(archiveDir, `${safeTopic}_${date}${reasonSuffix}_events${suffix}.jsonl`);
     try {
       writeFileSync8(path, body, { flag: "wx" });
       logger.info({ topicId, topicTitle, archive: path, eventCount: entries.length }, "archiveConversationEvents: archived raw conversation events");
@@ -10826,13 +10863,13 @@ var init_browser_processes = __esm(async () => {
 });
 
 // ../../packages/core/src/platform/playwright/headed-launch.ts
-import { accessSync as accessSync2, constants as constants2 } from "fs";
+import { accessSync as accessSync3, constants as constants2 } from "fs";
 import { delimiter, isAbsolute as isAbsolute4, resolve as resolve14 } from "path";
 function findExecutableOnPath(command, environment = process.env) {
   const candidates = isAbsolute4(command) ? [command] : (environment.PATH ?? "").split(delimiter).filter(Boolean).map((directory) => resolve14(directory, command));
   for (const candidate of candidates) {
     try {
-      accessSync2(candidate, constants2.X_OK);
+      accessSync3(candidate, constants2.X_OK);
       return candidate;
     } catch {}
   }
@@ -10931,7 +10968,7 @@ import { randomBytes as randomBytes6, timingSafeEqual as timingSafeEqual2 } from
 import { chmodSync as chmodSync4 } from "fs";
 import { createServer as createServer3 } from "net";
 import { tmpdir as tmpdir3 } from "os";
-import { join as join19 } from "path";
+import { join as join20 } from "path";
 function deepMapStrings2(value, transform) {
   if (typeof value === "string")
     return transform(value);
@@ -11018,7 +11055,7 @@ function authorized(actual, expected) {
 }
 async function createBrowserVaultBroker(userId) {
   const token = randomBytes6(32).toString("hex");
-  const socketPath = join19(process.platform === "win32" ? tmpdir3() : "/tmp", `negotium-browser-vault-${process.pid}-${randomBytes6(8).toString("hex")}.sock`);
+  const socketPath = join20(process.platform === "win32" ? tmpdir3() : "/tmp", `negotium-browser-vault-${process.pid}-${randomBytes6(8).toString("hex")}.sock`);
   const retainedForms = new Map;
   const leases = new Map;
   const sockets = new Set;
@@ -11227,7 +11264,7 @@ import {
   unlinkSync as unlinkSync11,
   writeFileSync as writeFileSync9
 } from "fs";
-import { dirname as dirname12, join as join20, resolve as resolve15 } from "path";
+import { dirname as dirname12, join as join21, resolve as resolve15 } from "path";
 function removeDefaultProfileDataDir(userDataDir) {
   const root = resolve15(BROWSER_PROFILES_DIR);
   const target = resolve15(userDataDir);
@@ -11317,14 +11354,14 @@ function portFileName(instanceKey) {
 function writePortFile(instanceKey, port) {
   try {
     mkdirSync11(managerHost.portsDir, { recursive: true });
-    writeFileSync9(join20(managerHost.portsDir, portFileName(instanceKey)), String(port));
+    writeFileSync9(join21(managerHost.portsDir, portFileName(instanceKey)), String(port));
   } catch (e) {
     logger.warn({ err: e, instanceKey, port }, "Failed to save playwright port file");
   }
 }
 function deletePortFile(instanceKey) {
   try {
-    unlinkSync11(join20(managerHost.portsDir, portFileName(instanceKey)));
+    unlinkSync11(join21(managerHost.portsDir, portFileName(instanceKey)));
   } catch (e) {
     if (e.code === "ENOENT")
       return;
@@ -12483,7 +12520,7 @@ var init_runtime_turn_requests = __esm(async () => {
 import { randomUUID as randomUUID11 } from "crypto";
 import { mkdtempSync as mkdtempSync2, rmSync as rmSync4, writeFileSync as writeFileSync11 } from "fs";
