@hilbras/omninode 2.0.0-alpha.11 → 2.0.0-alpha.13

package/dist/index.d.ts

@@ -1995,6 +1995,26 @@ type PlannerConfigYaml = z.infer<typeof plannerConfigSchema>;
 type ProjectConfigYaml = z.infer<typeof projectConfigSchema>;
 type AppConfigYaml = z.infer<typeof appConfigSchema>;
 
+/**
+ * Inline secret detection (roadmap §17, Secrets).
+ *
+ * OmniNode configuration must never contain literal credentials — only
+ * environment-variable *references*. This scanner runs before the config is
+ * parsed and reports anything that looks like an inline secret, so the file
+ * is rejected before it can be committed or persisted.
+ */
+interface SecretFinding {
+    /** 1-based line number in the source. */
+    line: number;
+    /** The offending key, e.g. `api_key`. */
+    key: string;
+    /** Redacted excerpt — never echoes the value. */
+    excerpt: string;
+}
+declare function scanForInlineSecrets(source: string): SecretFinding[];
+/** Formats findings as an actionable configuration error message. */
+declare function describeSecretFindings(file: string, findings: SecretFinding[]): string;
+
 interface AppConfig {
     project: {
         name: string;
@@ -2391,27 +2411,55 @@ declare class RoleRegistry {
 /** Builds a role registry from the project configuration. */
 declare function buildRoleRegistry(config: AppConfig): RoleRegistry;
 
+/** Current on-disk schema version. */
+declare const SCHEMA_VERSION = 2;
 interface JsonDocument<T> {
-    /** Bumped when the persisted shape changes in a breaking way (v2 Phase 12). */
     schemaVersion?: number;
     items: T[];
 }
+type DocumentState = {
+    status: "missing";
+} | {
+    status: "empty";
+} | {
+    status: "v1-legacy";
+} | {
+    status: "current";
+    schemaVersion: number;
+    count: number;
+} | {
+    status: "future";
+    schemaVersion: number;
+} | {
+    status: "corrupt";
+    detail: string;
+};
 interface JsonFileStoreOptions {
     directory?: string;
     fileName: string;
+    /** Schema version to write (defaults to the current version). */
     schemaVersion?: number;
-    /** Called when a persisted file cannot be parsed. */
+    /** Called when a persisted file is corrupt (after quarantine). */
     onCorrupt?: (path: string, error: unknown) => void;
-}
+    /** Disable file moves (used by dry runs / tests that inspect in place). */
+    quarantine?: boolean;
+}
+/** Durably writes a file: temp → fsync → rename → directory fsync. */
+declare function writeFileAtomic(target: string, contents: string): Promise<void>;
+/** Reads and classifies a persisted document without modifying it. */
+declare function inspectDocument(path: string): Promise<DocumentState>;
+/** Reads a document, migrating v1 shapes and quarantining corruption. */
+declare function readDocument<T>(path: string, onCorrupt?: (path: string, error: unknown) => void, quarantine?: boolean): Promise<T[]>;
 declare class JsonFileStore<T> {
     private readonly filePath;
     private readonly schemaVersion;
     private readonly onCorrupt?;
+    private readonly quarantine;
     private readonly log;
     private queue;
     constructor(options: JsonFileStoreOptions);
     get path(): string;
-    /** All items, or [] when missing/corrupt. */
+    /** All items, or [] when missing/migrated-from-v1/corrupt. */
     protected readAll(): Promise<T[]>;
     protected writeAll(items: T[]): Promise<void>;
     /** Serializes an async operation against this file. */
@@ -2676,6 +2724,8 @@ interface CombinedMeta {
     pipelineRunId?: string;
     taskIds?: string[];
 }
+/** Serialized size budget for a single report (roadmap §17 — output limits). */
+declare const MAX_REPORT_BYTES: number;
 interface CollectionDiagnostics {
     collected: number;
     accepted: number;
@@ -3017,11 +3067,9 @@ declare function createDefaultChatFn(providers: AppConfig["project"]["providers"
 declare function buildPipelineEngine(config: AppConfig, log?: Logger): PipelineEngine;
 
