@hilbras/omninode 2.0.0-alpha.12 → 2.0.0-alpha.14

package/dist/cli/index.js

@@ -1,4 +1,21 @@
 #!/usr/bin/env node
+import {
+  AgentError,
+  ConfigError,
+  MemoryError,
+  OmniHilbrasProvider,
+  OmniNodeError,
+  PipelineError,
+  PlannerError,
+  ProviderError,
+  TaskError,
+  configureLogger,
+  createProvider,
+  isOmniNodeError,
+  logger,
+  requestJson,
+  resolveApiKey
+} from "./chunk-6Z6O63SS.js";
 
 // src/cli/index.ts
 import { pathToFileURL } from "url";
@@ -6,60 +23,7 @@ import { realpathSync } from "fs";
 import { Command } from "commander";
 
 // src/version.ts
-var OMNINODE_VERSION = "2.0.0-alpha.12";
-
-// src/errors/index.ts
-var OmniNodeError = class extends Error {
-  code;
-  details;
-  constructor(code, message, options = {}) {
-    super(message, { cause: options.cause });
-    this.name = new.target.name;
-    this.code = code;
-    this.details = options.details;
-  }
-};
-var ConfigError = class extends OmniNodeError {
-  constructor(code, message, options = {}) {
-    super(code, message, options);
-  }
-};
-var ProviderError = class extends OmniNodeError {
-  constructor(code, message, options = {}) {
-    super(code, message, options);
-  }
-};
-var AgentError = class extends OmniNodeError {
-  constructor(code, message, options = {}) {
-    super(code, message, options);
-  }
-};
-var TaskError = class extends OmniNodeError {
-  constructor(code, message, options = {}) {
-    super(code, message, options);
-  }
-};
-var PipelineError = class extends OmniNodeError {
-  constructor(code, message, options = {}) {
-    super(code, message, options);
-  }
-};
-var PlannerError = class extends OmniNodeError {
-  constructor(code, message, options = {}) {
-    super(code, message, options);
-  }
-};
-var MemoryError = class extends OmniNodeError {
-  constructor(message, options = {}) {
-    super("MEMORY_UNAVAILABLE", message, options);
-  }
-};
-function isOmniNodeError(value) {
-  return value instanceof OmniNodeError;
-}
-
-// src/cli/commands/init.ts
-import { existsSync as existsSync2, writeFileSync } from "fs";
+var OMNINODE_VERSION = "2.0.0-alpha.14";
 
 // src/config/schema.ts
 import { z } from "zod";
@@ -142,9 +106,45 @@ var projectConfigSchema = z.object({
 }).strict();
 var appConfigSchema = z.object({
   project: projectConfigSchema,
-  logging: z.object({ level: z.enum(["debug", "info", "warn", "error"]) }).strict().optional()
+  logging: z.object({
+    level: z.enum(["debug", "info", "warn", "error"]),
+    format: z.enum(["text", "json"]).optional()
+  }).strict().optional()
 }).strict();
 
+// src/config/secrets.ts
+var SAFE_KEY_SUFFIXES = ["_env", "_env_var", "_file", "_path", "_ref", "_id", "_url", "_command"];
+var SECRET_KEY = /^\s*([A-Za-z0-9_-]*(?:api[_-]?key|token|password|passwd|secret|credential)[A-Za-z0-9_-]*)\s*:\s*(.*)$/i;
+var SAFE_VALUE = /^\s*(?:\$\{[^}]*\}|\$[A-Z_][A-Z0-9_]*|<[^>]*>|""|''|null|~)\s*$/i;
+function scanForInlineSecrets(source) {
+  const findings = [];
+  source.split("\n").forEach((line, index) => {
+    const trimmed = line.trim();
+    if (trimmed.startsWith("#")) return;
+    const match = SECRET_KEY.exec(line);
+    if (!match) return;
+    const key = match[1] ?? "";
+    const rawValue = (match[2] ?? "").trim().replace(/,\s*$/, "");
+    const keyIsReference = SAFE_KEY_SUFFIXES.some((suffix) => key.toLowerCase().endsWith(suffix));
+    if (keyIsReference) return;
+    const value = rawValue.replace(/^["']|["']$/g, "");
+    if (value.length === 0 || SAFE_VALUE.test(rawValue)) return;
+    if (value.length < 8) return;
+    findings.push({
+      line: index + 1,
+      key,
+      excerpt: `${key}: ${value.slice(0, 3)}\u2026 (${value.length} chars, redacted)`
+    });
+  });
+  return findings;
+}
+function describeSecretFindings(file, findings) {
+  const lines = findings.map((f) => `  line ${f.line}: ${f.excerpt}`).join("\n");
+  return `${file} appears to contain ${findings.length} inline secret(s):
+${lines}
+OmniNode never stores credentials in configuration. Replace each value with an environment-variable reference, e.g. api_key_env_var: MY_API_KEY.`;
+}
+
 // src/config/loader.ts
 import { existsSync, readFileSync } from "fs";
 import { parse as parseYaml } from "yaml";
@@ -181,6 +181,10 @@ function loadConfig(options = {}) {
     );
   }
   const raw = readFileSync(path, "utf8");
+  const secretFindings = scanForInlineSecrets(raw);
+  if (secretFindings.length > 0) {
+    throw new ConfigError("CONFIG_INVALID", describeSecretFindings(path, secretFindings));
+  }
   const expanded = expandEnvRefs(raw, env, path);
   let data;
   try {
@@ -327,6 +331,7 @@ function defaultProjectConfigYaml(projectName = "My Project") {
 }
 
 // src/cli/commands/init.ts
+import { existsSync as existsSync2, writeFileSync } from "fs";
 async function runInit(options) {
   const target = `${process.cwd()}/omninode.yaml`;
   if (!options.force && existsSync2(target)) {
@@ -352,578 +357,6 @@ function registerProjectCommands(program) {
   project.command("init").description("Alias of `omninode init`.").option("-f, --force", "Overwrite an existing omninode.yaml.").option("-n, --name <name>", "Project name to write into the configuration.", "My Project").action(async (options) => runInit(options));
 }
 
-// src/providers/auth.ts
-function resolveApiKey(config, env = process.env) {
-  if (!config.apiKeyEnvVar) return void 0;
-  const value = env[config.apiKeyEnvVar];
-  if (!value) {
-    throw new ProviderError(
-      "PROVIDER_AUTH_FAILED",
-      `Environment variable "${config.apiKeyEnvVar}" (referenced by provider "${config.name}") is not set.`
-    );
-  }
-  return value;
-}
-function authHeaders(config, env = process.env) {
-  const key = resolveApiKey(config, env);
-  const base = { ...config.headers ?? {} };
-  return key ? { ...base, authorization: `Bearer ${key}` } : base;
-}
-
-// src/providers/http.ts
-var HttpResponseError = class extends Error {
-  constructor(message, status, cause) {
-    super(message, { cause });
-    this.status = status;
-    this.name = "HttpResponseError";
-  }
-  status;
-};
-var DEFAULT_TIMEOUT_MS = 3e4;
-async function requestJson(url, options = {}) {
-  const { method = "GET", headers = {}, body, timeoutMs = DEFAULT_TIMEOUT_MS } = options;
-  const response = await fetch(url, {
-    method,
-    headers: {
-      accept: "application/json",
-      ...body !== void 0 ? { "content-type": "application/json" } : {},
-      ...headers
-    },
-    ...body !== void 0 ? { body: JSON.stringify(body) } : {},
-    signal: AbortSignal.timeout(timeoutMs)
-  });
-  let parsed;
-  try {
-    parsed = await response.json();
-  } catch (error) {
-    throw new HttpResponseError(`Response from ${url} was not valid JSON.`, response.status, error);
-  }
-  return { status: response.status, body: parsed };
-}
-
-// src/logger/index.ts
-var LEVEL_ORDER = {
-  debug: 10,
-  info: 20,
-  warn: 30,
-  error: 40
-};
-var ConsoleLogSink = class {
-  constructor(stream = process.stderr) {
-    this.stream = stream;
-  }
-  stream;
-  write(_level, line) {
-    this.stream.write(line + "\n");
-  }
-};
-var Logger = class _Logger {
-  level;
-  sink;
-  context;
-  constructor(options = {}) {
-    this.level = options.level ?? "info";
-    this.sink = options.sink ?? new ConsoleLogSink();
-    this.context = options.context ?? {};
-  }
-  child(context) {
-    return new _Logger({
-      level: this.level,
-      sink: this.sink,
-      context: { ...this.context, ...context }
-    });
-  }
-  debug(message, data) {
-    this.log("debug", message, data);
-  }
-  info(message, data) {
-    this.log("info", message, data);
-  }
-  warn(message, data) {
-    this.log("warn", message, data);
-  }
-  error(message, data) {
-    this.log("error", message, data);
-  }
-  log(level, message, data) {
-    if (LEVEL_ORDER[level] < LEVEL_ORDER[this.level]) return;
-    const parts = [(/* @__PURE__ */ new Date()).toISOString(), level.toUpperCase(), message];
