negotium 0.4.4 → 0.4.6

package/dist/main.js

@@ -1869,7 +1869,7 @@ var exports_version = {};
 __export(exports_version, {
   NEGOTIUM_VERSION: () => NEGOTIUM_VERSION
 });
-var NEGOTIUM_VERSION = "0.4.4";
+var NEGOTIUM_VERSION = "0.4.6";
 
 // ../../packages/core/src/agents/codex-native-multi-agent.ts
 import { spawn } from "child_process";
@@ -2770,14 +2770,20 @@ function playwrightTransport(port, owner, capability, agent) {
 function longLivedHttpMcp(agent, port) {
   return agent === "codex" ? { url: `http://127.0.0.1:${port}/mcp` } : { type: "sse", url: `http://127.0.0.1:${port}/sse` };
 }
-function setCuaRsMcpPort(port) {
+function setCuaRsMcpPort(port, token) {
   if (port !== undefined && (!Number.isInteger(port) || port < 1 || port > 65535)) {
     throw new Error(`invalid cua-rs MCP port: ${port}`);
   }
   cuaRsMcpPort = port;
+  cuaRsMcpToken = port === undefined ? undefined : token;
 }
-function cuaRsHttpMcp(port) {
-  return { type: "http", url: `http://127.0.0.1:${port}/mcp` };
+function cuaRsHttpMcp(agent, port, token) {
+  const url = `http://127.0.0.1:${port}/mcp`;
+  const headers = token ? { Authorization: `Bearer ${token}` } : undefined;
+  const base = { type: "http", url };
+  if (!headers)
+    return base;
+  return agent === "codex" ? { ...base, http_headers: headers } : { ...base, headers };
 }
 function backgroundBashTransport(agent, port, userId, topic) {
   const capability = bgBashContextCapability(userId, topic);
@@ -3054,7 +3060,7 @@ function getMcpServersForQuery(opts) {
     peerBridge: opts.peerBridge
   });
 }
-var _playwrightUnavailableNotifier, _playwrightUnavailableLastNotifiedAt, _PLAYWRIGHT_UNAVAILABLE_COOLDOWN_MS, _playwrightUnavailableThisTurn, CODEX_BROWSER_CAPABILITY_ENV = "NEGOTIUM_BROWSER_CAPABILITY", cuaRsMcpPort, MCP_CATALOG, allForumMcpServerNames, requiredForumMcpServers, REQUIRED_FORUM_MCP_SERVERS, optionalForumMcpServers, OPTIONAL_FORUM_MCP_SERVERS, nodeMcpEntries;
+var _playwrightUnavailableNotifier, _playwrightUnavailableLastNotifiedAt, _PLAYWRIGHT_UNAVAILABLE_COOLDOWN_MS, _playwrightUnavailableThisTurn, CODEX_BROWSER_CAPABILITY_ENV = "NEGOTIUM_BROWSER_CAPABILITY", cuaRsMcpPort, cuaRsMcpToken, MCP_CATALOG, allForumMcpServerNames, requiredForumMcpServers, REQUIRED_FORUM_MCP_SERVERS, optionalForumMcpServers, OPTIONAL_FORUM_MCP_SERVERS, nodeMcpEntries;
 var init_mcp_config = __esm(() => {
   init_canonical_bridge_config();
   init_runtime_spec();
@@ -3272,8 +3278,8 @@ var init_mcp_config = __esm(() => {
     },
     "cua-rs": {
       ...commonRuntimeMcpPolicy("cua-rs"),
-      build() {
-        return cuaRsMcpPort ? cuaRsHttpMcp(cuaRsMcpPort) : null;
+      build({ agent }) {
+        return cuaRsMcpPort ? cuaRsHttpMcp(agent, cuaRsMcpPort, cuaRsMcpToken) : null;
       }
     }
   };
@@ -32618,7 +32624,8 @@ __export(exports_src3, {
   NODE_CONTROL_PROTOCOL_VERSION: () => NODE_CONTROL_PROTOCOL_VERSION,
   NODE_CONTROL_BASE_PATH: () => NODE_CONTROL_BASE_PATH
 });
-import { rmSync as rmSync10 } from "fs";
+import { randomBytes as randomBytes8 } from "crypto";
+import { readFileSync as readFileSync29, rmSync as rmSync10, writeFileSync as writeFileSync25 } from "fs";
 import { createServer as createServer5 } from "net";
 import { join as join43 } from "path";
 async function availableLoopbackPort() {
@@ -32676,6 +32683,34 @@ async function wireNodeMcps(host2, manifest) {
     logger.info({ keys: entries.map((e) => e.key) }, "node mcp: manifest servers installed");
   }
 }
+function cuaRsToken() {