 /**
- * Persistence layer (v2 Phase 1): one entry point to every local store.
- *
- * All stores are interfaces with a local JSON default
- * (TaskStore, PipelineRunStore, ReportStore, PlanStore, IMemoryProvider,
- * AuditSink) — see docs/API.md for the inventory and stability status.
+ * Persistence layer (v2 Phase 12): one entry point to every local store,
+ * the canonical storage interface names, and the migration path that upgrades
+ * v1 data in place.
  */
 
 /** Bundles every store for a single project directory. */
@@ -3034,7 +3082,26 @@ declare class ProjectStores {
     readonly audit: FileAuditLog;
     constructor(directory?: string);
 }
+interface MigrationReport {
+    file: string;
+    state: DocumentState["status"];
+    before?: number;
+    after?: number;
+    migrated: boolean;
+    note?: string;
+}
+/** Every persisted store file OmniNode manages in a project. */
+declare const STORE_FILES: readonly ["tasks.json", "pipelines.json", "reports.json", "plans.json", "memory.json"];
+/**
+ * Migration (roadmap §16): inspects every store file, reports its schema
+ * state, and — unless `checkOnly` — rewrites v1 documents at the current
+ * schema version. Idempotent and safe: unknown/future versions are reported,
+ * never rewritten.
+ */
+declare function migrateProjectStores(directory?: string, options?: {
+    checkOnly?: boolean;
+}): Promise<MigrationReport[]>;
 
-declare const OMNINODE_VERSION = "2.0.0-alpha.11";
+declare const OMNINODE_VERSION = "2.0.0-alpha.13";
 