-    const merged = { ...this.context, ...data };
-    if (Object.keys(merged).length > 0) {
-      parts.push(JSON.stringify(merged));
-    }
-    this.sink.write(level, parts.join(" "));
-  }
-};
-var logger = new Logger();
-
-// src/providers/errors.ts
-function kindToCode(kind) {
-  switch (kind) {
-    case "AUTHENTICATION_ERROR":
-      return "PROVIDER_AUTH_FAILED";
-    case "MODEL_NOT_FOUND":
-      return "MODEL_NOT_FOUND";
-    default:
-      return "PROVIDER_UNAVAILABLE";
-  }
-}
-function isRetryable(kind) {
-  return kind === "RATE_LIMIT_ERROR" || kind === "SERVER_ERROR" || kind === "NETWORK_ERROR";
-}
-function kindFromStatus(status) {
-  if (status === 401 || status === 403) return "AUTHENTICATION_ERROR";
-  if (status === 429) return "RATE_LIMIT_ERROR";
-  if (status === 404) return "MODEL_NOT_FOUND";
-  if (status === 408 || status === 504) return "TIMEOUT";
-  if (status >= 500) return "SERVER_ERROR";
-  if (status >= 400) return "INVALID_REQUEST";
-  return "UNKNOWN_ERROR";
-}
-function extractMessage(body) {
-  if (body === null || typeof body !== "object") return void 0;
-  const root = body;
-  const error = root.error ?? root;
-  const message = error.message ?? error.detail ?? root.message;
-  return typeof message === "string" ? message : void 0;
-}
-function parseRetryAfter(value, now = Date.now()) {
-  if (!value) return void 0;
-  const seconds = Number(value);
-  if (Number.isFinite(seconds)) return Math.max(0, seconds * 1e3);
-  const date = Date.parse(value);
-  return Number.isNaN(date) ? void 0 : Math.max(0, date - now);
-}
-function isTimeoutError(error) {
-  return error instanceof Error && (error.name === "TimeoutError" || error.name === "AbortError") || typeof error?.code === "string" && error.code === "ABORT_ERR";
-}
-function fallbackMessage(kind, context, status) {
-  const { provider, operation } = context;
-  switch (kind) {
-    case "AUTHENTICATION_ERROR":
-      return `Authentication with provider "${provider}" failed (HTTP ${status}). Check that the referenced API key is set and valid.`;
-    case "RATE_LIMIT_ERROR":
-      return `Provider "${provider}" rate-limited ${operation} (HTTP ${status}). Retry later.`;
-    case "MODEL_NOT_FOUND":
-      return `Provider "${provider}" does not expose the requested model (HTTP ${status}).`;
-    case "TIMEOUT":
-      return `Provider "${provider}" timed out during ${operation} (HTTP ${status}).`;
-    case "SERVER_ERROR":
-      return `Provider "${provider}" returned a server error during ${operation} (HTTP ${status}).`;
-    case "INVALID_REQUEST":
-      return `Provider "${provider}" rejected ${operation} as invalid (HTTP ${status}).`;
-    default:
-      return `Provider "${provider}" failed during ${operation} (HTTP ${status}).`;
-  }
-}
-function providerHttpError(context) {
-  const status = context.status ?? 0;
-  const kind = kindFromStatus(status);
-  const detail = extractMessage(context.body);
-  const retryAfterMs = context.retryAfterMs ?? parseRetryAfter(void 0);
-  return new ProviderError(
-    context.code ?? kindToCode(kind),
-    detail ?? fallbackMessage(kind, context, status),
-    {
-      cause: context.cause,
-      details: {
-        kind,
-        provider: context.provider,
-        operation: context.operation,
-        status,
-        retryable: isRetryable(kind),
-        ...retryAfterMs !== void 0 ? { retryAfterMs } : {},
-        ...detail ? { providerMessage: detail } : {}
-      }
-    }
-  );
-}
-function providerTransportError(context) {
-  const cause = context.cause;
-  const kind = isTimeoutError(cause) ? "TIMEOUT" : cause instanceof SyntaxError || cause?.name === "HttpResponseError" ? "UNKNOWN_ERROR" : "NETWORK_ERROR";
-  const message = context.cause instanceof Error ? context.cause.message : String(context.cause);
-  return new ProviderError("PROVIDER_UNAVAILABLE", `Provider request failed: ${message}`, {
-    cause: context.cause,
-    details: {
-      kind,
-      provider: context.provider,
-      operation: context.operation,
-      retryable: isRetryable(kind)
-    }
-  });
-}
-
-// src/providers/openai-compatible/index.ts
-var DEFAULT_REQUEST_TIMEOUT_MS = 3e4;
-var OpenAICompatibleProvider = class {
-  config;
-  providerId;
-  authentication;
-  log;
-  /** Discovered models, so getModel() answers without another round-trip. */
-  discovered;
-  env;
-  constructor(config, log = logger, env = process.env) {
-    this.config = { ...config, baseUrl: normalizeBaseUrl(config.baseUrl) };
-    this.env = env;
-    this.providerId = config.providerId ?? config.name;
-    this.authentication = {
-      method: config.apiKeyEnvVar ? "bearer" : "none",
-      ...config.apiKeyEnvVar ? { envVar: config.apiKeyEnvVar } : {},
-      configured: config.apiKeyEnvVar ? Boolean(env[config.apiKeyEnvVar]) : true
-    };
-    this.log = log.child({ provider: config.name });
-  }
-  /** Provider-level request timeout (roadmap §6.6/§11) with the shared default. */
-  get requestTimeoutMs() {
-    return this.config.timeoutMs ?? DEFAULT_REQUEST_TIMEOUT_MS;
-  }
-  /** Authenticate + discover (roadmap §10, Model Discovery). */
-  async connect() {
-    authHeaders(this.config, this.env);
-    const models = await this.listModels();
-    this.discovered = models;
-    return models;
-  }
-  async getModel(modelId) {
-    const models = this.discovered ?? await this.connect();
-    return models.find((m) => m.id === modelId);
-  }
-  /** Raw /models body (protected so adapters can capture gateway-level metadata). */
-  async rawModelsResponse() {
-    const response = await this.modelsRequest();
-    return response.body;
-  }
-  async modelsRequest() {
-    let response;
-    try {
-      response = await requestJson(`${this.config.baseUrl}/models`, {
-        headers: authHeaders(this.config, this.env),
-        timeoutMs: this.requestTimeoutMs
-      });
-    } catch (error) {
-      if (error instanceof ProviderError) throw error;
-      throw providerTransportError({ provider: this.config.name, operation: "listModels", cause: error });
-    }
-    const { status, body } = response;
-    if (status !== 200) {
-      throw providerHttpError({
-        provider: this.config.name,
-        operation: "listModels",
-        status,
-        body
-      });
-    }
-    return response;
-  }
-  async listModels() {
-    const body = await this.rawModelsResponse();
-    const entries = extractModelEntries(body, this.config);
-    const models = [];
-    let skipped = 0;
-    for (const entry2 of entries) {
-      if (typeof entry2.id !== "string" || entry2.id.length === 0) {
-        skipped += 1;
-        continue;
-      }
-      models.push(this.toModelInfo(entry2));
-    }
-    if (skipped > 0) {
-      this.log.warn(`Skipped ${skipped} model entr(y/ies) without a valid id.`);
-    }
-    return models;
-  }
-  /** Maps a raw model entry onto the normalized metadata shape (§10). */
-  toModelInfo(entry2) {
-    const parameters = Array.isArray(entry2.supported_parameters) ? entry2.supported_parameters.filter((p) => typeof p === "string") : void 0;
-    const contextWindow = typeof entry2.context_length === "number" ? entry2.context_length : typeof entry2.context_window === "number" ? entry2.context_window : void 0;
-    const inputTypes = normalizeModalities(entry2.input_modalities);
-    const outputTypes = normalizeModalities(entry2.output_modalities);
-    return {
-      provider: this.config.name,
-      id: entry2.id,
-      displayName: entry2.id,
-      ...typeof entry2.name === "string" ? { name: entry2.name } : {},
-      status: "available",
-      ...contextWindow !== void 0 ? { contextWindow } : {},
-      ...inputTypes !== void 0 ? { inputTypes } : {},
-      ...outputTypes !== void 0 ? { outputTypes } : {},
-      ...parameters !== void 0 ? {
-        supportsTools: parameters.includes("tools") || parameters.includes("tool_choice"),
-        supportsStructuredOutput: parameters.includes("response_format"),