 import { tmpdir as tmpdir4 } from "os";
-import { join as join21 } from "path";
+import { join as join22 } from "path";
 function previousCompactedSummary(entries) {
   for (let index = entries.length - 2;index >= 0; index -= 1) {
     const request = entries[index]?.event;
@@ -12613,7 +12650,7 @@ function formatCompactElapsed(startedAt) {
 async function summarizeTopicContext(request) {
   const startedAt = Date.now();
   const sessionIds = [];
-  const compactCwd = mkdtempSync2(join21(tmpdir4(), "negotium-compact-"));
+  const compactCwd = mkdtempSync2(join22(tmpdir4(), "negotium-compact-"));
   const abortController = new AbortController;
   const relayAbort = () => abortController.abort(request.signal?.reason);
   if (request.signal?.aborted)
@@ -12640,7 +12677,7 @@ async function summarizeTopicContext(request) {
   let error = "";
   let toolViolation = false;
   let compactionLogCalls = 0;
-  const compactionLogPath = join21(compactCwd, "conversation.log");
+  const compactionLogPath = join22(compactCwd, "conversation.log");
   try {
     const compactionMcp = useCompactionLog ? {
       compact_log: {
@@ -13259,14 +13296,14 @@ var init_derive = __esm(async () => {
 });
 
 // ../../packages/core/src/query/session-inbox-path.ts
-import { join as join22 } from "path";
+import { join as join23 } from "path";
 function sessionInboxPath(userId, topicId) {
   const key = Buffer.from(topicId, "utf8").toString("base64url");
-  return join22(SESSION_INBOX_DIR, userId, `${TOPIC_ID_FILE_PREFIX}${key}${JSONL_SUFFIX}`);
+  return join23(SESSION_INBOX_DIR, userId, `${TOPIC_ID_FILE_PREFIX}${key}${JSONL_SUFFIX}`);
 }
 function scheduledSessionInboxPath(userId, topicId) {
   const key = Buffer.from(topicId, "utf8").toString("base64url");
-  return join22(SESSION_INBOX_DIR, userId, `${TOPIC_ID_FILE_PREFIX}${key}${SCHEDULE_SUFFIX}`);
+  return join23(SESSION_INBOX_DIR, userId, `${TOPIC_ID_FILE_PREFIX}${key}${SCHEDULE_SUFFIX}`);
 }
 var TOPIC_ID_FILE_PREFIX = "topic-id-", JSONL_SUFFIX = ".jsonl", SCHEDULE_SUFFIX = ".schedule";
 var init_session_inbox_path = __esm(() => {
@@ -13275,13 +13312,13 @@ var init_session_inbox_path = __esm(() => {
 
 // ../../packages/core/src/query/session-inbox-cleanup.ts
 import { unlinkSync as unlinkSync14 } from "fs";
-import { basename as basename3, join as join23 } from "path";
+import { basename as basename3, join as join24 } from "path";
 function cleanupSessionInboxFiles(userId, topicId, legacyTopicTitle) {
   const live = sessionInboxPath(userId, topicId);
   const scheduled = scheduledSessionInboxPath(userId, topicId);
   const candidates = new Set([live, `${live}.processing`, scheduled, `${scheduled}.processing`]);
   if (legacyTopicTitle && legacyTopicTitle !== "." && legacyTopicTitle !== ".." && basename3(legacyTopicTitle) === legacyTopicTitle) {
-    const legacyBase = join23(SESSION_INBOX_DIR, userId, legacyTopicTitle);
+    const legacyBase = join24(SESSION_INBOX_DIR, userId, legacyTopicTitle);
     for (const suffix of [".jsonl", ".jsonl.processing", ".schedule", ".schedule.processing"]) {
       candidates.add(`${legacyBase}${suffix}`);
     }
@@ -13307,16 +13344,16 @@ var init_session_inbox_cleanup = __esm(() => {
 
 // ../../packages/core/src/query/state.ts
 import { mkdirSync as mkdirSync14, renameSync as renameSync7, unlinkSync as unlinkSync15, writeFileSync as writeFileSync12 } from "fs";
-import { basename as basename4, join as join24 } from "path";