-export { AgentAdapterRegistry, type AgentConfig, type AgentConfigYaml, type AgentDescriptor, AgentError, type AgentInfo, type AgentInputMode, type AgentIntegrationType, AgentRegistry, type AgentStatus, type AgentTaskInput, type AgentTaskOutput, type AgentToNodeMessage, type AggregateOptions, type AggregatedFinding, type AggregatedRecommendation, type AppConfig, type AppConfigYaml, type ArtifactKind, type ArtifactPayload, type AskedQuestion, type AuditAction, type AuditEvent, type AuditSink, type ChatFn, type ChatMessage, type ChatRequest, type ChatResponse, type ChatRole, type ChatStreamChunk, type ChatUsage, type CollectionDiagnostics, type CombinedMeta, type CombinedReport, type CombinedReportFilter, type Confidence, ConfigError, type ConflictPosition, ConsoleLogSink, type CreateTaskInput, type CwdValidation, DEFAULT_MAX_OUTPUT_BYTES, type DecodeResult, type DiscoveryResult, type EnvPolicy, type EnvelopeMeta, type Evidence, type EvidenceInput, type EvidenceKind, type ExecutionRecord, type ExtractionMeta, FileAuditLog, FilePipelineRunStore, FilePlanStore, FileReportStore, FileTaskStore, type Finding, type FindingOrigin, type FindingSeverity, type FindingSource, type HelloResult, HeuristicPlanner, type HttpRequestOptions, type HttpResponse, type IAgent, type IAgentAdapter, type IChatProvider, type IMemoryProvider, type IPipelineExecutor, type IPlanner, type IProvider, type JsonDocument, JsonFileStore, type JsonFileStoreOptions, type LoadConfigOptions, LocalMemoryProvider, type LogLevel, type LogSink, Logger, type LoggerOptions, MAX_CONTEXT_CHARS, MAX_MESSAGE_BYTES, type MemoryCategory, type MemoryContextQuery, type MemoryEntry, MemoryError, type MemoryProviderConfig, type MemoryProviderMetadata, type MemoryQuery, type MemoryScope, MemoryService, type MemoryServiceOptions, type MemoryTaskContext, type MessageEnvelope, type Modality, type ModelCapabilities, type ModelFilter, type ModelInfo, ModelPlanner, ModelRegistry, type ModelStatus, type NodeToAgentMessage, OMNINODE_VERSION, OPENAI_COMPATIBLE_TYPES, type OmniHilbrasConnectionResult, OmniHilbrasProvider, OmniNodeError, type OmniNodeErrorCode, type OmniNodeErrorOptions, OpenAICompatibleProvider, PROTOCOL_V2, type PipelineConfigYaml, type PipelineDefinition, PipelineEngine, type PipelineEngineOptions, PipelineError, type PipelineRun, type PipelineRunAttempt, type PipelineRunFilter, type PipelineRunOptions, type PipelineRunStatus, type PipelineRunStore, type PipelineStep, type PipelineStepCondition, type PipelineStepConfigYaml, type PipelineStepKind, type PipelineStepRun, type Plan, type PlanFilter, type PlanJsonResult, type PlanRequest, type PlanStep, type PlanStore, type PlanValidationIssue, type PlanValidationResult, type PlannerConfigYaml, PlannerError, ProcessAgent, ProcessAgentAdapter, type Project, type ProjectConfigYaml, ProjectStores, type ProtocolAgentToNodeType, ProtocolDecoder, type ProtocolEnvelope, ProtocolError, type ProtocolMessageType, type ProtocolNodeToAgentType, ProtocolSession, type ProtocolViolation, type ProtocolViolationCode, type ProviderAuthentication, type ProviderCapability, type ProviderConfig, type ProviderConfigYaml, ProviderError, type ProviderErrorKind, type ProviderHealth, type ProviderStatus, type ProviderType, type QuestionPayload, type QuestionResponder, type RememberaConfig, RememberaMemoryProvider, type Report, type ReportArtifact, type ReportConflict, type ReportFilter, type ReportPayload, ReportService, type ReportStore, type ReportValidationIssue, type ReportValidationResult, type RoleConfigYaml, type RoleDefinition, RoleRegistry, type RunPipelineOptions, SUPPORTED_PROTOCOL_VERSIONS, type SessionIds, TERMINAL_TASK_STATUSES, type Task, type TaskContext, TaskEngine, type TaskEngineOptions, TaskError, type TaskPayload, type TaskResult, type TaskStatus, type TaskStore, type TaskStoreFilter, type WritableLike, agentConfigSchema, aggregateReports, appConfigSchema, authHeaders, buildAgentRegistry, buildChildEnv, buildHello, buildHelloAck, buildPipelineEngine, buildPlanner, buildPlannerContext, buildRoleRegistry, composeTaskText, createAgent, createDefaultChatFn, createMemoryProvider, createProvider, createTaskEngine, decodeMessage, decodeStream, defaultMetadata, defaultProjectConfigYaml, defaultSearch, describeExit, detectConflicts, encodeMessage, envelope, expandEnvRefs, extractMessage, extractReportFromText, findConfigFile, isNetworkError, isOmniNodeError, isRetryable, isSupportedProtocol, isTimeoutError, keywords, killTree, kindFromStatus, loadConfig, logger, newMessageId, normalizeEvidence, normalizeFinding, parseHello, parsePlanJson, parseRetryAfter, pipelineConfigSchema, pipelineStepConfigSchema, planJsonSchema, plannerConfigSchema, projectConfigSchema, providerConfigSchema, providerHttpError, providerTransportError, registryKey, requestJson, requireCompletion, resolveApiKey, resolveEnvPolicy, roleConfigSchema, sanitizeChunk, similar, validateEnvelope, validatePlan, validateReport, validateWorkingDirectory };