-        supportsStreaming: parameters.includes("stream")
-      } : {},
-      metadata: {
-        ...typeof entry2.owned_by === "string" ? { ownedBy: entry2.owned_by } : {},
-        ...typeof entry2.created === "number" ? { createdAt: entry2.created } : {},
-        ...parameters !== void 0 ? { supportedParameters: parameters } : {}
-      }
-    };
-  }
-  /** Streaming where the gateway supports it (§11). */
-  stream(request, onChunk) {
-    return streamChatCompletion(this.config, request, onChunk, this.env);
-  }
-  async healthCheck() {
-    const lastCheckedAt = (/* @__PURE__ */ new Date()).toISOString();
-    try {
-      const started = Date.now();
-      const models = await this.listModels();
-      return {
-        name: this.config.name,
-        type: this.config.type,
-        baseUrl: this.config.baseUrl,
-        health: "healthy",
-        connected: true,
-        modelCount: models.length,
-        lastCheckedAt,
-        message: `Discovered ${models.length} model(s) in ${Date.now() - started}ms.`
-      };
-    } catch (error) {
-      return {
-        name: this.config.name,
-        type: this.config.type,
-        baseUrl: this.config.baseUrl,
-        health: inferHealth(error),
-        connected: false,
-        modelCount: 0,
-        lastCheckedAt,
-        message: error instanceof Error ? error.message : String(error)
-      };
-    }
-  }
-  async chat(request) {
-    let response;
-    try {
-      response = await requestJson(`${this.config.baseUrl}/chat/completions`, {
-        method: "POST",
-        headers: authHeaders(this.config, this.env),
-        timeoutMs: this.requestTimeoutMs,
-        body: {
-          model: request.model,
-          messages: request.messages,
-          ...request.temperature !== void 0 ? { temperature: request.temperature } : {},
-          ...request.maxTokens !== void 0 ? { max_tokens: request.maxTokens } : {},
-          ...request.stop !== void 0 ? { stop: request.stop } : {}
-        }
-      });
-    } catch (error) {
-      if (error instanceof ProviderError) throw error;
-      throw providerTransportError({ provider: this.config.name, operation: "chat", cause: error });
-    }
-    const { status, body } = response;
-    if (status !== 200) {
-      throw providerHttpError({
-        provider: this.config.name,
-        operation: "chat",
-        status,
-        body,
-        ...status === 404 ? {
-          code: "MODEL_NOT_FOUND"
-        } : {}
-      });
-    }
-    const payload = body;
-    const choices = Array.isArray(payload.choices) ? payload.choices : [];
-    const first = choices[0];
-    if (!first || typeof first.message?.content !== "string") {
-      throw unavailable(this.config, "Chat completion response had no message content.", status);
-    }
-    const usage = payload.usage ?? {};
-    return {
-      model: typeof payload.model === "string" ? payload.model : request.model,
-      content: first.message.content,
-      finishReason: typeof first.finish_reason === "string" ? first.finish_reason : void 0,
-      usage: {
-        promptTokens: typeof usage.prompt_tokens === "number" ? usage.prompt_tokens : void 0,
-        completionTokens: typeof usage.completion_tokens === "number" ? usage.completion_tokens : void 0,
-        totalTokens: typeof usage.total_tokens === "number" ? usage.total_tokens : void 0
-      },
-      raw: body
-    };
-  }
-};
-async function streamChatCompletion(config, request, onChunk, env = process.env) {
-  const baseUrl = normalizeBaseUrl(config.baseUrl);
-  const timeoutMs = config.timeoutMs ?? DEFAULT_REQUEST_TIMEOUT_MS;
-  let response;
-  try {
-    response = await fetch(`${baseUrl}/chat/completions`, {
-      method: "POST",
-      headers: {
-        accept: "text/event-stream",
-        "content-type": "application/json",
-        ...authHeaders(config, env)
-      },
-      body: JSON.stringify({
-        model: request.model,
-        messages: request.messages,
-        stream: true,
-        ...request.temperature !== void 0 ? { temperature: request.temperature } : {},
-        ...request.maxTokens !== void 0 ? { max_tokens: request.maxTokens } : {}
-      }),
-      signal: AbortSignal.timeout(timeoutMs)
-    });
-  } catch (error) {
-    throw providerTransportError({ provider: config.name, operation: "stream", cause: error });
-  }
-  if (!response.ok) {
-    const body = await response.json().catch(() => void 0);
-    throw providerHttpError({ provider: config.name, operation: "stream", status: response.status, body });
-  }
-  if (!response.body) {
-    throw providerHttpError({
-      provider: config.name,
-      operation: "stream",
-      status: 500,
-      body: { error: { message: "streaming is not supported by this endpoint" } }
-    });
-  }
-  let content = "";
-  let model = request.model;
-  let finishReason;
-  const decoder = new TextDecoder();
-  let buffer = "";
-  for await (const piece of response.body) {
-    buffer += decoder.decode(piece, { stream: true });
-    let newline = buffer.indexOf("\n");
-    while (newline >= 0) {
-      const line = buffer.slice(0, newline).trim();
-      buffer = buffer.slice(newline + 1);
-      newline = buffer.indexOf("\n");
-      if (line.length === 0 || line.startsWith(":")) continue;
-      const data = line.startsWith("data:") ? line.slice(5).trim() : line;
-      if (data === "[DONE]") continue;
-      let event;
-      try {
-        event = JSON.parse(data);
-      } catch {
-        continue;
-      }
-      if (typeof event.model === "string") model = event.model;
-      const choices = Array.isArray(event.choices) ? event.choices : [];
-      const first = choices[0];
-      const delta = typeof first?.delta?.content === "string" ? first.delta.content : "";
-      if (delta.length > 0) content += delta;
-      if (typeof first?.finish_reason === "string") finishReason = first.finish_reason;
-      onChunk({ delta, ...finishReason !== void 0 ? { finishReason } : {}, raw: event });
-    }
-  }
-  return { model, content, ...finishReason !== void 0 ? { finishReason } : {} };
-}
-function normalizeModalities(value) {
-  const list = Array.isArray(value) ? value : typeof value === "string" ? [value] : void 0;
-  if (!list) return void 0;
-  const allowed = /* @__PURE__ */ new Set(["text", "image", "audio", "video", "embedding"]);
-  const modalities = list.filter((m) => typeof m === "string" && allowed.has(m));
-  return modalities.length > 0 ? modalities : void 0;
-}
-function normalizeBaseUrl(baseUrl) {
-  return baseUrl.replace(/\/+$/, "");
-}
-function extractModelEntries(body, config) {
-  if (Array.isArray(body)) return body;
-  if (body !== null && typeof body === "object" && Array.isArray(body.data)) {
-    return body.data;
-  }
-  throw new ProviderError(
-    "PROVIDER_UNAVAILABLE",
-    `Provider "${config.name}" returned an unrecognized model list shape.`,
-    { details: { endpoint: "models" } }
-  );
-}
-function unavailable(config, message, status) {
-  return new ProviderError("PROVIDER_UNAVAILABLE", `Provider "${config.name}": ${message}`, {
-    details: { status }
-  });
-}
-function inferHealth(error) {
-  const status = error instanceof ProviderError && typeof error.details?.status === "number" ? error.details.status : void 0;
-  return status !== void 0 && status >= 500 ? "degraded" : "unreachable";
-}
-
-// src/providers/omnihilbras/index.ts
-var OmniHilbrasProvider = class extends OpenAICompatibleProvider {
-  gateway;
-  async listModels() {
-    const raw = await this.rawModelsResponse();
-    await this.extractGatewayMetadata(raw);
-    const models = await super.listModels();
-    return this.gateway ? models.map((model) => ({ ...model, metadata: { ...model.metadata, gateway: this.gateway } })) : models;
-  }
-  /**
-   * Run the full connect flow. Throws on authentication or transport failure
-   * (use healthCheck() for a non-throwing probe).