+import { basename as basename4, join as join25 } from "path";
 function createQueryStateStore(options) {
   const sanitize = options.sanitizeTopicId ?? sanitizeId;
-  const queryStateDirPath = (userId) => join24(options.usersLogDir, String(userId), "active-queries");
-  const queryStateFile = (userId, topicId) => join24(queryStateDirPath(userId), `${sanitize(topicId)}.json`);
+  const queryStateDirPath = (userId) => join25(options.usersLogDir, String(userId), "active-queries");
+  const queryStateFile = (userId, topicId) => join25(queryStateDirPath(userId), `${sanitize(topicId)}.json`);
   const legacyQueryStateFile = (userId, topicName) => {
     if (!topicName || topicName === "." || topicName === ".." || basename4(topicName) !== topicName) {
       return null;
     }
-    return join24(queryStateDirPath(userId), `${topicName}.json`);
+    return join25(queryStateDirPath(userId), `${topicName}.json`);
   };
   return {
     write(userId, topicId, topicName, task) {
@@ -13477,29 +13514,29 @@ import {
   unlinkSync as unlinkSync16,
   writeFileSync as writeFileSync13
 } from "fs";
-import { dirname as dirname14, join as join25 } from "path";
+import { dirname as dirname14, join as join26 } from "path";
 function pendingAskDir(userId) {
   const rawUserId = String(userId);
   const safeUserId = /^[A-Za-z0-9][A-Za-z0-9_.@-]{0,255}$/.test(rawUserId) && !rawUserId.includes("..") ? rawUserId : `sha256-${createHash6("sha256").update(rawUserId).digest("hex")}`;
-  return join25(resolveStorageSessionAsksDir(), safeUserId);
+  return join26(resolveStorageSessionAsksDir(), safeUserId);
 }
 function encodeAskKey(key) {
   return JSON.stringify([key.from, key.to]);
 }
 function pendingAskPath(key) {
   const digest = createHash6("sha256").update(encodeAskKey(key)).digest("hex");
-  return join25(pendingAskDir(key.userId), `${ASK_FILENAME_PREFIX}${digest}.pending`);
+  return join26(pendingAskDir(key.userId), `${ASK_FILENAME_PREFIX}${digest}.pending`);
 }
 function v2PendingAskPath(key) {
   const encoded = Buffer.from(encodeAskKey(key), "utf8").toString("base64url");
-  return join25(pendingAskDir(key.userId), `${V2_ASK_FILENAME_PREFIX}${encoded}.pending`);
+  return join26(pendingAskDir(key.userId), `${V2_ASK_FILENAME_PREFIX}${encoded}.pending`);
 }
 function legacyPendingAskPath(key) {
   if (key.from.includes("/") || key.from.includes("\\") || key.to.includes("/") || key.to.includes("\\") || key.from.includes("\x00") || key.to.includes("\x00")) {
     return null;
   }
   const dir = pendingAskDir(key.userId);
-  const candidate = join25(dir, `${key.from}___${key.to}.pending`);
+  const candidate = join26(dir, `${key.from}___${key.to}.pending`);
   return dirname14(candidate) === dir ? candidate : null;
 }
 function parsePendingAskFilename(fileName) {
@@ -13740,7 +13777,7 @@ function listPendingAsksForCaller(args) {
     const parsed = isV3 ? { from: args.from, to: "" } : parsePendingAskFilename(fileName);
     if (!parsed)
       continue;
-    const path = join25(dir, fileName);
+    const path = join26(dir, fileName);
     const record = readPendingAskFile(path, {
       userId: args.userId,
       from: parsed.from,
@@ -13782,7 +13819,7 @@ function deletePendingAsksForTopic(args) {
   }
   let deleted = 0;
   for (const fileName of files) {
-    const path = join25(dir, fileName);
+    const path = join26(dir, fileName);
     const parsed = parsePendingAskFilename(fileName);
     const record = readPendingAskFile(path, {