+  const file = join43(RUN_DIR, CUA_RS_MCP_TOKEN_FILE);
+  try {
+    const existing = readFileSync29(file, "utf8").trim();
+    if (/^[0-9a-f]{64}$/.test(existing))
+      return existing;
+  } catch {}
+  const token = randomBytes8(32).toString("hex");
+  writeFileSync25(file, token, { mode: 384 });
+  return token;
+}
+async function cuaRsAuthOk(port, token) {
+  try {
+    const res = await fetch(`http://127.0.0.1:${port}/mcp`, {
+      method: "POST",
+      headers: {
+        Authorization: `Bearer ${token}`,
+        "Content-Type": "application/json",
+        Accept: "application/json, text/event-stream"
+      },
+      body: "{}",
+      signal: AbortSignal.timeout(2000)
+    });
+    return res.status !== 401;
+  } catch {
+    return true;
+  }
+}
 async function wireCuaRsMcp() {
   setCuaRsMcpPort(undefined);
   const binary = resolveCuaRsBinary();
@@ -32684,11 +32719,13 @@ async function wireCuaRsMcp() {
   const manifestFile = join43(RUN_DIR, CUA_RS_MCP_MANIFEST_FILE);
   rmSync10(manifestFile, { force: true });
   const manifest = new McpManifest({ file: manifestFile });
+  const token = cuaRsToken();
   const spec = {
     key: CUA_RS_MCP_KEY,
     transport: "http",
     command: binary,
     args: ["{port}"],
+    env: { CUA_HTTP_TOKEN: token },
     portRange: CUA_RS_MCP_PORT_RANGE,
     scope: "node",
     healthIntervalMs: 15000
@@ -32697,10 +32734,20 @@ async function wireCuaRsMcp() {
   const host2 = new McpHost({ manifest });
   const stopSweeper = host2.startSweeper();
   try {
-    const instance = await host2.ensure(CUA_RS_MCP_KEY);
+    let instance = await host2.ensure(CUA_RS_MCP_KEY);
     if (!instance.port)
       throw new Error("cua-rs started without an HTTP port");
-    setCuaRsMcpPort(instance.port);
+    if (!await cuaRsAuthOk(instance.port, token)) {
+      logger.warn({ port: instance.port }, "cua-rs rejected the node's token; restarting it");
+      await host2.stop(CUA_RS_MCP_KEY);
+      instance = await host2.ensure(CUA_RS_MCP_KEY);
+      if (!instance.port)
+        throw new Error("cua-rs restarted without an HTTP port");
+      if (!await cuaRsAuthOk(instance.port, token)) {
+        throw new Error("cua-rs will not accept the node's bearer token");
+      }
+    }
+    setCuaRsMcpPort(instance.port, token);
     logger.info({ pid: instance.pid, port: instance.port }, "cua-rs MCP server ready");
     return { host: host2, stopSweeper };
   } catch (error2) {
@@ -32909,7 +32956,7 @@ async function runNodeDaemon(opts = {}) {
   await new Promise((resolve24) => setImmediate(resolve24));
   process.exit(0);
 }
-var CUA_RS_MCP_KEY = "cua-rs", CUA_RS_MCP_MANIFEST_FILE = "cua-rs-mcp-manifest.json", CUA_RS_MCP_PORT_RANGE;
+var CUA_RS_MCP_KEY = "cua-rs", CUA_RS_MCP_MANIFEST_FILE = "cua-rs-mcp-manifest.json", CUA_RS_MCP_TOKEN_FILE = "cua-rs-mcp.token", CUA_RS_MCP_PORT_RANGE;
 var init_src5 = __esm(async () => {
   await init_conversation_migration();
   await init_node_host();
@@ -43108,12 +43155,12 @@ import {
   lstatSync,
   mkdirSync as mkdirSync33,
   openSync as openSync5,
-  readFileSync as readFileSync29,
+  readFileSync as readFileSync30,
   renameSync as renameSync17,
   rmSync as rmSync11,
   statSync as statSync20,
   unlinkSync as unlinkSync23,
-  writeFileSync as writeFileSync25
+  writeFileSync as writeFileSync26
 } from "fs";
 import { dirname as dirname23, resolve as resolve25 } from "path";
 function joinFilePath() {
@@ -43194,7 +43241,7 @@ function withJoinCredentialLock(operation) {