+export { AgentAdapterRegistry, type AgentConfig, type AgentConfigYaml, type AgentDescriptor, AgentError, type AgentInfo, type AgentInputMode, type AgentIntegrationType, AgentRegistry, type AgentStatus, type AgentTaskInput, type AgentTaskOutput, type AgentToNodeMessage, type AggregateOptions, type AggregatedFinding, type AggregatedRecommendation, type AppConfig, type AppConfigYaml, type ArtifactKind, type ArtifactPayload, type AskedQuestion, type AuditAction, type AuditEvent, type AuditSink, type AuditSink as AuditStore, type ChatFn, type ChatMessage, type ChatRequest, type ChatResponse, type ChatRole, type ChatStreamChunk, type ChatUsage, type CollectionDiagnostics, type CombinedMeta, type CombinedReport, type CombinedReportFilter, type Confidence, ConfigError, type ConflictPosition, ConsoleLogSink, type CreateTaskInput, type CwdValidation, DEFAULT_MAX_OUTPUT_BYTES, type DecodeResult, type DiscoveryResult, type DocumentState, type EnvPolicy, type EnvelopeMeta, type Evidence, type EvidenceInput, type EvidenceKind, type ExecutionRecord, type ExtractionMeta, FileAuditLog, FilePipelineRunStore, FilePlanStore, FileReportStore, FileTaskStore, type Finding, type FindingOrigin, type FindingSeverity, type FindingSource, type HelloResult, HeuristicPlanner, type HttpRequestOptions, type HttpResponse, type IAgent, type IAgentAdapter, type IChatProvider, type IMemoryProvider, type IPipelineExecutor, type IPlanner, type IProvider, type JsonDocument, JsonFileStore, type JsonFileStoreOptions, type LoadConfigOptions, LocalMemoryProvider, type LogLevel, type LogSink, Logger, type LoggerOptions, MAX_CONTEXT_CHARS, MAX_MESSAGE_BYTES, MAX_REPORT_BYTES, type MemoryCategory, type MemoryContextQuery, type MemoryEntry, MemoryError, type MemoryProviderConfig, type MemoryProviderMetadata, type MemoryQuery, type MemoryScope, MemoryService, type MemoryServiceOptions, LocalMemoryProvider as MemoryStore, type MemoryTaskContext, type MessageEnvelope, type MigrationReport, type Modality, type ModelCapabilities, type ModelFilter, type ModelInfo, ModelPlanner, ModelRegistry, type ModelStatus, type NodeToAgentMessage, OMNINODE_VERSION, OPENAI_COMPATIBLE_TYPES, type OmniHilbrasConnectionResult, OmniHilbrasProvider, OmniNodeError, type OmniNodeErrorCode, type OmniNodeErrorOptions, OpenAICompatibleProvider, PROTOCOL_V2, type PipelineConfigYaml, type PipelineDefinition, PipelineEngine, type PipelineEngineOptions, PipelineError, type PipelineRun, type PipelineRunAttempt, type PipelineRunFilter, type PipelineRunOptions, type PipelineRunStatus, type PipelineRunStore, type PipelineStep, type PipelineStepCondition, type PipelineStepConfigYaml, type PipelineStepKind, type PipelineStepRun, type PipelineRunStore as PipelineStore, type Plan, type PlanFilter, type PlanJsonResult, type PlanRequest, type PlanStep, type PlanStore, type PlanValidationIssue, type PlanValidationResult, type PlannerConfigYaml, PlannerError, ProcessAgent, ProcessAgentAdapter, type Project, type ProjectConfigYaml, ProjectStores, type ProtocolAgentToNodeType, ProtocolDecoder, type ProtocolEnvelope, ProtocolError, type ProtocolMessageType, type ProtocolNodeToAgentType, ProtocolSession, type ProtocolViolation, type ProtocolViolationCode, type ProviderAuthentication, type ProviderCapability, type ProviderConfig, type ProviderConfigYaml, ProviderError, type ProviderErrorKind, type ProviderHealth, type ProviderStatus, type ProviderType, type QuestionPayload, type QuestionResponder, type RememberaConfig, RememberaMemoryProvider, type Report, type ReportArtifact, type ReportConflict, type ReportFilter, type ReportPayload, ReportService, type ReportStore, type ReportValidationIssue, type ReportValidationResult, type RoleConfigYaml, type RoleDefinition, RoleRegistry, type RunPipelineOptions, SCHEMA_VERSION, STORE_FILES, SUPPORTED_PROTOCOL_VERSIONS, type SecretFinding, type SessionIds, TERMINAL_TASK_STATUSES, type Task, type TaskContext, TaskEngine, type TaskEngineOptions, TaskError, type TaskPayload, type TaskResult, type TaskStatus, type TaskStore, type TaskStoreFilter, type WritableLike, agentConfigSchema, aggregateReports, appConfigSchema, authHeaders, buildAgentRegistry, buildChildEnv, buildHello, buildHelloAck, buildPipelineEngine, buildPlanner, buildPlannerContext, buildRoleRegistry, composeTaskText, createAgent, createDefaultChatFn, createMemoryProvider, createProvider, createTaskEngine, decodeMessage, decodeStream, defaultMetadata, defaultProjectConfigYaml, defaultSearch, describeExit, describeSecretFindings, detectConflicts, encodeMessage, envelope, expandEnvRefs, extractMessage, extractReportFromText, findConfigFile, inspectDocument, isNetworkError, isOmniNodeError, isRetryable, isSupportedProtocol, isTimeoutError, keywords, killTree, kindFromStatus, loadConfig, logger, migrateProjectStores, newMessageId, normalizeEvidence, normalizeFinding, parseHello, parsePlanJson, parseRetryAfter, pipelineConfigSchema, pipelineStepConfigSchema, planJsonSchema, plannerConfigSchema, projectConfigSchema, providerConfigSchema, providerHttpError, providerTransportError, readDocument, registryKey, requestJson, requireCompletion, resolveApiKey, resolveEnvPolicy, roleConfigSchema, sanitizeChunk, scanForInlineSecrets, similar, validateEnvelope, validatePlan, validateReport, validateWorkingDirectory, writeFileAtomic };