-   */
-  /**
-   * Gateway metadata reported alongside the model list (gateway version, tier,
-   * region…), kept separate from per-model metadata (§11 — provider metadata).
-   */
-  gatewayMetadata() {
-    return this.gateway;
-  }
-  async extractGatewayMetadata(body) {
-    if (body !== null && typeof body === "object") {
-      const gateway = body.gateway;
-      if (gateway !== null && typeof gateway === "object") {
-        this.gateway = gateway;
-      }
-    }
-  }
-  async connectAndRegister(registry) {
-    const apiKey = resolveApiKey(this.config);
-    const discovered = await this.listModels();
-    const seen = /* @__PURE__ */ new Set();
-    const models = [];
-    const duplicates = [];
-    for (const model of discovered) {
-      if (seen.has(model.id)) {
-        duplicates.push(model.id);
-        continue;
-      }
-      seen.add(model.id);
-      models.push({
-        ...model,
-        provider: this.config.name,
-        status: "available",
-        metadata: { ...model.metadata, gateway: "omnihilbras" }
-      });
-    }
-    if (registry) {
-      for (const model of models) registry.register(model);
-    }
-    const message = `Authenticated${apiKey ? " with API key" : " (no API key configured)"}; validated ${models.length} unique model(s)` + (duplicates.length > 0 ? `, skipped ${duplicates.length} duplicate(s)` : "") + ".";
-    const status = {
-      name: this.config.name,
-      type: this.config.type,
-      baseUrl: this.config.baseUrl,
-      health: "healthy",
-      connected: true,
-      modelCount: models.length,
-      lastCheckedAt: (/* @__PURE__ */ new Date()).toISOString(),
-      message
-    };
-    return { status, models, duplicates, registered: registry ? models.length : 0 };
-  }
-};
-
-// src/providers/factory.ts
-var OPENAI_COMPATIBLE_TYPES = [
-  "openai-compatible",
-  "openrouter",
-  "local",
-  "custom"
-];
-function createProvider(config) {
-  if (config.type === "omnihilbras") {
-    return new OmniHilbrasProvider(config);
-  }
-  if (OPENAI_COMPATIBLE_TYPES.includes(config.type)) {
-    return new OpenAICompatibleProvider(config);
-  }
-  throw new OmniNodeError("NOT_IMPLEMENTED", `Provider type "${config.type}" has no adapter yet.`);
-}
-
 // src/registry/index.ts
 function registryKey(provider, id) {
   return `${provider}:${id}`;
@@ -1008,183 +441,24 @@ function appendToConfigList(listKey, item) {
   return configPath;
 }
 
-// src/cli/commands/providers.ts
-function registerProviderCommands(program) {
-  const provider = program.command("provider").description("Manage AI providers configured in omninode.yaml.");
-  provider.command("list").description("List configured providers.").action(async () => {
-    const config = loadConfig();
-    const providers = config.project.providers;
-    if (providers.length === 0) {
-      console.log(
-        "No providers configured. Add one with `omninode provider add` or edit omninode.yaml."
-      );
-      return;
-    }
-    for (const provider2 of providers) {
-      const key = provider2.apiKeyEnvVar ? `$${provider2.apiKeyEnvVar}` : "none";
-      const enabled = provider2.enabled === false ? "  (disabled)" : "";
-      console.log(
-        `${provider2.name}  type=${provider2.type}  base_url=${provider2.baseUrl}  key=${key}${enabled}`
-      );
-    }
-  });
-  provider.command("add").description(
-    "Add a provider to omninode.yaml. OpenAI-compatible gateways (including OpenRouter and local runtimes) are supported today; OmniHilbras gets its own adapter in Phase 2."
-  ).requiredOption("--name <name>", "Unique provider name used in configuration and the model registry.").requiredOption("--base-url <url>", "Provider base URL, e.g. https://example.com/v1").option(
-    "--type <type>",
-    "Provider type: openai-compatible, omnihilbras, openrouter, local or custom.",
-    "openai-compatible"
-  ).option(
-    "--api-key-env-var <envVar>",
-    "Environment variable holding the API key. Keys are never written to the config file."
-  ).action(async (options) => addProvider(options));
-  provider.command("test <name>").description("Test connectivity, authentication and model discovery for a configured provider.").option(
-    "--connect",
-    "Run the full provider connect flow (authenticate, fetch, validate, register) where the adapter supports it."
-  ).action(async (name, options) => testProvider(name, options));
-  provider.command("remove <name>").description("Remove a provider (planned for Phase 1 follow-up).").action(() => {
-    throw notImplemented("omninode provider remove", "a Phase 1 follow-up");
-  });
+// src/agents/process/index.ts
+import { spawn } from "child_process";
+
+// src/agent-protocol/version.ts
+var PROTOCOL_V2 = "omninode-agent-protocol/2";
+var SUPPORTED_PROTOCOL_VERSIONS = [
+  "omninode-agent-protocol/1",
+  PROTOCOL_V2
+];
+var MAX_MESSAGE_BYTES = 1048576;
+function isSupportedProtocol(protocol) {
+  return SUPPORTED_PROTOCOL_VERSIONS.includes(protocol);
 }
-async function addProvider(options) {
-  const configPath = findConfigFile();
-  if (!configPath) {
-    throw new OmniNodeError("CONFIG_NOT_FOUND", "No omninode.yaml found. Run `omninode init` first.");
-  }
-  const candidate = providerConfigSchema.safeParse({
-    name: options.name,
-    type: options.type,
-    base_url: options.baseUrl,
-    ...options.apiKeyEnvVar !== void 0 ? { api_key_env_var: options.apiKeyEnvVar } : {}
-  });
-  if (!candidate.success) {
-    const issues = candidate.error.issues.map((issue) => `${issue.path.join(".") || "(root)"}: ${issue.message}`).join("; ");
-    throw new OmniNodeError("CLI_USAGE", `Invalid provider options: ${issues}`);
-  }
-  const newProvider = candidate.data;
-  const existing = loadConfig();
-  if (existing.project.providers.some((p) => p.name === newProvider.name)) {
-    throw new OmniNodeError(
-      "CLI_USAGE",
-      `Provider "${newProvider.name}" already exists in ${findConfigFile() ?? "omninode.yaml"}.`
-    );
-  }
-  const writtenPath = appendToConfigList("providers", newProvider);
-  console.log(`Added provider "${newProvider.name}" (${newProvider.type}) to ${writtenPath}.`);
-  if (newProvider.api_key_env_var) {
-    console.log(
-      `Set $${newProvider.api_key_env_var} in your environment, then run: omninode provider test ${newProvider.name}`
-    );
-  } else {
-    console.log(`Run \`omninode provider test ${newProvider.name}\` to verify connectivity.`);
-  }
-}
-async function testProvider(name, options = {}) {
-  const config = loadConfig();
-  const providerConfig = config.project.providers.find((p) => p.name === name);
-  if (!providerConfig) {
-    const available = config.project.providers.map((p) => p.name).join(", ") || "(none)";
-    throw new ProviderError(
-      "PROVIDER_NOT_FOUND",
-      `Provider "${name}" is not configured. Configured providers: ${available}.`
-    );
-  }
-  const provider = createProvider(providerConfig);
-  console.log(`Testing provider "${name}" (${providerConfig.type}) at ${provider.config.baseUrl}`);
-  if (options.connect && provider instanceof OmniHilbrasProvider) {
-    const registry = new ModelRegistry();
-    try {
-      const result = await provider.connectAndRegister(registry);
-      printProviderStatus(result.status);
-      console.log(`  registered: ${result.registered}`);
-    } catch (error) {
-      console.log(`  connect failed: ${error instanceof Error ? error.message : String(error)}`);
-      process.exitCode = 1;
-    }
-    return;
-  }
-  const health = await provider.healthCheck();
-  printProviderStatus(health);
-  if (!health.connected) process.exitCode = 1;
-}
-function printProviderStatus(status) {
-  console.log(`  health:    ${status.health}`);
-  console.log(`  connected: ${status.connected}`);
-  console.log(`  models:    ${status.modelCount}`);
-  if (status.message) console.log(`  detail:    ${status.message}`);
-}
-
-// src/cli/commands/models.ts
-var CAPABILITIES = [
-  "chat",
-  "coding",
-  "tools",
-  "vision",
-  "embeddings"
-];
-function registerModelsCommand(program) {
-  program.command("models").description("Discover and list models from configured providers (model registry, \xA78).").argument("[provider]", "Only discover from this provider.").option("-c, --capability <capability>", `Filter by capability: ${CAPABILITIES.join(", ")}.`).action(async (providerName, options) => {
-    const capability = options.capability;
-    if (capability !== void 0 && !CAPABILITIES.includes(capability)) {
-      throw new OmniNodeError(
-        "CLI_USAGE",
-        `Unknown capability "${options.capability}". Valid capabilities: ${CAPABILITIES.join(", ")}.`
-      );
-    }
-    const config = loadConfig();
-    const selected = config.project.providers.filter(
-      (p) => providerName ? p.name === providerName : true
-    );
-    if (selected.length === 0) {
-      throw new OmniNodeError(
-        "PROVIDER_NOT_FOUND",
-        providerName ? `Provider "${providerName}" is not configured.` : "No providers configured. Add one with `omninode provider add`."
