negotium 0.4.5 → 0.4.8

package/dist/main.js

@@ -273,7 +273,7 @@ function resolveDefaultModel(agent, registryDefaultModel) {
 function codexAuthFilePath() {
   return process.env.NEGOTIUM_CODEX_AUTH_FILE || join(process.env.CODEX_HOME || join(homedir(), ".codex"), "auth.json");
 }
-var HOME, PROJECT_ROOT, STATE_DIR_ENV, STATE_DIR, WORKSPACE_DIR, TOPIC_WORKSPACE_DIR, SHARED_WIKI_DIR, CRON_WORKSPACE_DIR, BROWSER_DIR, BROWSER_PROFILES_DIR, BINARIES_DIR, SECRETS_DIR, DM_WORKSPACE_DIR, SESSION_WORKSPACE_DIR, CLAUDE_EXECUTABLE_ENV, CLAUDE_EXECUTABLE, DEFAULT_OUTPUT_LANGUAGE = "English", BROWSER_RS_VERSION = "v0.1.22", BROWSER_RS_MIN_SECURE_VERSION = "0.1.15", BROWSER_RS_VERSION_PROBE_TIMEOUT_MS = 15000, SNIPPETS_API_URL, BROWSER_RS_BIN, BASH_RS_VERSION = "v0.1.7", BASH_RS_BIN, PLAYWRIGHT_MCP_BIN, TSX_BIN, TSX_LOADER, TSCONFIG_PATH, SESSION_COMM_SERVER, TASK_SERVER, DECISION_SERVER, BROWSER_MCP_SSE_PROXY_SERVER, CANONICAL_MCP_PROXY_SERVER, WIKI_SERVER, TOKEN_STATS_SERVER, COMPACTION_LOG_SERVER, SYSTEM_HEALTH_SERVER, AGENT_HEALTH_SERVER, VAULT_SERVER, BG_BASH_BASE_PORT, BG_BASH_MAX_PORT, RUNTIME_MCP_SECRET, NODE_CONTROL_TOKEN, NODE_ID, VAULT_MASTER_KEY, NEGOTIUM_PORT, hostname, DATA_DIR, LOG_DIR, UPLOADS_DIR, VAULT_DIR, SESSIONS_DB, DEBUG_FILE, USERS_LOG_DIR, RUN_DIR, PROGRESS_DIR, DM_CMD_DIR, DM_RESP_DIR, SESSION_INBOX_DIR, SESSION_ASKS_DIR, BASHRS_SPILL_ROOT, PLAYWRIGHT_BASE_PORT, PLAYWRIGHT_MAX_PORT, PLAYWRIGHT_PORTS_DIR, ACTIVE_QUERY_STALE_MS, AGENTS_PROMPTS_DIR, RESOURCES_DIR, FILE_TAG_REGEX, MODEL_SONNET = "claude-sonnet-5", MODEL_OPUS = "claude-opus-5", MODEL_FABLE = "claude-fable-5", FALLBACK_AGENT, SESSION_AGENT, GATEWAY_AGENT, FALLBACK_MODEL, SESSION_MODEL, GATEWAY_MODEL, FFMPEG_BIN, FFPROBE_BIN, PYTHON_BIN, FASTER_WHISPER_WRAPPER, WHISPER_MODEL, TESSERACT_BIN, PDFTOTEXT_BIN, _envMaxTellDepth, MAX_TELL_DEPTH;
+var HOME, PROJECT_ROOT, STATE_DIR_ENV, STATE_DIR, WORKSPACE_DIR, TOPIC_WORKSPACE_DIR, SHARED_WIKI_DIR, CRON_WORKSPACE_DIR, BROWSER_DIR, BROWSER_PROFILES_DIR, BINARIES_DIR, SECRETS_DIR, DM_WORKSPACE_DIR, SESSION_WORKSPACE_DIR, CLAUDE_EXECUTABLE_ENV, CLAUDE_EXECUTABLE, DEFAULT_OUTPUT_LANGUAGE = "English", BROWSER_RS_VERSION = "v0.1.22", BROWSER_RS_MIN_SECURE_VERSION = "0.1.15", BROWSER_RS_VERSION_PROBE_TIMEOUT_MS = 15000, SNIPPETS_API_URL, BROWSER_RS_BIN, BASH_RS_VERSION = "v0.1.7", BASH_RS_BIN, PLAYWRIGHT_MCP_BIN, TSX_BIN, TSX_LOADER, TSCONFIG_PATH, SESSION_COMM_SERVER, TASK_SERVER, DECISION_SERVER, CANONICAL_MCP_PROXY_SERVER, WIKI_SERVER, TOKEN_STATS_SERVER, COMPACTION_LOG_SERVER, SYSTEM_HEALTH_SERVER, AGENT_HEALTH_SERVER, VAULT_SERVER, BG_BASH_BASE_PORT, BG_BASH_MAX_PORT, RUNTIME_MCP_SECRET, NODE_CONTROL_TOKEN, NODE_ID, VAULT_MASTER_KEY, NEGOTIUM_PORT, hostname, DATA_DIR, LOG_DIR, UPLOADS_DIR, VAULT_DIR, SESSIONS_DB, DEBUG_FILE, USERS_LOG_DIR, RUN_DIR, PROGRESS_DIR, DM_CMD_DIR, DM_RESP_DIR, SESSION_INBOX_DIR, SESSION_ASKS_DIR, BASHRS_SPILL_ROOT, PLAYWRIGHT_BASE_PORT, PLAYWRIGHT_MAX_PORT, PLAYWRIGHT_PORTS_DIR, ACTIVE_QUERY_STALE_MS, AGENTS_PROMPTS_DIR, RESOURCES_DIR, FILE_TAG_REGEX, MODEL_SONNET = "claude-sonnet-5", MODEL_OPUS = "claude-opus-5", MODEL_FABLE = "claude-fable-5", FALLBACK_AGENT, SESSION_AGENT, GATEWAY_AGENT, FALLBACK_MODEL, SESSION_MODEL, GATEWAY_MODEL, FFMPEG_BIN, FFPROBE_BIN, PYTHON_BIN, FASTER_WHISPER_WRAPPER, WHISPER_MODEL, TESSERACT_BIN, PDFTOTEXT_BIN, _envMaxTellDepth, MAX_TELL_DEPTH;