package/dist/index.js

@@ -202,6 +202,39 @@ var appConfigSchema = z.object({
   logging: z.object({ level: z.enum(["debug", "info", "warn", "error"]) }).strict().optional()
 }).strict();
 
+// src/config/secrets.ts
+var SAFE_KEY_SUFFIXES = ["_env", "_env_var", "_file", "_path", "_ref", "_id", "_url", "_command"];
+var SECRET_KEY = /^\s*([A-Za-z0-9_-]*(?:api[_-]?key|token|password|passwd|secret|credential)[A-Za-z0-9_-]*)\s*:\s*(.*)$/i;
+var SAFE_VALUE = /^\s*(?:\$\{[^}]*\}|\$[A-Z_][A-Z0-9_]*|<[^>]*>|""|''|null|~)\s*$/i;
+function scanForInlineSecrets(source) {
+  const findings = [];
+  source.split("\n").forEach((line, index) => {
+    const trimmed = line.trim();
+    if (trimmed.startsWith("#")) return;
+    const match = SECRET_KEY.exec(line);
+    if (!match) return;
+    const key = match[1] ?? "";
+    const rawValue = (match[2] ?? "").trim().replace(/,\s*$/, "");
+    const keyIsReference = SAFE_KEY_SUFFIXES.some((suffix) => key.toLowerCase().endsWith(suffix));
+    if (keyIsReference) return;
+    const value = rawValue.replace(/^["']|["']$/g, "");
+    if (value.length === 0 || SAFE_VALUE.test(rawValue)) return;
+    if (value.length < 8) return;
+    findings.push({
+      line: index + 1,
+      key,
+      excerpt: `${key}: ${value.slice(0, 3)}\u2026 (${value.length} chars, redacted)`
+    });
+  });
+  return findings;
+}
+function describeSecretFindings(file, findings) {
+  const lines = findings.map((f) => `  line ${f.line}: ${f.excerpt}`).join("\n");
+  return `${file} appears to contain ${findings.length} inline secret(s):
+${lines}
+OmniNode never stores credentials in configuration. Replace each value with an environment-variable reference, e.g. api_key_env_var: MY_API_KEY.`;
+}
+
 // src/config/loader.ts
 import { existsSync, readFileSync } from "fs";
 import { parse as parseYaml } from "yaml";
@@ -238,6 +271,10 @@ function loadConfig(options = {}) {
     );
   }
   const raw = readFileSync(path, "utf8");
+  const secretFindings = scanForInlineSecrets(raw);
+  if (secretFindings.length > 0) {
+    throw new ConfigError("CONFIG_INVALID", describeSecretFindings(path, secretFindings));
+  }
   const expanded = expandEnvRefs(raw, env, path);
   let data;
   try {
@@ -1820,51 +1857,119 @@ function buildRoleRegistry(config) {
 }
 