     try {
       mkdirSync33(lockPath, { mode: 448 });
       created = true;
-      writeFileSync25(ownerPath, `${JSON.stringify(owner)}
+      writeFileSync26(ownerPath, `${JSON.stringify(owner)}
 `, { mode: 384 });
       const ownerFd = openSync5(ownerPath, "r");
       try {
@@ -43212,7 +43259,7 @@ function withJoinCredentialLock(operation) {
         throw error2;
       let current3 = null;
       try {
-        current3 = JSON.parse(readFileSync29(ownerPath, "utf8"));
+        current3 = JSON.parse(readFileSync30(ownerPath, "utf8"));
       } catch {}
       let ageMs;
       try {
@@ -43242,7 +43289,7 @@ function withJoinCredentialLock(operation) {
     return operation();
   } finally {
     try {
-      const current3 = JSON.parse(readFileSync29(ownerPath, "utf8"));
+      const current3 = JSON.parse(readFileSync30(ownerPath, "utf8"));
       if (current3.pid === owner.pid && current3.token === owner.token) {
         rmSync11(lockPath, { recursive: true, force: true });
       }
@@ -43267,7 +43314,7 @@ function joinCredentialDigest(join46) {
 function readPersistedJoins(path = joinFilePath()) {
   if (!existsSync39(path))
     return [];
-  const parsed = JSON.parse(readFileSync29(path, "utf-8"));
+  const parsed = JSON.parse(readFileSync30(path, "utf-8"));
   if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) {
     throw new Error("persisted join credentials are not a JSON object");
   }
@@ -43305,7 +43352,7 @@ function writeJoins(joins, allowOverwrite) {
   let fd;
   try {
     fd = openSync5(temporaryPath, "wx", 384);
-    writeFileSync25(fd, `${JSON.stringify(payload, null, 2)}
+    writeFileSync26(fd, `${JSON.stringify(payload, null, 2)}
 `, "utf8");
     fsyncSync2(fd);
     closeSync5(fd);
@@ -43931,7 +43978,7 @@ var init_store2 = __esm(async () => {
 
 // ../../adapters/otium/src/workspace-scope.ts
 import { createHash as createHash13 } from "crypto";
-import { mkdirSync as mkdirSync35, readFileSync as readFileSync30, writeFileSync as writeFileSync26 } from "fs";
+import { mkdirSync as mkdirSync35, readFileSync as readFileSync31, writeFileSync as writeFileSync27 } from "fs";
 import { dirname as dirname24, resolve as resolve26 } from "path";
 function surfaceScopeFor(central, workspaceId) {
   const digest = createHash13("sha256").update(`${central.trim().replace(/\/+$/, "")}
@@ -43943,7 +43990,7 @@ function scopeCachePath() {
 }
 function readCache() {
   try {
-    const parsed = JSON.parse(readFileSync30(scopeCachePath(), "utf-8"));
+    const parsed = JSON.parse(readFileSync31(scopeCachePath(), "utf-8"));
     if (!parsed || typeof parsed !== "object" || Array.isArray(parsed))
       return {};
     return parsed;
@@ -43964,7 +44011,7 @@ function cacheSurfaceScope(join47, workspaceId) {
     mkdirSync35(dirname24(path), { recursive: true });
     const cache = readCache();
     cache[join47.cellId] = { central: join47.central, workspaceId, scope };
-    writeFileSync26(path, `${JSON.stringify(cache, null, 2)}
+    writeFileSync27(path, `${JSON.stringify(cache, null, 2)}
 `, { mode: 384 });
   } catch (err2) {
     logger.warn({ err: err2, path }, "otium: could not cache the workspace scope");
@@ -45005,10 +45052,10 @@ import {
   linkSync as linkSync2,
   mkdirSync as mkdirSync36,
   openSync as openSync6,
-  readFileSync as readFileSync31,
+  readFileSync as readFileSync32,
   renameSync as renameSync18,
   unlinkSync as unlinkSync24,
-  writeFileSync as writeFileSync27
+  writeFileSync as writeFileSync28