 var init_config = __esm(() => {
   init_config_helpers();
   init_logger();
@@ -304,7 +304,6 @@ var init_config = __esm(() => {
   SESSION_COMM_SERVER = resolve(PROJECT_ROOT, "src/mcp/session-comm/server.ts");
   TASK_SERVER = resolve(PROJECT_ROOT, "src/mcp/task-server.ts");
   DECISION_SERVER = resolve(PROJECT_ROOT, "src/mcp/decision-server.ts");
-  BROWSER_MCP_SSE_PROXY_SERVER = resolve(PROJECT_ROOT, "src/mcp/browser-sse-proxy-server.ts");
   CANONICAL_MCP_PROXY_SERVER = resolve(PROJECT_ROOT, "src/mcp/canonical-proxy-server.ts");
   WIKI_SERVER = resolve(PROJECT_ROOT, "src/mcp/wiki-server.ts");
   TOKEN_STATS_SERVER = resolve(PROJECT_ROOT, "src/mcp/token-stats-server.ts");
@@ -1869,7 +1868,7 @@ var exports_version = {};
 __export(exports_version, {
   NEGOTIUM_VERSION: () => NEGOTIUM_VERSION
 });
-var NEGOTIUM_VERSION = "0.4.5";
+var NEGOTIUM_VERSION = "0.4.8";
 
 // ../../packages/core/src/agents/codex-native-multi-agent.ts
 import { spawn } from "child_process";
@@ -2755,12 +2754,6 @@ function playwrightTransport(port, owner, capability, agent) {
     };
   }
   const query = new URLSearchParams({ owner });
-  if (agent === "maestro") {
-    return buildStdioMcpServer("maestro", BROWSER_MCP_SSE_PROXY_SERVER, [], {
-      NEGOTIUM_BROWSER_SSE_URL: `http://127.0.0.1:${port}/sse?${query}`,
-      NEGOTIUM_BROWSER_OWNER_CAPABILITY: ownerCapability
-    });
-  }
   return {
     type: "sse",
     url: `http://127.0.0.1:${port}/sse?${query}`,
@@ -2770,14 +2763,20 @@ function playwrightTransport(port, owner, capability, agent) {
 function longLivedHttpMcp(agent, port) {
   return agent === "codex" ? { url: `http://127.0.0.1:${port}/mcp` } : { type: "sse", url: `http://127.0.0.1:${port}/sse` };
 }
-function setCuaRsMcpPort(port) {
+function setCuaRsMcpPort(port, token) {
   if (port !== undefined && (!Number.isInteger(port) || port < 1 || port > 65535)) {
     throw new Error(`invalid cua-rs MCP port: ${port}`);
   }
   cuaRsMcpPort = port;
+  cuaRsMcpToken = port === undefined ? undefined : token;
 }
-function cuaRsHttpMcp(port) {
-  return { type: "http", url: `http://127.0.0.1:${port}/mcp` };
+function cuaRsHttpMcp(agent, port, token) {
+  const url = `http://127.0.0.1:${port}/mcp`;
+  const headers = token ? { Authorization: `Bearer ${token}` } : undefined;
+  const base = { type: "http", url };
+  if (!headers)
+    return base;
+  return agent === "codex" ? { ...base, http_headers: headers } : { ...base, headers };
 }
 function backgroundBashTransport(agent, port, userId, topic) {
   const capability = bgBashContextCapability(userId, topic);
@@ -3054,7 +3053,7 @@ function getMcpServersForQuery(opts) {
     peerBridge: opts.peerBridge
   });
 }