-      );
-    }
-    const registry = new ModelRegistry();
-    for (const providerConfig of selected) {
-      try {
-        const provider = createProvider(providerConfig);
-        const discovered = await registry.discoverFrom(provider);
-        console.log(`${providerConfig.name}: ${discovered.length} model(s)`);
-      } catch (error) {
-        const message = error instanceof Error ? error.message : String(error);
-        console.log(`${providerConfig.name}: discovery failed \u2014 ${message}`);
-      }
-    }
-    const models = registry.list({
-      ...providerName !== void 0 ? { provider: providerName } : {},
-      ...capability !== void 0 ? { capability } : {}
-    });
-    if (models.length === 0) {
-      console.log("No models found.");
-      return;
-    }
-    console.log("");
-    for (const model of models) {
-      console.log(`${model.provider}:${model.id}`);
-    }
-  });
-}
-
-// src/agents/process/index.ts
-import { spawn } from "child_process";
-
-// src/agent-protocol/version.ts
-var PROTOCOL_V2 = "omninode-agent-protocol/2";
-var SUPPORTED_PROTOCOL_VERSIONS = [
-  "omninode-agent-protocol/1",
-  PROTOCOL_V2
-];
-var MAX_MESSAGE_BYTES = 1048576;
-function isSupportedProtocol(protocol) {
-  return SUPPORTED_PROTOCOL_VERSIONS.includes(protocol);
-}
-
-// src/agent-protocol/types.ts
-function newMessageId(prefix = "msg") {
-  const random = Math.random().toString(36).slice(2, 10);
-  return `${prefix}-${Date.now().toString(36)}-${random}`;
+
+// src/agent-protocol/types.ts
+function newMessageId(prefix = "msg") {
+  const random = Math.random().toString(36).slice(2, 10);
+  return `${prefix}-${Date.now().toString(36)}-${random}`;
 }
 function envelope(type, payload, ids = {}) {
   return {
@@ -1576,7 +850,7 @@ function buildChildEnv(config) {
 }
 
 // src/agents/process/index.ts
-var DEFAULT_TIMEOUT_MS2 = 6e5;
+var DEFAULT_TIMEOUT_MS = 6e5;
 var KILL_GRACE_MS = 5e3;
 var DEFAULT_MAX_OUTPUT_BYTES = 5 * 1024 * 1024;
 function composeTaskText(input) {
@@ -1639,7 +913,7 @@ var ProcessAgent = class {
       throw new AgentError("AGENT_NOT_FOUND", `Agent "${this.config.name}" has no command configured.`);
     }
     const mode = this.config.inputMode ?? "stdin";
-    const timeoutMs = this.config.timeoutMs ?? DEFAULT_TIMEOUT_MS2;
+    const timeoutMs = this.config.timeoutMs ?? DEFAULT_TIMEOUT_MS;
     return new Promise((resolve2, reject) => {
       let cwd;
       try {
@@ -1998,138 +1272,57 @@ function buildAgentRegistry(config, log = logger) {
   return registry;
 }
 
-// src/cli/commands/agents.ts
-var collectArgs = (value, previous) => [...previous, value];
-function registerAgentCommands(program) {
-  const agent = program.command("agent").description("Manage CLI agents registered with OmniNode.");
-  agent.command("list").description("List configured agents.").action(async () => {
-    const config = loadConfig();
-    const agents = config.project.agents;
-    if (agents.length === 0) {
-      console.log("No agents configured. Add one with `omninode agent add` or edit omninode.yaml.");
-      return;
-    }
-    for (const agent2 of agents) {
-      const command = agent2.command ?? "(no command)";
-      console.log(
-        `${agent2.name}  integration=${agent2.integration}  command=${command}  input=${agent2.inputMode ?? "stdin"}`
-      );
-    }
-  });
-  agent.command("add").description(
-    "Register a CLI agent in omninode.yaml. Agents run as child processes (stdin/stdout); native adapters come in a later phase."
-  ).requiredOption("--name <name>", "Unique agent name.").requiredOption("--command <command>", "Executable command, e.g. opencode").option("--arg <value>", "Additional command argument (repeatable).", collectArgs, []).option("--cwd <dir>", "Working directory for the agent process.").option(
-    "--input-mode <mode>",
-    "How the task is delivered: stdin (prompt on stdin), arg (prompt as last argument) or protocol (\xA721 JSON-lines task protocol).",
-    "stdin"
-  ).option("--env-policy <policy>", "Environment policy: inherit, allowlist, denylist or explicit.").option("--allow-env <name>", "Variable to forward under the allowlist policy (repeatable).", collectArgs).option("--deny-env <name>", "Variable to remove under the denylist policy (repeatable).", collectArgs).option("--max-output-bytes <n>", "Per-stream output budget in bytes (default 5 MiB).", (value) => Number(value)).option("--allow-external-cwd", "Allow a working directory outside the project root.").option(
-    "--timeout-ms <ms>",
-    "Per-task timeout in milliseconds.",
-    (value) => Number(value)
-  ).action(async (options) => addAgent(options));
-  agent.command("test <name>").description("Verify the OmniNode \u2194 agent connection by sending a trivial task.").action(async (name) => testAgent(name));
-}
-async function addAgent(options) {
-  const candidate = agentConfigSchema.safeParse({
-    name: options.name,
-    type: "cli",
-    command: options.command,
-    ...options.arg !== void 0 && options.arg.length > 0 ? { args: options.arg } : {},
-    ...options.cwd !== void 0 ? { cwd: options.cwd } : {},
-    input_mode: options.inputMode,
-    ...options.timeoutMs !== void 0 ? { timeout_ms: options.timeoutMs } : {},
-    ...options.envPolicy !== void 0 ? { env_policy: options.envPolicy } : {},
-    ...options.allowEnv !== void 0 && options.allowEnv.length > 0 ? { env_allowlist: options.allowEnv } : {},
-    ...options.denyEnv !== void 0 && options.denyEnv.length > 0 ? { env_denylist: options.denyEnv } : {},
-    ...options.maxOutputBytes !== void 0 ? { max_output_bytes: options.maxOutputBytes } : {},
-    ...options.allowExternalCwd !== void 0 ? { allow_external_cwd: options.allowExternalCwd } : {}
-  });
-  if (!candidate.success) {
-    const issues = candidate.error.issues.map((issue) => `${issue.path.join(".") || "(root)"}: ${issue.message}`).join("; ");
-    throw new OmniNodeError("CLI_USAGE", `Invalid agent options: ${issues}`);
+// src/roles/index.ts
+var RoleRegistry = class {
+  roles = /* @__PURE__ */ new Map();
+  register(role) {
+    this.roles.set(role.id, role);
   }
-  const newAgent = candidate.data;
-  const existing = loadConfig();
-  if (existing.project.agents.some((a) => a.name === newAgent.name)) {
-    throw new OmniNodeError(
-      "CLI_USAGE",
-      `Agent "${newAgent.name}" already exists in omninode.yaml. Remove it first or pick another name.`
-    );
+  registerAll(roles) {
+    for (const role of roles) this.register(role);
   }
-  const configPath = appendToConfigList("agents", newAgent);
-  console.log(`Added agent "${newAgent.name}" (${newAgent.type}, input=${newAgent.input_mode}) to ${configPath}.`);
-  console.log(`Run \`omninode agent test ${newAgent.name}\` to verify the connection.`);
-}
-async function testAgent(name) {
-  const config = loadConfig();
-  const agentConfig = config.project.agents.find((a) => a.name === name);
-  if (!agentConfig) {
-    const available = config.project.agents.map((a) => a.name).join(", ") || "(none)";
-    throw new AgentError(
-      "AGENT_NOT_FOUND",
-      `Agent "${name}" is not configured. Configured agents: ${available}.`
-    );
+  get(id) {
+    return this.roles.get(id);
   }
-  const agent = createAgent(agentConfig);
-  console.log(
-    `Testing agent "${name}" (${agent.info.integration}, input=${agentConfig.inputMode ?? "stdin"}) \u2014 sending a trivial task.`
-  );
-  const result = await agent.run({
-    taskId: `test-${Date.now()}`,
-    objective: "Reply with the single word: OK"
-  });
-  console.log(`  status: ${result.status}`);
-  if (result.exitCode !== void 0) console.log(`  exit:   ${result.exitCode}`);
-  if (result.summary) console.log(`  output: ${result.summary}`);
-  if (result.rawOutput && result.rawOutput !== result.summary) {
-    console.log(`  raw:    ${result.rawOutput.slice(0, 200).replace(/\n/g, " ")}`);
+  list() {
+    return [...this.roles.values()].sort((a, b) => a.id.localeCompare(b.id));
   }
-  if (result.error) console.log(`  error:  ${result.error}`);
-  if (result.status !== "completed") process.exitCode = 1;
-}
-
-// src/cli/commands/roles.ts
-function registerRoleCommands(program) {
