negotium 0.4.1 → 0.4.2

package/dist/hosted-agent.js

@@ -518,6 +518,11 @@ function referencesRuntimeSecretStorage(value) {
   return false;
 }
 
+// ../../packages/core/src/platform/mcp-config.ts
+import { accessSync as accessSync2, constants as fsConstants } from "fs";
+import { homedir as homedir2 } from "os";
+import { join as join2 } from "path";
+
 // ../../packages/core/src/mcp/runtime-spec.ts
 import { createHash, createHmac, timingSafeEqual } from "crypto";
 var RUNTIME_MCP_KEY = "runtime";
@@ -856,7 +861,8 @@ var COMMON_RUNTIME_MCP_POLICY = {
   "system-health": { scopes: ["dm", "forum", "manager", "cron"], forumRequired: true },
   "background-bash": { scopes: ["forum"], forumRequired: true },
   "agent-health": { scopes: ["forum", "manager", "cron"], forumRequired: true },
-  vault: { scopes: ["dm", "forum", "manager", "cron"], forumRequired: true }
+  vault: { scopes: ["dm", "forum", "manager", "cron"], forumRequired: true },
+  "cua-rs": { scopes: ["dm", "forum", "fork"], forumRequired: false }
 };
 function classifyForumMcpServers(catalog) {
   const all = Object.entries(catalog).filter(([, entry]) => entry.scopes.includes("forum")).map(([name]) => name);
@@ -1184,8 +1190,38 @@ var MCP_CATALOG = {
         args.push("--list-only=true");
       return buildBuiltinMcpServer("vault", { ...ctx, userId: vaultUserId ?? userId }, () => buildStdioMcpServer(agent, VAULT_SERVER, args));
     }
+  },
+  "cua-rs": {
+    ...commonRuntimeMcpPolicy("cua-rs"),
+    build() {
+      const bin = resolveCuaRsBinary();
+      if (!bin)
+        return null;
+      return { command: bin, args: cuaRsArgs() };
+    }
   }
 };
+function cuaRsArgs() {
+  const raw = envText("NEGOTIUM_CUA_RS_ALLOW_HID")?.trim().toLowerCase();
+  const on = raw === "1" || raw === "true" || raw === "yes";
+  return on ? ["--allow-hid"] : [];
+}
+function resolveCuaRsBinary(platform = process.platform) {
+  if (platform !== "darwin")
+    return null;
+  const candidates = [
+    envText("NEGOTIUM_CUA_RS_BIN"),
+    join2(homedir2(), ".local", "bin", "cua-rs"),
+    "/usr/local/bin/cua-rs"
+  ].filter((p) => Boolean(p));
+  for (const candidate of candidates) {
+    try {
+      accessSync2(candidate, fsConstants.X_OK);
+      return candidate;
+    } catch {}
+  }
+  return null;
+}
 var allForumMcpServerNames = [];
 var requiredForumMcpServers = [];
 var REQUIRED_FORUM_MCP_SERVERS = requiredForumMcpServers;
@@ -1413,7 +1449,7 @@ function getMcpServersForQuery(opts) {
 
 // ../../packages/core/src/storage/vault.ts
 import { chmodSync as chmodSync2, mkdirSync as mkdirSync4 } from "fs";
-import { join as join3 } from "path";
+import { join as join4 } from "path";
 
 // ../../packages/core/src/storage/sqlite.ts
 var isBun = typeof process.versions.bun === "string";
@@ -1468,8 +1504,8 @@ if (isBun) {
 