-var _playwrightUnavailableNotifier, _playwrightUnavailableLastNotifiedAt, _PLAYWRIGHT_UNAVAILABLE_COOLDOWN_MS, _playwrightUnavailableThisTurn, CODEX_BROWSER_CAPABILITY_ENV = "NEGOTIUM_BROWSER_CAPABILITY", cuaRsMcpPort, MCP_CATALOG, allForumMcpServerNames, requiredForumMcpServers, REQUIRED_FORUM_MCP_SERVERS, optionalForumMcpServers, OPTIONAL_FORUM_MCP_SERVERS, nodeMcpEntries;
+var _playwrightUnavailableNotifier, _playwrightUnavailableLastNotifiedAt, _PLAYWRIGHT_UNAVAILABLE_COOLDOWN_MS, _playwrightUnavailableThisTurn, CODEX_BROWSER_CAPABILITY_ENV = "NEGOTIUM_BROWSER_CAPABILITY", cuaRsMcpPort, cuaRsMcpToken, MCP_CATALOG, allForumMcpServerNames, requiredForumMcpServers, REQUIRED_FORUM_MCP_SERVERS, optionalForumMcpServers, OPTIONAL_FORUM_MCP_SERVERS, nodeMcpEntries;
 var init_mcp_config = __esm(() => {
   init_canonical_bridge_config();
   init_runtime_spec();
@@ -3272,8 +3271,8 @@ var init_mcp_config = __esm(() => {
     },
     "cua-rs": {
       ...commonRuntimeMcpPolicy("cua-rs"),
-      build() {
-        return cuaRsMcpPort ? cuaRsHttpMcp(cuaRsMcpPort) : null;
+      build({ agent }) {
+        return cuaRsMcpPort ? cuaRsHttpMcp(agent, cuaRsMcpPort, cuaRsMcpToken) : null;
       }
     }
   };
@@ -32618,7 +32617,8 @@ __export(exports_src3, {
   NODE_CONTROL_PROTOCOL_VERSION: () => NODE_CONTROL_PROTOCOL_VERSION,
   NODE_CONTROL_BASE_PATH: () => NODE_CONTROL_BASE_PATH
 });
-import { rmSync as rmSync10 } from "fs";
+import { randomBytes as randomBytes8 } from "crypto";
+import { readFileSync as readFileSync29, rmSync as rmSync10, writeFileSync as writeFileSync25 } from "fs";
 import { createServer as createServer5 } from "net";
 import { join as join43 } from "path";
 async function availableLoopbackPort() {
@@ -32676,6 +32676,34 @@ async function wireNodeMcps(host2, manifest) {
     logger.info({ keys: entries.map((e) => e.key) }, "node mcp: manifest servers installed");
   }
 }
+function cuaRsToken() {
+  const file = join43(RUN_DIR, CUA_RS_MCP_TOKEN_FILE);
+  try {
+    const existing = readFileSync29(file, "utf8").trim();
+    if (/^[0-9a-f]{64}$/.test(existing))
+      return existing;
+  } catch {}
+  const token = randomBytes8(32).toString("hex");
+  writeFileSync25(file, token, { mode: 384 });
+  return token;
+}
+async function cuaRsAuthOk(port, token) {
+  try {
+    const res = await fetch(`http://127.0.0.1:${port}/mcp`, {
+      method: "POST",
+      headers: {
+        Authorization: `Bearer ${token}`,
+        "Content-Type": "application/json",
+        Accept: "application/json, text/event-stream"
+      },
+      body: "{}",
+      signal: AbortSignal.timeout(2000)
+    });
+    return res.status !== 401;
+  } catch {
+    return true;
+  }
+}
 async function wireCuaRsMcp() {
   setCuaRsMcpPort(undefined);
   const binary = resolveCuaRsBinary();
@@ -32684,11 +32712,13 @@ async function wireCuaRsMcp() {
   const manifestFile = join43(RUN_DIR, CUA_RS_MCP_MANIFEST_FILE);
   rmSync10(manifestFile, { force: true });
   const manifest = new McpManifest({ file: manifestFile });
+  const token = cuaRsToken();
   const spec = {
     key: CUA_RS_MCP_KEY,
     transport: "http",
     command: binary,
     args: ["{port}"],