       userId: args.userId,
@@ -14182,7 +14219,7 @@ body{font-family:system-ui,-apple-system,"Segoe UI",sans-serif;background:var(--
 // ../../packages/core/src/storage/token-stats.ts
 import { createHash as createHash7 } from "crypto";
 import { mkdirSync as mkdirSync16, writeFileSync as writeFileSync14 } from "fs";
-import { join as join26 } from "path";
+import { join as join27 } from "path";
 function tokenStatsFileId(userId) {
   const rawUserId = String(userId);
   return /^[A-Za-z0-9][A-Za-z0-9_.@-]{0,255}$/.test(rawUserId) && !rawUserId.includes("..") ? rawUserId : `sha256-${createHash7("sha256").update(rawUserId).digest("hex")}`;
@@ -14191,7 +14228,7 @@ function queriesPath(userId) {
   const fileId = tokenStatsFileId(userId);
   const logDir = resolveStorageLogDir();
   mkdirSync16(logDir, { recursive: true });
-  return join26(logDir, `token-queries-${fileId}.jsonl`);
+  return join27(logDir, `token-queries-${fileId}.jsonl`);
 }
 function estimateUsageCost(agent, model, usage) {
   const prices = TOKEN_PRICES[`${agent}:${model}`];
@@ -14507,7 +14544,7 @@ var init_lifecycle = __esm(async () => {
 // ../../packages/core/src/runtime/attachments.ts
 import { randomUUID as randomUUID14 } from "crypto";
 import { copyFileSync as copyFileSync2, mkdirSync as mkdirSync17, writeFileSync as writeFileSync15 } from "fs";
-import { basename as basename5, join as join27 } from "path";
+import { basename as basename5, join as join28 } from "path";
 function workspaceCwdFor(topicId) {
   return resolveTopicWorkspaceDir(topicId);
 }
@@ -14520,7 +14557,7 @@ function materializePromptAttachments(topicId, queryId, attachmentIds) {
   if (!attachmentIds?.length)
     return [];
   const out = [];
-  const destDir = join27(workspaceCwdFor(topicId), "attachments", queryId);
+  const destDir = join28(workspaceCwdFor(topicId), "attachments", queryId);
   for (const rawId of attachmentIds) {
     if (typeof rawId !== "string")
       continue;
@@ -14537,7 +14574,7 @@ function materializePromptAttachments(topicId, queryId, attachmentIds) {
       mkdirSync17(destDir, { recursive: true });
       const index = String(out.length + 1).padStart(2, "0");
       const safeName = safeAttachmentFilename(attachment.filename, fileId);
-      const destPath = join27(destDir, `${index}-${fileId.slice(0, 8)}-${safeName}`);
+      const destPath = join28(destDir, `${index}-${fileId.slice(0, 8)}-${safeName}`);
       copyFileSync2(sourcePath, destPath);
       out.push({
         id: attachment.id,
@@ -14567,10 +14604,10 @@ function promptWithAttachments(prompt, attachments) {
   return composeAttachmentPrompt(prompt, attachments.map(({ filename, path }) => attachmentPromptLine(filename, path)));
 }
 function ingestAttachment(args) {
-  const destDir = join27(UPLOADS_DIR, args.topicId);
+  const destDir = join28(UPLOADS_DIR, args.topicId);
   mkdirSync17(destDir, { recursive: true });
   const safeName = safeAttachmentFilename(args.filename, "upload");
-  const destPath = join27(destDir, `${Date.now()}-${randomUUID14().slice(0, 8)}-${safeName}`);
+  const destPath = join28(destDir, `${Date.now()}-${randomUUID14().slice(0, 8)}-${safeName}`);
   if (args.sourcePath !== undefined) {
     copyFileSync2(args.sourcePath, destPath);
   } else if (args.bytes !== undefined) {
@@ -15859,9 +15896,9 @@ var init_turn_session = __esm(async () => {
 
 // ../../packages/core/src/storage/app-settings.ts
 import { existsSync as existsSync19, mkdirSync as mkdirSync18, readFileSync as readFileSync17, writeFileSync as writeFileSync16 } from "fs";