-  const role = program.command("role").description("Inspect roles defined in omninode.yaml.");
-  role.command("list").description("List configured roles.").action(async () => {
-    const config = loadConfig();
-    const roles = config.project.roles;
-    if (roles.length === 0) {
-      console.log("No roles configured. Add one under `project.roles` in omninode.yaml.");
-      return;
-    }
-    for (const role2 of roles) {
-      console.log(`${role2.id}  ${role2.name}`);
-      for (const responsibility of role2.responsibilities) {
-        console.log(`  - ${responsibility}`);
-      }
-    }
-  });
+};
+function buildRoleRegistry(config) {
+  const registry = new RoleRegistry();
+  registry.registerAll(config.project.roles);
+  return registry;
 }
 
 // src/persistence/json-file-store.ts
-import { open, mkdir, readFile, rename, stat } from "fs/promises";
+import { open, mkdir, readFile, rename, stat, writeFile } from "fs/promises";
 import { dirname } from "path";
 var SCHEMA_VERSION = 2;
-async function writeFileAtomic(target, contents) {
+async function writeFileAtomic(target, contents, durability = "rename") {
   const tmp = `${target}.tmp`;
   await mkdir(dirname(target), { recursive: true });
-  const handle = await open(tmp, "w");
-  try {
-    await handle.writeFile(contents, "utf8");
-    await handle.sync();
-  } finally {
-    await handle.close();
+  if (durability === "fsync") {
+    const handle = await open(tmp, "w");
+    try {
+      await handle.writeFile(contents, "utf8");
+      await handle.sync();
+    } finally {
+      await handle.close();
+    }
+  } else {
+    await writeFile(tmp, contents, "utf8");
   }
   await rename(tmp, target);
-  try {
-    const dir = await open(dirname(target), "r");
+  if (durability === "fsync") {
     try {
-      await dir.sync();
-    } finally {
-      await dir.close();
+      const dir = await open(dirname(target), "r");
+      try {
+        await dir.sync();
+      } finally {
+        await dir.close();
+      }
+    } catch {
     }
-  } catch {
   }
 }
 async function inspectDocument(path) {
@@ -2199,6 +1392,7 @@ async function readDocument(path, onCorrupt, quarantine = true) {
 var JsonFileStore = class {
   filePath;
   schemaVersion;
+  durability;
   onCorrupt;
   quarantine;
   log;
@@ -2206,6 +1400,7 @@ var JsonFileStore = class {
   constructor(options) {
     this.filePath = `${options.directory ?? `${process.cwd()}/.omninode`}/${options.fileName}`;
     this.schemaVersion = options.schemaVersion ?? SCHEMA_VERSION;
+    this.durability = options.durability ?? "rename";
     this.onCorrupt = options.onCorrupt;
     this.quarantine = options.quarantine ?? true;
     this.log = logger.child({ component: "persistence", file: options.fileName });
@@ -2220,7 +1415,7 @@ var JsonFileStore = class {
   async writeAll(items) {
     const document = { schemaVersion: this.schemaVersion, items };
     await writeFileAtomic(this.filePath, `${JSON.stringify(document, null, 2)}
-`);
+`, this.durability);
   }
   /** Serializes an async operation against this file. */
   synchronized(operation) {
@@ -2242,711 +1437,1137 @@ var JsonFileStore = class {
   }
 };
 
-// src/tasks/store.ts
-var FileTaskStore = class extends JsonFileStore {
-  constructor(directory) {
-    super({ ...directory !== void 0 ? { directory } : {}, fileName: "tasks.json" });
-  }
-  save(task) {
-    return this.mutate((tasks) => {
-      const index = tasks.findIndex((t) => t.id === task.id);
-      if (index >= 0) tasks[index] = task;
-      else tasks.push(task);
-      return [tasks, void 0];
-    });
-  }
-  async get(id) {
-    const tasks = await this.readAll();
-    return tasks.find((t) => t.id === id);
-  }
-  async list(filter = {}) {
-    const tasks = await this.readAll();
-    return tasks.filter((task) => filter.status ? task.status === filter.status : true).filter((task) => filter.project ? task.project === filter.project : true).sort((a, b) => a.createdAt.localeCompare(b.createdAt));
+// src/memory/base.ts
+function defaultSearch(provider, text, options = {}) {
+  return provider.retrieve({
+    text,
+    ...options.scope !== void 0 ? { scope: options.scope } : {},
+    ...options.limit !== void 0 ? { limit: options.limit } : {}
+  });
+}
+function defaultMetadata(name, options = {}) {
+  return {
+    name,
+    capabilities: options.capabilities ?? ["retrieve", "store", "search"],
+    relevanceRanking: options.relevanceRanking ?? false,
+    ...options.backend !== void 0 ? { backend: options.backend } : {}
+  };
+}
+
+// src/memory/local.ts
+var STOPWORDS = /* @__PURE__ */ new Set([
+  "the",
+  "and",
+  "for",
+  "with",
+  "this",
+  "that",
+  "from",
+  "into",
+  "was",
+  "were",
+  "have",
+  "has",
+  "had",
+  "are",
+  "but",
+  "not",
+  "you",
+  "his",
+  "her",
+  "its",
+  "their",
+  "them",
+  "then",
+  "than",
+  "when",
+  "what",
+  "which",
+  "will",
+  "would",
+  "been",
+  "were",
+  "also",
+  "because",
+  "about",
+  "after",
+  "before"
+]);
+function keywords(text) {
+  return new Set(
+    (text ?? "").toLowerCase().replace(/[^a-z0-9\s]/g, " ").split(/\s+/).filter((t) => t.length >= 4 && !STOPWORDS.has(t))
+  );
+}
+function relevanceScore(queryKeywords, entry2) {
+  if (queryKeywords.size === 0) return 0;
+  const entryKeywords = keywords(`${entry2.content} ${entry2.key}`);
+  let overlap = 0;
+  for (const keyword of queryKeywords) {
+    if (entryKeywords.has(keyword)) overlap += 1;
+  }
+  let tagMatches = 0;
+  for (const tag of entry2.tags ?? []) {
+    if (queryKeywords.has(tag.toLowerCase())) tagMatches += 1;
+  }
+  return overlap * 2 + tagMatches * 1.5;
+}
+var LocalMemoryProvider = class extends JsonFileStore {
+  name = "local";
+  constructor(directory) {
+    super({ ...directory !== void 0 ? { directory } : {}, fileName: "memory.json" });
+  }
+  metadata() {
+    return defaultMetadata(this.name, {
+      capabilities: ["retrieve", "store", "search", "categories", "tags"],
+      relevanceRanking: true,
+      backend: { kind: "json-file", deterministicScoring: true }
+    });
+  }
+  search(text, options = {}) {
+    return defaultSearch(this, text, options);
+  }
+  /** @deprecated v1 alias of {@link retrieve}. */
+  query(query) {
+    return this.retrieve(query);
+  }
+  /** @deprecated v1 alias of {@link store}. */
+  write(entry2) {
+    return this.store(entry2);
+  }
+  async retrieve(query) {
+    const entries = await this.readAll();
+    const filtered = entries.filter((entry2) => query.scope ? entry2.scope === query.scope : true).filter((entry2) => query.category ? entry2.category === query.category : true).filter(
+      (entry2) => query.tags && query.tags.length > 0 ? query.tags.every((tag) => (entry2.tags ?? []).includes(tag)) : true
+    );
+    if (!query.text || query.text.trim().length === 0) {
+      return filtered.sort((a, b) => (b.updatedAt ?? b.createdAt ?? "").localeCompare(a.updatedAt ?? a.createdAt ?? "")).slice(0, query.limit ?? 10);
+    }
+    const queryKeywords = keywords(query.text);
+    return filtered.map((entry2) => ({ entry: entry2, score: relevanceScore(queryKeywords, entry2) })).filter(({ score }) => score > 0).sort((a, b) => b.score - a.score).slice(0, query.limit ?? 10).map(({ entry: entry2 }) => entry2);
+  }
+  store(entry2) {
+    return this.mutate((entries) => {
+      const index = entries.findIndex((e) => e.key === entry2.key);
+      const stamped = {
+        ...entry2,
+        createdAt: entry2.createdAt ?? (/* @__PURE__ */ new Date()).toISOString(),
+        updatedAt: (/* @__PURE__ */ new Date()).toISOString()
+      };
+      if (index >= 0) entries[index] = stamped;
+      else entries.push(stamped);
+      return [entries, void 0];
+    });
+  }
+  async count() {
+    return (await this.readAll()).length;
   }
 };
 
-// src/tasks/engine.ts
-import { randomBytes } from "crypto";
-var ALLOWED_TRANSITIONS = {
-  created: ["queued", "running", "cancelled"],
-  queued: ["running", "cancelled"],
-  running: ["completed", "failed", "timed_out", "unknown", "cancelled", "partially_completed"],
-  waiting: ["running", "cancelled"],
-  completed: [],
-  // failed → running is the only re-entry: bounded automatic retry (§6.4).