+    env: { CUA_HTTP_TOKEN: token },
     portRange: CUA_RS_MCP_PORT_RANGE,
     scope: "node",
     healthIntervalMs: 15000
@@ -32697,10 +32727,20 @@ async function wireCuaRsMcp() {
   const host2 = new McpHost({ manifest });
   const stopSweeper = host2.startSweeper();
   try {
-    const instance = await host2.ensure(CUA_RS_MCP_KEY);
+    let instance = await host2.ensure(CUA_RS_MCP_KEY);
     if (!instance.port)
       throw new Error("cua-rs started without an HTTP port");
-    setCuaRsMcpPort(instance.port);
+    if (!await cuaRsAuthOk(instance.port, token)) {
+      logger.warn({ port: instance.port }, "cua-rs rejected the node's token; restarting it");
+      await host2.stop(CUA_RS_MCP_KEY);
+      instance = await host2.ensure(CUA_RS_MCP_KEY);
+      if (!instance.port)
+        throw new Error("cua-rs restarted without an HTTP port");
+      if (!await cuaRsAuthOk(instance.port, token)) {
+        throw new Error("cua-rs will not accept the node's bearer token");
+      }
+    }
+    setCuaRsMcpPort(instance.port, token);
     logger.info({ pid: instance.pid, port: instance.port }, "cua-rs MCP server ready");
     return { host: host2, stopSweeper };
   } catch (error2) {
@@ -32909,7 +32949,7 @@ async function runNodeDaemon(opts = {}) {
   await new Promise((resolve24) => setImmediate(resolve24));
   process.exit(0);
 }
-var CUA_RS_MCP_KEY = "cua-rs", CUA_RS_MCP_MANIFEST_FILE = "cua-rs-mcp-manifest.json", CUA_RS_MCP_PORT_RANGE;
+var CUA_RS_MCP_KEY = "cua-rs", CUA_RS_MCP_MANIFEST_FILE = "cua-rs-mcp-manifest.json", CUA_RS_MCP_TOKEN_FILE = "cua-rs-mcp.token", CUA_RS_MCP_PORT_RANGE;
 var init_src5 = __esm(async () => {
   await init_conversation_migration();
   await init_node_host();
@@ -43108,12 +43148,12 @@ import {
   lstatSync,
   mkdirSync as mkdirSync33,
   openSync as openSync5,
-  readFileSync as readFileSync29,
+  readFileSync as readFileSync30,
   renameSync as renameSync17,
   rmSync as rmSync11,
   statSync as statSync20,
   unlinkSync as unlinkSync23,
-  writeFileSync as writeFileSync25
+  writeFileSync as writeFileSync26
 } from "fs";
 import { dirname as dirname23, resolve as resolve25 } from "path";
 function joinFilePath() {
@@ -43194,7 +43234,7 @@ function withJoinCredentialLock(operation) {
     try {
       mkdirSync33(lockPath, { mode: 448 });
       created = true;
-      writeFileSync25(ownerPath, `${JSON.stringify(owner)}
+      writeFileSync26(ownerPath, `${JSON.stringify(owner)}
 `, { mode: 384 });
       const ownerFd = openSync5(ownerPath, "r");
       try {
@@ -43212,7 +43252,7 @@ function withJoinCredentialLock(operation) {
         throw error2;
       let current3 = null;
       try {
-        current3 = JSON.parse(readFileSync29(ownerPath, "utf8"));
+        current3 = JSON.parse(readFileSync30(ownerPath, "utf8"));
       } catch {}
       let ageMs;
       try {
@@ -43242,7 +43282,7 @@ function withJoinCredentialLock(operation) {
     return operation();
   } finally {
     try {
-      const current3 = JSON.parse(readFileSync29(ownerPath, "utf8"));