 } from "fs";
 import { dirname as dirname25, resolve as resolve27 } from "path";
 function parseEnrollmentInvite(code) {
@@ -45038,7 +45085,7 @@ function isEnrollmentPending(invite) {
   if (!existsSync40(path))
     return false;
   try {
-    const saved = JSON.parse(readFileSync31(path, "utf8"));
+    const saved = JSON.parse(readFileSync32(path, "utf8"));
     return saved.central === invite.central && saved.token === invite.token;
   } catch {
     return false;
@@ -45047,7 +45094,7 @@ function isEnrollmentPending(invite) {
 function loadOrCreatePending(invite, nodeName) {
   const path = pendingEnrollmentPath();
   if (existsSync40(path)) {
-    const saved = JSON.parse(readFileSync31(path, "utf8"));
+    const saved = JSON.parse(readFileSync32(path, "utf8"));
     if (saved.central === invite.central && saved.token === invite.token)
       return saved;
     throw new Error(`another Otium enrollment is pending at ${path}`);
@@ -45065,7 +45112,7 @@ function loadOrCreatePending(invite, nodeName) {
   let fd;
   try {
     fd = openSync6(temporaryPath, "wx", 384);
-    writeFileSync27(fd, `${JSON.stringify(pending2, null, 2)}
+    writeFileSync28(fd, `${JSON.stringify(pending2, null, 2)}
 `, "utf8");
     fsyncSync3(fd);
     closeSync6(fd);
@@ -45085,7 +45132,7 @@ function loadOrCreatePending(invite, nodeName) {
     if (existsSync40(temporaryPath))
       unlinkSync24(temporaryPath);
     if (error2.code === "EEXIST" && existsSync40(path)) {
-      const saved = JSON.parse(readFileSync31(path, "utf8"));
+      const saved = JSON.parse(readFileSync32(path, "utf8"));
       if (saved.central === invite.central && saved.token === invite.token)
         return saved;
     }
@@ -45100,7 +45147,7 @@ function replacePendingEnrollment(pending2) {
   let fd;
   try {
     fd = openSync6(temporaryPath, "wx", 384);
-    writeFileSync27(fd, `${JSON.stringify(pending2, null, 2)}
+    writeFileSync28(fd, `${JSON.stringify(pending2, null, 2)}
 `, "utf8");
     fsyncSync3(fd);
     closeSync6(fd);
@@ -45122,7 +45169,7 @@ function replacePendingEnrollment(pending2) {
 }
 function recordClaimedCredential(pending2, join47) {
   withJoinCredentialLock(() => {
-    const current3 = JSON.parse(readFileSync31(pendingEnrollmentPath(), "utf8"));
+    const current3 = JSON.parse(readFileSync32(pendingEnrollmentPath(), "utf8"));
     if (current3.central !== pending2.central || current3.token !== pending2.token || current3.idempotencyKey !== pending2.idempotencyKey || current3.publicKey !== pending2.publicKey) {
       throw new Error("pending Otium enrollment changed while its claim was in flight");
     }
@@ -45201,7 +45248,7 @@ async function claimEnrollment(invite, nodeName) {
 function commitEnrollment(join47, options = {}) {
   return withJoinCredentialLock(() => {
     const pendingPath = pendingEnrollmentPath();
-    const pending2 = existsSync40(pendingPath) ? JSON.parse(readFileSync31(pendingPath, "utf8")) : null;
+    const pending2 = existsSync40(pendingPath) ? JSON.parse(readFileSync32(pendingPath, "utf8")) : null;
     const digest = joinCredentialDigest(join47);
     if (pending2 && (!pending2.claimed || pending2.claimed.digest !== digest || pending2.claimed.cellId !== join47.cellId)) {
       throw new Error(`pending Otium enrollment at ${pendingPath} does not match these credentials`);
@@ -47292,4 +47339,4 @@ switch (command) {
   }
 }
 
-//# debugId=FB1DC2846CA4438764756E2164756E21
+//# debugId=C1F343985A31393664756E2164756E21