 // ../../packages/core/src/storage/storage-host.ts
 import { mkdirSync as mkdirSync3 } from "fs";
-import { homedir as homedir2 } from "os";
-import { dirname as dirname3, join as join2, resolve as resolve4 } from "path";
+import { homedir as homedir3 } from "os";
+import { dirname as dirname3, join as join3, resolve as resolve4 } from "path";
 var STORAGE_HOST_STATE = Symbol.for("negotium.storage-host.state.v1");
 function storageState() {
   const holder = globalThis;
@@ -1498,13 +1534,13 @@ function envPath(name, fallback) {
   return resolve4(value || fallback);
 }
 function defaultStateDir() {
-  return envPath("NEGOTIUM_STATE_DIR", join2(homedir2(), ".negotium"));
+  return envPath("NEGOTIUM_STATE_DIR", join3(homedir3(), ".negotium"));
 }
 function defaultDataDir() {
-  return envPath("NEGOTIUM_DATA_DIR", join2(defaultStateDir(), "data"));
+  return envPath("NEGOTIUM_DATA_DIR", join3(defaultStateDir(), "data"));
 }
 function defaultSessionsDatabasePath() {
-  return envPath("SESSIONS_DB_PATH", join2(resolveStorageDataDir(), "sessions.db"));
+  return envPath("SESSIONS_DB_PATH", join3(resolveStorageDataDir(), "sessions.db"));
 }
 var SQLITE_INIT_RETRY_MS = 25;
 var SQLITE_INIT_TIMEOUT_MS = 5000;
@@ -1683,8 +1719,8 @@ function initializeVaultDatabase(database) {
   }
 }
 function openVaultDatabase(dataDir) {
-  const vaultDir = join3(dataDir, "vault");
-  const path = join3(vaultDir, "vault.db");
+  const vaultDir = join4(dataDir, "vault");
+  const path = join4(vaultDir, "vault.db");
   mkdirSync4(vaultDir, { recursive: true, mode: 448 });
   const database = new Database(path, { create: true });
   chmodSync2(path, 384);
@@ -2359,8 +2395,8 @@ async function* claudeProvider(opts) {
 // ../../packages/core/src/agents/codex-provider.ts
 import { execFileSync as execFileSync4 } from "child_process";
 import { existsSync as existsSync6, readFileSync as readFileSync6, realpathSync as realpathSync3, statSync as statSync3 } from "fs";
-import { homedir as homedir3 } from "os";
-import { dirname as dirname8, isAbsolute, join as join7, relative, resolve as resolve7 } from "path";
+import { homedir as homedir4 } from "os";
+import { dirname as dirname8, isAbsolute, join as join8, relative, resolve as resolve7 } from "path";
 import { Codex } from "@openai/codex-sdk";
 
 // ../../packages/core/src/agents/codex-native-multi-agent.ts
@@ -2379,10 +2415,10 @@ import {
 } from "fs";
 import { createRequire as createRequire2 } from "module";
 import { tmpdir } from "os";
-import { dirname as dirname5, join as join4 } from "path";
+import { dirname as dirname5, join as join5 } from "path";
 
 // ../../packages/core/src/version.ts
-var NEGOTIUM_VERSION = "0.4.1";
+var NEGOTIUM_VERSION = "0.4.2";
 