 // src/persistence/json-file-store.ts
-import { mkdir, readFile, rename, writeFile } from "fs/promises";
+import { open, mkdir, readFile, rename, stat } from "fs/promises";
 import { dirname } from "path";
+var SCHEMA_VERSION = 2;
+async function writeFileAtomic(target, contents) {
+  const tmp = `${target}.tmp`;
+  await mkdir(dirname(target), { recursive: true });
+  const handle = await open(tmp, "w");
+  try {
+    await handle.writeFile(contents, "utf8");
+    await handle.sync();
+  } finally {
+    await handle.close();
+  }
+  await rename(tmp, target);
+  try {
+    const dir = await open(dirname(target), "r");
+    try {
+      await dir.sync();
+    } finally {
+      await dir.close();
+    }
+  } catch {
+  }
+}
+async function inspectDocument(path) {
+  let raw;
+  try {
+    await stat(path);
+  } catch {
+    return { status: "missing" };
+  }
+  try {
+    raw = await readFile(path, "utf8");
+  } catch (error) {
+    return { status: "corrupt", detail: `unreadable: ${error instanceof Error ? error.message : String(error)}` };
+  }
+  if (raw.trim().length === 0) return { status: "empty" };
+  let parsed;
+  try {
+    parsed = JSON.parse(raw);
+  } catch (error) {
+    return { status: "corrupt", detail: error instanceof Error ? error.message : "invalid JSON" };
+  }
+  if (Array.isArray(parsed)) return { status: "v1-legacy" };
+  if (parsed === null || typeof parsed !== "object") return { status: "corrupt", detail: "not an object" };
+  const doc = parsed;
+  if (!Array.isArray(doc.items)) return { status: "corrupt", detail: "missing items array" };
+  const version = typeof doc.schemaVersion === "number" ? doc.schemaVersion : 1;
+  if (version > SCHEMA_VERSION) return { status: "future", schemaVersion: version };
+  if (version < SCHEMA_VERSION) return { status: "v1-legacy" };
+  return { status: "current", schemaVersion: version, count: doc.items.length };
+}
+async function readDocument(path, onCorrupt, quarantine = true) {
+  const state = await inspectDocument(path);
+  if (state.status === "missing" || state.status === "empty") return [];
+  if (state.status === "future") {
+    const error = new Error(
+      `${path} was written by a newer OmniNode (schema v${state.schemaVersion} > v${SCHEMA_VERSION})`
+    );
+    onCorrupt?.(path, error);
+    return [];
+  }
+  let raw;
+  try {
+    raw = await readFile(path, "utf8");
+  } catch (error) {
+    onCorrupt?.(path, error);
+    return [];
+  }
+  try {
+    const parsed = JSON.parse(raw);
+    if (Array.isArray(parsed)) return parsed;
+    return parsed.items ?? [];
+  } catch (error) {
+    if (quarantine) {
+      const quarantinePath = `${path}.corrupt-${Date.now()}`;
+      try {
+        await rename(path, quarantinePath);
+        logger.child({ component: "persistence" }).warn(
+          `Quarantined unreadable store file ${path} \u2192 ${quarantinePath}`
+        );
+      } catch {
+      }
+    }
+    onCorrupt?.(path, error);
+    return [];
+  }
+}
 var JsonFileStore = class {
   filePath;
   schemaVersion;
   onCorrupt;
+  quarantine;
   log;
   queue = Promise.resolve();
   constructor(options) {
     this.filePath = `${options.directory ?? `${process.cwd()}/.omninode`}/${options.fileName}`;
-    this.schemaVersion = options.schemaVersion ?? 1;
+    this.schemaVersion = options.schemaVersion ?? SCHEMA_VERSION;
     this.onCorrupt = options.onCorrupt;
+    this.quarantine = options.quarantine ?? true;
     this.log = logger.child({ component: "persistence", file: options.fileName });
   }
   get path() {
     return this.filePath;
   }
-  /** All items, or [] when missing/corrupt. */
+  /** All items, or [] when missing/migrated-from-v1/corrupt. */
   async readAll() {
-    let raw;
-    try {
-      raw = await readFile(this.filePath, "utf8");
-    } catch {
-      return [];
-    }
-    try {
-      const parsed = JSON.parse(raw);
-      if (Array.isArray(parsed)) return parsed;
-      if (parsed !== null && typeof parsed === "object" && Array.isArray(parsed.items)) {
-        return parsed.items;
-      }
-      throw new Error("persisted file has an unrecognized shape");
-    } catch (error) {
-      this.log.warn(`Treating ${this.filePath} as empty \u2014 it could not be parsed.`);
-      this.onCorrupt?.(this.filePath, error);
-      return [];
-    }
+    return readDocument(this.filePath, this.onCorrupt, this.quarantine);
   }
   async writeAll(items) {
     const document = { schemaVersion: this.schemaVersion, items };
-    const tmp = `${this.filePath}.tmp`;
-    await mkdir(dirname(this.filePath), { recursive: true });
-    await writeFile(tmp, `${JSON.stringify(document, null, 2)}
-`, "utf8");
-    await rename(tmp, this.filePath);
+    await writeFileAtomic(this.filePath, `${JSON.stringify(document, null, 2)}
+`);
   }
   /** Serializes an async operation against this file. */
   synchronized(operation) {
@@ -2167,7 +2272,7 @@ function sleep(ms) {
 }
 