+      const current3 = JSON.parse(readFileSync30(ownerPath, "utf8"));
       if (current3.pid === owner.pid && current3.token === owner.token) {
         rmSync11(lockPath, { recursive: true, force: true });
       }
@@ -43267,7 +43307,7 @@ function joinCredentialDigest(join46) {
 function readPersistedJoins(path = joinFilePath()) {
   if (!existsSync39(path))
     return [];
-  const parsed = JSON.parse(readFileSync29(path, "utf-8"));
+  const parsed = JSON.parse(readFileSync30(path, "utf-8"));
   if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) {
     throw new Error("persisted join credentials are not a JSON object");
   }
@@ -43305,7 +43345,7 @@ function writeJoins(joins, allowOverwrite) {
   let fd;
   try {
     fd = openSync5(temporaryPath, "wx", 384);
-    writeFileSync25(fd, `${JSON.stringify(payload, null, 2)}
+    writeFileSync26(fd, `${JSON.stringify(payload, null, 2)}
 `, "utf8");
     fsyncSync2(fd);
     closeSync5(fd);
@@ -43931,7 +43971,7 @@ var init_store2 = __esm(async () => {
 
 // ../../adapters/otium/src/workspace-scope.ts
 import { createHash as createHash13 } from "crypto";
-import { mkdirSync as mkdirSync35, readFileSync as readFileSync30, writeFileSync as writeFileSync26 } from "fs";
+import { mkdirSync as mkdirSync35, readFileSync as readFileSync31, writeFileSync as writeFileSync27 } from "fs";
 import { dirname as dirname24, resolve as resolve26 } from "path";
 function surfaceScopeFor(central, workspaceId) {
   const digest = createHash13("sha256").update(`${central.trim().replace(/\/+$/, "")}
@@ -43943,7 +43983,7 @@ function scopeCachePath() {
 }
 function readCache() {
   try {
-    const parsed = JSON.parse(readFileSync30(scopeCachePath(), "utf-8"));
+    const parsed = JSON.parse(readFileSync31(scopeCachePath(), "utf-8"));
     if (!parsed || typeof parsed !== "object" || Array.isArray(parsed))
       return {};
     return parsed;
@@ -43964,7 +44004,7 @@ function cacheSurfaceScope(join47, workspaceId) {
     mkdirSync35(dirname24(path), { recursive: true });
     const cache = readCache();
     cache[join47.cellId] = { central: join47.central, workspaceId, scope };
-    writeFileSync26(path, `${JSON.stringify(cache, null, 2)}
+    writeFileSync27(path, `${JSON.stringify(cache, null, 2)}
 `, { mode: 384 });
   } catch (err2) {
     logger.warn({ err: err2, path }, "otium: could not cache the workspace scope");
@@ -45005,10 +45045,10 @@ import {
   linkSync as linkSync2,
   mkdirSync as mkdirSync36,
   openSync as openSync6,
-  readFileSync as readFileSync31,
+  readFileSync as readFileSync32,
   renameSync as renameSync18,
   unlinkSync as unlinkSync24,
-  writeFileSync as writeFileSync27
+  writeFileSync as writeFileSync28
 } from "fs";
 import { dirname as dirname25, resolve as resolve27 } from "path";
 function parseEnrollmentInvite(code) {
@@ -45038,7 +45078,7 @@ function isEnrollmentPending(invite) {
   if (!existsSync40(path))
     return false;
   try {
-    const saved = JSON.parse(readFileSync31(path, "utf8"));
+    const saved = JSON.parse(readFileSync32(path, "utf8"));
     return saved.central === invite.central && saved.token === invite.token;