 // ../../packages/core/src/agents/codex-native-multi-agent.ts
 var moduleRequire = createRequire2(import.meta.url);
@@ -2401,7 +2437,7 @@ var SAFE_BUNDLED_CODEX_VERSION = BUNDLED_CODEX_VERSION.replace(/[^a-zA-Z0-9._-]/
 var NEGOTIUM_MODEL_CACHE = `negotium-models-cache-${SAFE_BUNDLED_CODEX_VERSION}.json`;
 var NEGOTIUM_MODEL_CATALOG = `negotium-model-catalog-${SAFE_BUNDLED_CODEX_VERSION}.json`;
 function codexCliScriptPath() {
-  return join4(dirname5(bundledCodexPackagePath), "bin", "codex.js");
+  return join5(dirname5(bundledCodexPackagePath), "bin", "codex.js");
 }
 function parseCodexModelCache(contents, sourcePath) {
   let parsed;
@@ -2442,7 +2478,7 @@ function writePrivateFileAtomic(path, contents) {
   }
 }
 function bundledCodexModelCachePath(authFilePath) {
-  return join4(dirname5(authFilePath), NEGOTIUM_MODEL_CACHE);
+  return join5(dirname5(authFilePath), NEGOTIUM_MODEL_CACHE);
 }
 async function bootstrapCodexModelCache(codexHome, cachePath) {
   const child = spawn3(process.execPath, [codexCliScriptPath(), "app-server", "--stdio"], {
@@ -2528,15 +2564,15 @@ async function bootstrapCodexModelCache(codexHome, cachePath) {
 }
 async function bootstrapIsolatedCodexModelCache(authFilePath, bootstrap) {
   const sourceHome = dirname5(authFilePath);
-  const isolatedHome = mkdtempSync(join4(tmpdir(), "negotium-codex-models-"));
-  const isolatedCachePath = join4(isolatedHome, "models_cache.json");
+  const isolatedHome = mkdtempSync(join5(tmpdir(), "negotium-codex-models-"));
+  const isolatedCachePath = join5(isolatedHome, "models_cache.json");
   try {
-    const isolatedAuthPath = join4(isolatedHome, "auth.json");
+    const isolatedAuthPath = join5(isolatedHome, "auth.json");
     copyFileSync(authFilePath, isolatedAuthPath);
     chmodSync3(isolatedAuthPath, 384);
-    const sourceConfigPath = join4(sourceHome, "config.toml");
+    const sourceConfigPath = join5(sourceHome, "config.toml");
     if (existsSync3(sourceConfigPath)) {
-      const isolatedConfigPath = join4(isolatedHome, "config.toml");
+      const isolatedConfigPath = join5(isolatedHome, "config.toml");
       copyFileSync(sourceConfigPath, isolatedConfigPath);
       chmodSync3(isolatedConfigPath, 384);
     }
@@ -2557,7 +2593,7 @@ async function ensureCodexModelCache(authFilePath, bootstrap = bootstrapCodexMod
     return configuredCachePath;
   }
   const bundledCachePath = bundledCodexModelCachePath(authFilePath);
-  const sharedCachePath = join4(codexHome, "models_cache.json");
+  const sharedCachePath = join5(codexHome, "models_cache.json");
   if (existsSync3(sharedCachePath)) {
     try {
       const shared = readCompatibleCodexModelCache(sharedCachePath);
@@ -2577,7 +2613,7 @@ async function ensureCodexModelCache(authFilePath, bootstrap = bootstrapCodexMod
 }
 function writeCodexCatalogWithNativeMultiAgentDisabled(authFilePath, sourcePath) {
   const codexHome = dirname5(authFilePath);
-  const outputPath = join4(codexHome, NEGOTIUM_MODEL_CATALOG);
+  const outputPath = join5(codexHome, NEGOTIUM_MODEL_CATALOG);
   const parsed = readCodexModelCache(sourcePath).parsed;
   const models = parsed.models.map((model, index) => {
     if (!model || typeof model !== "object" || Array.isArray(model)) {
@@ -2816,7 +2852,7 @@ import { existsSync as existsSync4 } from "fs";
 import { chmod, mkdtemp, rm, writeFile } from "fs/promises";
 import { createServer } from "net";
 import { tmpdir as tmpdir2 } from "os";
-import { dirname as dirname6, join as join5, resolve as resolve5 } from "path";
+import { dirname as dirname6, join as join6, resolve as resolve5 } from "path";
 import { fileURLToPath as fileURLToPath2 } from "url";
 var MAX_HOOK_REQUEST_BYTES = 1024 * 1024;
 var SENSITIVE_STORAGE_DENIAL = "Runtime secret storage access is not permitted";
@@ -2873,10 +2909,10 @@ function privateCodexWrapper(codexScript, socketPath, token) {
 `);
 }
 async function createCodexVaultHookBridge(userId) {
-  const root = await mkdtemp(join5(tmpdir2(), "negotium-codex-vault-"));
+  const root = await mkdtemp(join6(tmpdir2(), "negotium-codex-vault-"));
   await chmod(root, 448);
-  const socketPath = join5(root, "hook.sock");
-  const wrapperPath = join5(root, "codex-with-hooks");
+  const socketPath = join6(root, "hook.sock");
+  const wrapperPath = join6(root, "codex-with-hooks");
   const token = randomBytes4(32).toString("hex");
   const connections = new Set;
   const server = createServer((socket) => {
@@ -2963,9 +2999,9 @@ async function createCodexVaultHookBridge(userId) {
 