 // src/audit/index.ts
-import { appendFile, mkdir as mkdir2 } from "fs/promises";
+import { mkdir as mkdir2, readFile as readFile2 } from "fs/promises";
 import { dirname as dirname2 } from "path";
 var FileAuditLog = class {
   filePath;
@@ -2179,8 +2284,15 @@ var FileAuditLog = class {
   async record(event) {
     try {
       await mkdir2(dirname2(this.filePath), { recursive: true });
-      await appendFile(this.filePath, `${JSON.stringify(event)}
+      const { open: open2 } = await import("fs/promises");
+      const handle = await open2(this.filePath, "a");
+      try {
+        await handle.appendFile(`${JSON.stringify(event)}
 `, "utf8");
+        await handle.sync();
+      } finally {
+        await handle.close();
+      }
     } catch (error) {
       this.log.warn(
         `Audit write failed: ${error instanceof Error ? error.message : String(error)}`
@@ -2189,7 +2301,6 @@ var FileAuditLog = class {
   }
   /** Recent events, oldest first; used by the CLI. */
   async recent(limit = 20) {
-    const { readFile: readFile2 } = await import("fs/promises");
     let raw;
     try {
       raw = await readFile2(this.filePath, "utf8");
@@ -3822,6 +3933,7 @@ function truncate3(text, max) {
 }
 