   } catch {
     return false;
@@ -45047,7 +45087,7 @@ function isEnrollmentPending(invite) {
 function loadOrCreatePending(invite, nodeName) {
   const path = pendingEnrollmentPath();
   if (existsSync40(path)) {
-    const saved = JSON.parse(readFileSync31(path, "utf8"));
+    const saved = JSON.parse(readFileSync32(path, "utf8"));
     if (saved.central === invite.central && saved.token === invite.token)
       return saved;
     throw new Error(`another Otium enrollment is pending at ${path}`);
@@ -45065,7 +45105,7 @@ function loadOrCreatePending(invite, nodeName) {
   let fd;
   try {
     fd = openSync6(temporaryPath, "wx", 384);
-    writeFileSync27(fd, `${JSON.stringify(pending2, null, 2)}
+    writeFileSync28(fd, `${JSON.stringify(pending2, null, 2)}
 `, "utf8");
     fsyncSync3(fd);
     closeSync6(fd);
@@ -45085,7 +45125,7 @@ function loadOrCreatePending(invite, nodeName) {
     if (existsSync40(temporaryPath))
       unlinkSync24(temporaryPath);
     if (error2.code === "EEXIST" && existsSync40(path)) {
-      const saved = JSON.parse(readFileSync31(path, "utf8"));
+      const saved = JSON.parse(readFileSync32(path, "utf8"));
       if (saved.central === invite.central && saved.token === invite.token)
         return saved;
     }
@@ -45100,7 +45140,7 @@ function replacePendingEnrollment(pending2) {
   let fd;
   try {
     fd = openSync6(temporaryPath, "wx", 384);
-    writeFileSync27(fd, `${JSON.stringify(pending2, null, 2)}
+    writeFileSync28(fd, `${JSON.stringify(pending2, null, 2)}
 `, "utf8");
     fsyncSync3(fd);
     closeSync6(fd);
@@ -45122,7 +45162,7 @@ function replacePendingEnrollment(pending2) {
 }
 function recordClaimedCredential(pending2, join47) {
   withJoinCredentialLock(() => {
-    const current3 = JSON.parse(readFileSync31(pendingEnrollmentPath(), "utf8"));
+    const current3 = JSON.parse(readFileSync32(pendingEnrollmentPath(), "utf8"));
     if (current3.central !== pending2.central || current3.token !== pending2.token || current3.idempotencyKey !== pending2.idempotencyKey || current3.publicKey !== pending2.publicKey) {
       throw new Error("pending Otium enrollment changed while its claim was in flight");
     }
@@ -45201,7 +45241,7 @@ async function claimEnrollment(invite, nodeName) {
 function commitEnrollment(join47, options = {}) {
   return withJoinCredentialLock(() => {
     const pendingPath = pendingEnrollmentPath();
-    const pending2 = existsSync40(pendingPath) ? JSON.parse(readFileSync31(pendingPath, "utf8")) : null;
+    const pending2 = existsSync40(pendingPath) ? JSON.parse(readFileSync32(pendingPath, "utf8")) : null;
     const digest = joinCredentialDigest(join47);
     if (pending2 && (!pending2.claimed || pending2.claimed.digest !== digest || pending2.claimed.cellId !== join47.cellId)) {
       throw new Error(`pending Otium enrollment at ${pendingPath} does not match these credentials`);
@@ -47292,4 +47332,4 @@ switch (command) {
   }
 }
 
-//# debugId=3BD5C4B6822614C464756E2164756E21
+//# debugId=F3E282057E27AACC64756E2164756E21