-  failed: ["running"],
-  timed_out: [],
-  cancelled: [],
-  unknown: [],
-  partially_completed: []
+// src/memory/remembera.ts
+var RememberaMemoryProvider = class {
+  name = "remembera";
+  baseUrl;
+  apiKeyEnvVar;
+  env;
+  log;
+  constructor(config, log = logger) {
+    this.baseUrl = config.baseUrl.replace(/\/+$/, "");
+    this.apiKeyEnvVar = config.apiKeyEnvVar;
+    this.env = config.env ?? process.env;
+    this.log = log.child({ component: "remembera" });
+  }
+  get authenticationConfigured() {
+    return this.apiKeyEnvVar === void 0 || Boolean(this.env[this.apiKeyEnvVar]);
+  }
+  headers() {
+    const key = this.apiKeyEnvVar ? resolveApiKey({ name: "remembera", apiKeyEnvVar: this.apiKeyEnvVar }, this.env) : void 0;
+    return key ? { authorization: `Bearer ${key}` } : {};
+  }
+  /** Search delegates to the gateway's relevance query. */
+  search(text, options = {}) {
+    return defaultSearch(
+      this,
+      text,
+      {
+        ...options.scope !== void 0 ? { scope: options.scope } : {},
+        ...options.limit !== void 0 ? { limit: options.limit } : {}
+      }
+    );
+  }
+  metadata() {
+    return defaultMetadata(this.name, {
+      capabilities: ["retrieve", "store", "search", "categories", "tags"],
+      relevanceRanking: true,
+      backend: { kind: "http", baseUrl: this.baseUrl, authenticated: this.authenticationConfigured }
+    });
+  }
+  /** @deprecated v1 alias of {@link retrieve}. */
+  query(query) {
+    return this.retrieve(query);
+  }
+  /** @deprecated v1 alias of {@link store}. */
+  write(entry2) {
+    return this.store(entry2);
+  }
+  async retrieve(query) {
+    const { status, body } = await this.request(`${this.baseUrl}/api/memory/query`, query);
+    if (status !== 200) {
+      throw new MemoryError(`Remembera query returned HTTP ${status}.`);
+    }
+    const entries = body.entries;
+    if (!Array.isArray(entries)) {
+      throw new MemoryError("Remembera query response had no entries array.");
+    }
+    return entries.map((entry2) => this.toEntry(entry2)).filter((entry2) => entry2 !== void 0);
+  }
+  async store(entry2) {
+    const { status } = await this.request(`${this.baseUrl}/api/memory`, entry2);
+    if (status !== 200 && status !== 201) {
+      throw new MemoryError(`Remembera write returned HTTP ${status}.`);
+    }
+  }
+  async request(url, body) {
+    const headers = this.headers();
+    try {
+      return await requestJson(url, {
+        method: "POST",
+        headers,
+        body
+      });
+    } catch (error) {
+      const message = error instanceof Error ? error.message : String(error);
+      throw new MemoryError(`Remembera request to ${url} failed: ${message}`, { cause: error });
+    }
+  }
+  toEntry(raw) {
+    if (raw === null || typeof raw !== "object") {
+      this.log.warn("Skipping malformed Remembera memory entry.");
+      return void 0;
+    }
+    const entry2 = raw;
+    if (typeof entry2.key !== "string" || typeof entry2.content !== "string") {
+      this.log.warn("Skipping Remembera memory entry without key/content.");
+      return void 0;
+    }
+    const scope = entry2.scope;
+    return {
+      key: entry2.key,
+      content: entry2.content,
+      scope: scope === "project" || scope === "role" || scope === "task" || scope === "knowledge" ? scope : "knowledge",
+      ...Array.isArray(entry2.tags) ? { tags: entry2.tags.filter((t) => typeof t === "string") } : {},
+      ...typeof entry2.category === "string" ? { category: entry2.category } : {},
+      ...typeof entry2.createdAt === "string" ? { createdAt: entry2.createdAt } : {},
+      ...typeof entry2.updatedAt === "string" ? { updatedAt: entry2.updatedAt } : {}
+    };
+  }
 };
-var RETRYABLE_ERROR_CODES = ["AGENT_FAILED"];
-var EXECUTION_HISTORY_LIMIT = 10;
-var TaskEngine = class {
-  constructor(options) {
-    this.options = options;
-    this.log = (options.log ?? logger).child({ component: "tasks" });
+
+// src/memory/factory.ts
+function createMemoryProvider(config) {
+  if (!config || config.provider === "local") {
+    return new LocalMemoryProvider();
+  }
+  if (config.provider === "remembera") {
+    if (!config.baseUrl) {
+      throw new ConfigError(
+        "CONFIG_INVALID",
+        `Memory provider "remembera" needs a base_url in omninode.yaml.`
+      );
+    }
+    return new RememberaMemoryProvider({
+      baseUrl: config.baseUrl,
+      apiKeyEnvVar: config.apiKeyEnvVar
+    });
+  }
+  throw new ConfigError(
+    "CONFIG_INVALID",
+    `Unknown memory provider "${config.provider}". Available: local, remembera.`
+  );
+}
+
+// src/memory/service.ts
+var DEFAULT_ENTRY_LIMIT = 8;
+var MAX_CONTEXT_CHARS = 4e3;
+var MemoryService = class {
+  constructor(provider, log = logger, options = {}) {
+    this.provider = provider;
+    this.log = log.child({ component: "memory", provider: provider.name });
+    this.required = options.required ?? false;
+    this.maxContextChars = options.maxContextChars ?? MAX_CONTEXT_CHARS;
+  }
+  provider;
+  log;
+  required;
+  maxContextChars;
+  get providerRef() {
+    return this.provider;
   }
-  options;
-  log;
-  get store() {
-    return this.options.store;
+  get providerName() {
+    return this.provider.name;
   }
-  async create(input) {
-    if (!input.objective || input.objective.trim().length === 0) {
-      throw new TaskError("TASK_INVALID", "Task objective must not be empty.");
-    }
-    if (input.role && !this.options.roles.get(input.role)) {
-      throw new TaskError(
-        "TASK_INVALID",
-        `Role "${input.role}" is not defined. Add it under project.roles in omninode.yaml.`
-      );
-    }
-    if (input.agent && !this.options.agents.get(input.agent)) {
-      throw new TaskError(
-        "TASK_INVALID",
-        `Agent "${input.agent}" is not registered. Add it with \`omninode agent add\`.`
-      );
+  get isRequired() {
+    return this.required;
+  }
+  /** Structured, budgeted context for a task (§12 — avoid loading all memory). */
+  async contextFor(query) {
+    let entries;
+    try {
+      entries = await this.provider.retrieve({
+        text: query.objective,
+        ...query.role ? { tags: [query.role] } : {},
+        limit: query.limit ?? DEFAULT_ENTRY_LIMIT
+      });
+    } catch (error) {
+      return this.handleFailure("retrieve", error, { text: "", entries: [], truncated: false });
     }
-    const now = (/* @__PURE__ */ new Date()).toISOString();
-    const task = {
-      id: generateTaskId(),
-      objective: input.objective.trim(),
-      status: "created",
-      attempt: 0,
-      createdAt: now,
-      updatedAt: now,
-      ...input.project !== void 0 ? { project: input.project } : {},
-      ...input.role !== void 0 ? { role: input.role } : {},
-      ...input.agent !== void 0 ? { agent: input.agent } : {},
-      ...input.context !== void 0 ? { context: input.context } : {}
-    };
-    await this.options.store.save(task);
-    this.log.info(`Created task ${task.id}.`);
-    await this.audit("task.created", task.id, { objective: task.objective, project: task.project });
-    return task;
+    return this.format(entries);
   }
-  async queue(id) {
-    const task = await this.mustGet(id);
-    return this.transition(task, "queued");
+  /** Prompt-ready context text (v1 convenience wrapper). */
+  async gatherContext(query) {
+    return (await this.contextFor(query)).text;
   }
-  /** Runs the task through its assigned agent and records the result.