-import { dirname as dirname15, join as join28 } from "path";
+import { dirname as dirname15, join as join29 } from "path";
 function settingsFile() {
-  return join28(resolveStorageDataDir(), "otium-settings.json");
+  return join29(resolveStorageDataDir(), "otium-settings.json");
 }
 function getGlobalAiName() {
   const path = settingsFile();
@@ -15956,7 +15993,7 @@ __export(exports_turn_runner, {
 });
 import { randomUUID as randomUUID16 } from "crypto";
 import { existsSync as existsSync20, mkdirSync as mkdirSync19, readdirSync as readdirSync5, statSync as statSync10 } from "fs";
-import { join as join29 } from "path";
+import { join as join30 } from "path";
 function withDefaultPlaywright(configuredMcp, isManager) {
   if (isManager)
     return configuredMcp;
@@ -16011,7 +16048,7 @@ function appendAskReplyMessage(topicId, text2, agentType) {
   return message;
 }
 function resolveWikiMirrorPath(directory, preferredFilename, matchesLegacyId, matchesTitle, preferExact = true) {
-  const preferred = join29(directory, preferredFilename);
+  const preferred = join30(directory, preferredFilename);
   if (preferExact && existsSync20(preferred))
     return preferred;
   let newestLegacyId = null;
@@ -16022,7 +16059,7 @@ function resolveWikiMirrorPath(directory, preferredFilename, matchesLegacyId, ma
       const legacyIdMatch = !titleMatch && matchesLegacyId(filename);
       if (!titleMatch && !legacyIdMatch)
         continue;
-      const path = join29(directory, filename);
+      const path = join30(directory, filename);
       const mtimeMs = statSync10(path).mtimeMs;
       if (titleMatch) {
         if (!newestTitle || mtimeMs > newestTitle.mtimeMs) {
@@ -16036,9 +16073,9 @@ function resolveWikiMirrorPath(directory, preferredFilename, matchesLegacyId, ma
   return newestTitle?.path ?? newestLegacyId?.path ?? preferred;
 }
 function resolveWikiMemoryMirror(wikiDir, topicId, topicTitle) {
-  const briefFile = resolveWikiMirrorPath(join29(wikiDir, "topic"), `${wikiBriefStorageKey(topicTitle, topicId)}.md`, (filename) => isTopicBriefFile(filename, topicId), (filename) => isTopicBriefFile(filename, topicId, topicTitle));
+  const briefFile = resolveWikiMirrorPath(join30(wikiDir, "topic"), `${wikiBriefStorageKey(topicTitle, topicId)}.md`, (filename) => isTopicBriefFile(filename, topicId), (filename) => isTopicBriefFile(filename, topicId, topicTitle));
   const hasBriefFile = existsSync20(briefFile) && statSync10(briefFile).isFile();
-  const latestSummaryCandidate = resolveWikiMirrorPath(join29(wikiDir, "summaries"), `__missing__-${wikiSummaryFilename("0000-00-00", topicTitle, topicId)}`, (filename) => isTopicSummaryFile(filename, topicId), (filename) => isTopicSummaryFile(filename, topicId, topicTitle), false);
+  const latestSummaryCandidate = resolveWikiMirrorPath(join30(wikiDir, "summaries"), `__missing__-${wikiSummaryFilename("0000-00-00", topicTitle, topicId)}`, (filename) => isTopicSummaryFile(filename, topicId), (filename) => isTopicSummaryFile(filename, topicId, topicTitle), false);
   const latestSummaryFile = existsSync20(latestSummaryCandidate) && statSync10(latestSummaryCandidate).isFile() ? latestSummaryCandidate : null;
   return { briefFile, hasBriefFile, latestSummaryFile };
 }
@@ -19130,4 +19167,4 @@ export {
   DEFAULT_SELF_CONFIG_PRODUCT
 };
 
-//# debugId=0F776DB92A8B6B8F64756E2164756E21
+//# debugId=D944C86CF6E691B664756E2164756E21