 // src/reports/service.ts
+var MAX_REPORT_BYTES = 256 * 1024;
 var ReportService = class {
   constructor(store, log = logger) {
     this.store = store;
@@ -3856,6 +3968,16 @@ var ReportService = class {
     const reports = [];
     const rejected = [];
     for (const candidate of candidates) {
+      const size = Buffer.byteLength(JSON.stringify(candidate), "utf8");
+      if (size > MAX_REPORT_BYTES) {
+        rejected.push({
+          key: candidate?.id ?? "(unknown)",
+          reason: `report exceeds the ${MAX_REPORT_BYTES} byte limit (${size} bytes)`,
+          issues: []
+        });
+        this.log.warn(`Rejected oversized report (${size} bytes).`);
+        continue;
+      }
       const result = validateReport(candidate);
       if (result.valid) {
         reports.push(result.report);
@@ -3976,9 +4098,59 @@ var ProjectStores = class {
     this.audit = new FileAuditLog(directory);
   }
 };
+var STORE_FILES = [
+  "tasks.json",
+  "pipelines.json",
+  "reports.json",
+  "plans.json",
+  "memory.json"
+];
+async function migrateProjectStores(directory = `${process.cwd()}/.omninode`, options = {}) {
+  const reports = [];
+  for (const file of STORE_FILES) {
+    const path = `${directory}/${file}`;
+    const state = await inspectDocument(path);
+    if (state.status === "missing") {
+      reports.push({ file, state: state.status, migrated: false });
+      continue;
+    }
+    if (state.status === "current") {
+      reports.push({ file, state: state.status, before: state.count, after: state.count, migrated: false });
+      continue;
+    }
+    if (state.status === "future") {
+      reports.push({
+        file,
+        state: state.status,
+        migrated: false,
+        note: `written by a newer OmniNode (schema v${state.schemaVersion}); not touched`
+      });
+      continue;
+    }
+    if (state.status === "corrupt") {
+      reports.push({ file, state: state.status, migrated: false, note: state.detail });
+      continue;
+    }
+    const items = await readDocument(path, void 0, false);
+    if (!options.checkOnly) {
+      await writeFileAtomic(path, `${JSON.stringify({ schemaVersion: SCHEMA_VERSION, items }, null, 2)}
+`);
+    }
+    const beforeCount = items.length;
+    reports.push({
+      file,
+      state: state.status,
+      before: beforeCount,
+      after: items.length,
+      migrated: !options.checkOnly,
+      ...options.checkOnly ? { note: "would migrate" } : {}
+    });
+  }
+  return reports;
+}
 
 // src/version.ts
-var OMNINODE_VERSION = "2.0.0-alpha.11";
+var OMNINODE_VERSION = "2.0.0-alpha.13";
 export {
   AgentAdapterRegistry,
   AgentError,
@@ -3997,6 +4169,7 @@ export {
   Logger,
   MAX_CONTEXT_CHARS,
   MAX_MESSAGE_BYTES,
+  MAX_REPORT_BYTES,
   MemoryError,
   MemoryService,
   ModelPlanner,
@@ -4020,6 +4193,8 @@ export {
   RememberaMemoryProvider,
   ReportService,
   RoleRegistry,
+  SCHEMA_VERSION,
+  STORE_FILES,
   SUPPORTED_PROTOCOL_VERSIONS,
   TERMINAL_TASK_STATUSES,
   TaskEngine,
@@ -4048,6 +4223,7 @@ export {
   defaultProjectConfigYaml,
   defaultSearch,
   describeExit,
+  describeSecretFindings,
   detectConflicts,
   encodeMessage,
   envelope,
@@ -4055,6 +4231,7 @@ export {
   extractMessage,
   extractReportFromText,
   findConfigFile,
+  inspectDocument,
   isNetworkError,
   isOmniNodeError,
   isRetryable,
@@ -4065,6 +4242,7 @@ export {
   kindFromStatus,
   loadConfig,
   logger,
+  migrateProjectStores,
   newMessageId,
   normalizeEvidence,
   normalizeFinding,
@@ -4079,6 +4257,7 @@ export {
   providerConfigSchema,
   providerHttpError,
   providerTransportError,
+  readDocument,
   registryKey,
   requestJson,
   requireCompletion,
@@ -4086,10 +4265,12 @@ export {
   resolveEnvPolicy,
   roleConfigSchema,
   sanitizeChunk,
+  scanForInlineSecrets,
   similar,
   validateEnvelope,
   validatePlan,
   validateReport,
-  validateWorkingDirectory
+  validateWorkingDirectory,
+  writeFileAtomic
 };
 //# sourceMappingURL=index.js.map