 // ../../packages/core/src/agents/rollout/codex.ts
 import { existsSync as existsSync5, readFileSync as readFileSync5, realpathSync as realpathSync2, statSync as statSync2, unlinkSync as unlinkSync4 } from "fs";
-import { basename, dirname as dirname7, join as join6, resolve as resolve6 } from "path";
+import { basename, dirname as dirname7, join as join7, resolve as resolve6 } from "path";
 function codexSessionsDir() {
-  return join6(hostedCodexHomePath(), "sessions");
+  return join7(hostedCodexHomePath(), "sessions");
 }
 function canonicalFilePath(path) {
   const absolute = resolve6(path);
@@ -2973,7 +3009,7 @@ function canonicalFilePath(path) {
     return realpathSync2(absolute);
   } catch {
     try {
-      return join6(realpathSync2(dirname7(absolute)), basename(absolute));
+      return join7(realpathSync2(dirname7(absolute)), basename(absolute));
     } catch {
       return absolute;
     }
@@ -3203,19 +3239,19 @@ function latestCodexRolloutPath(threadId) {
   try {
     if (buckets) {
       for (const bucket of buckets) {
-        const dir = join6(sessionsDir, bucket);
+        const dir = join7(sessionsDir, bucket);
         if (!existsSync5(dir))
           continue;
         const glob = new Bun.Glob(`rollout-*-${threadId}.jsonl`);
         for (const rel of glob.scanSync({ cwd: dir, onlyFiles: true })) {
-          candidates.push(join6(dir, rel));
+          candidates.push(join7(dir, rel));
         }
       }
     }
     if (candidates.length === 0) {
       const glob = new Bun.Glob(`**/rollout-*-${threadId}.jsonl`);
       for (const rel of glob.scanSync({ cwd: sessionsDir, onlyFiles: true })) {
-        candidates.push(join6(sessionsDir, rel));
+        candidates.push(join7(sessionsDir, rel));
       }
     }
     return candidates.sort((a, b) => statSync2(b).mtimeMs - statSync2(a).mtimeMs)[0];
@@ -3368,7 +3404,7 @@ function codexMcpServerName(name) {
   return CODEX_MCP_SERVER_NAME_OVERRIDES[name] ?? name;
 }
 function globalCodexMcpServerNames(authFilePath) {
-  const configPath = join7(dirname8(authFilePath), "config.toml");
+  const configPath = join8(dirname8(authFilePath), "config.toml");
   if (!existsSync6(configPath))
     return [];
   try {
@@ -3730,7 +3766,7 @@ async function* codexProvider(opts) {
     mcpServerCount: Object.keys(codexMcpServers).length
   }, "codexProvider: starting turn");
   const hostedCodexHome = hostedCodexHomePath();
-  const inheritedCodexHome = process.env.CODEX_HOME || join7(homedir3(), ".codex");
+  const inheritedCodexHome = process.env.CODEX_HOME || join8(homedir4(), ".codex");
   const codexEnvironment = scopedBrowserCapability || resolve7(hostedCodexHome) !== resolve7(inheritedCodexHome) ? {
     ...Object.fromEntries(Object.entries(process.env).filter((entry) => typeof entry[1] === "string")),
     CODEX_HOME: hostedCodexHome,
@@ -4157,7 +4193,7 @@ function maestroProvider(opts) {
 // ../../packages/core/src/agents/claude-runtime-inspection.ts
 import { readFileSync as readFileSync7 } from "fs";
 import { createRequire as createRequire3 } from "module";
-import { dirname as dirname9, join as join8 } from "path";
+import { dirname as dirname9, join as join9 } from "path";
 var cached;
 function inspectBundledClaudeRuntime() {
   if (cached)
@@ -4165,8 +4201,8 @@ function inspectBundledClaudeRuntime() {
   try {
     const require2 = createRequire3(import.meta.url);
     const sdkDir = dirname9(require2.resolve("@anthropic-ai/claude-agent-sdk"));
-    const sdkPackage = JSON.parse(readFileSync7(join8(sdkDir, "package.json"), "utf8"));
-    const manifest = JSON.parse(readFileSync7(join8(sdkDir, "manifest.json"), "utf8"));
+    const sdkPackage = JSON.parse(readFileSync7(join9(sdkDir, "package.json"), "utf8"));
+    const manifest = JSON.parse(readFileSync7(join9(sdkDir, "manifest.json"), "utf8"));
     const sdkVersion = typeof sdkPackage.version === "string" ? sdkPackage.version : "";
     const claudeCodeVersion = typeof manifest.version === "string" ? manifest.version : "";
     if (!sdkVersion || !claudeCodeVersion) {
@@ -4239,4 +4275,4 @@ export {
   buildClaudeDisallowedTools
 };
 
-//# debugId=08FB62E75535D71964756E2164756E21
+//# debugId=AA00F8568D35B36164756E2164756E21