-   *  `maxAttempts` enables bounded automatic retries of *retryable* errors
-   *  with linear backoff; unknown/timed_out outcomes are never auto-retried. */
-  async run(id, options = {}) {
-    const task = await this.mustGet(id);
-    if (task.status !== "created" && task.status !== "queued") {
-      throw new TaskError("TASK_INVALID", `Task ${id} is "${task.status}" and cannot be run.`);
-    }
-    if (!task.agent) {
-      throw new TaskError("TASK_INVALID", `Task ${id} has no agent assigned. Re-create it with --agent.`);
-    }
-    const agent = this.options.agents.get(task.agent);
-    if (!agent) {
-      throw new TaskError("TASK_INVALID", `Agent "${task.agent}" is not registered anymore.`);
-    }
-    const role = task.role ? this.options.roles.get(task.role) : void 0;
-    this.log.info(`Running task ${task.id} on agent "${task.agent}".`);
-    let background = task.context?.background;
-    if (this.options.memory) {
-      const memoryContext = await this.options.memory.gatherContext({
-        objective: task.objective,
-        ...task.role ? { role: task.role } : {},
-        ...task.project ? { project: task.project } : {}
+  /** Records a finished task's outcome — task history plus "known problems" (§12). */
+  async recordTaskOutcome(task) {
+    const outcome = task.result?.summary ?? task.result?.error ?? "(no output)";
+    try {
+      await this.provider.store({
+        key: `task:${task.id}`,
+        scope: "task",
+        category: "tasks",
+        content: `Objective: ${task.objective}
+Status: ${task.status}
+Outcome: ${outcome}`,
+        tags: ["task", ...task.agent ? [task.agent] : [], ...task.role ? [task.role] : []],
+        createdAt: task.createdAt
       });
-      if (memoryContext.length > 0) {
-        background = [memoryContext, background].filter((part) => part && part.length > 0).join("\n\n");
-      }
-    }
-    const maxAttempts = Math.max(1, options.maxAttempts ?? 1);
-    const backoffMs = options.retryBackoffMs ?? 0;
-    let current = task;
-    for (let i = 0; i < maxAttempts; i += 1) {
-      const attempt = current.attempt + 1;
-      const executionId = `exec-${Date.now().toString(36)}-${randomBytes(3).toString("hex")}`;
-      const startedAt = (/* @__PURE__ */ new Date()).toISOString();
-      current = await this.transition(current, "running", { attempt });
-      let output;
-      let thrown;
-      try {
-        output = await agent.run({
-          taskId: current.id,
-          objective: current.objective,
-          ...role ? { role } : {},
-          ...background !== void 0 ? { context: background } : {}
-        });
-      } catch (error) {
-        thrown = error;
-      }
-      const finishedAt = (/* @__PURE__ */ new Date()).toISOString();
-      if (thrown !== void 0 || output === void 0) {
-        const outcome = classifyThrown(thrown);
-        const message = thrown instanceof Error ? thrown.message : String(thrown);
-        const retryable = outcome === "failed" && RETRYABLE_ERROR_CODES.includes(errorCode(thrown)) && i < maxAttempts - 1;
-        current = await this.transition(current, outcome, {
-          attempt,
-          lastError: message,
-          execution: {
-            executionId,
-            attempt,
-            startedAt,
-            finishedAt,
-            outcome,
-            error: message
-          }
+      const significant = (task.result?.reports ?? []).flatMap(
+        (report) => report.findings.filter((finding) => finding.severity === "high" || finding.severity === "critical").map((finding) => ({ report, finding }))
+      );
+      for (const { report, finding } of significant) {
+        await this.provider.store({
+          key: `finding:${report.id}:${finding.id}`,
+          scope: "project",
+          category: "problems",
+          content: `[${finding.severity}] ${finding.title} \u2014 ${finding.detail}`,
+          tags: ["known-problem", report.agent]
         });
-        this.log.warn(`Task ${current.id} attempt ${attempt} \u2192 ${outcome}: ${message}`);
-        if (retryable) {
-          if (backoffMs > 0) await sleep(backoffMs * attempt);
-          continue;
-        }
-        if (this.options.memory) await this.options.memory.recordTaskOutcome(current);
-        return current;
-      }
-      const currentState = await this.options.store.get(current.id);
-      if (currentState?.status === "cancelled") {
-        current = currentState;
-        break;
       }
-      const result = {
-        ...output.summary !== void 0 ? { summary: output.summary } : {},
-        ...output.reports !== void 0 && output.reports.length > 0 ? { reports: output.reports } : {},
-        // Keep the verbatim output (bounded) for report extraction and audit.
-        ...output.rawOutput !== void 0 && output.rawOutput.length > 0 ? { rawOutput: output.rawOutput.slice(0, 1e4) } : {},
-        ...output.error !== void 0 ? { error: output.error } : {},
-        finishedAt
-      };
-      const finalStatus = output.status === "completed" ? "completed" : "failed";
-      current = await this.transition(current, finalStatus, {
-        attempt,
-        result,
-        execution: { executionId, attempt, startedAt, finishedAt, outcome: finalStatus }
-      });
-      this.log.info(`Task ${current.id} finished: ${finalStatus}.`);
-      break;
-    }
-    if (this.options.memory) {
-      await this.options.memory.recordTaskOutcome(current);
+    } catch (error) {
+      this.handleFailure("store", error, void 0);
     }
-    return current;
   }
-  async cancel(id) {
-    const task = await this.mustGet(id);
-    if (!ALLOWED_TRANSITIONS[task.status].includes("cancelled")) {
-      throw new TaskError("TASK_INVALID", `Task ${id} is "${task.status}" and cannot be cancelled.`);
+  format(entries) {
+    if (entries.length === 0) return { text: "", entries, truncated: false };
+    const byScope = /* @__PURE__ */ new Map();
+    for (const entry2 of entries) {
+      byScope.set(entry2.scope, [...byScope.get(entry2.scope) ?? [], entry2]);
     }
-    if (task.agent) {
-      const agent = this.options.agents.get(task.agent);
-      await agent?.cancel?.(task.id);
+    const parts = [];
+    for (const scope of ["project", "task", "role", "knowledge"]) {
+      const scopeEntries = byScope.get(scope) ?? [];
+      if (scopeEntries.length === 0) continue;
+      const lines = scopeEntries.map((entry2) => {
+        const category = entry2.category ? `[${entry2.category}] ` : "";
+        return `- ${category}${entry2.content}`;
+      }).join("\n");
+      parts.push(`### Relevant memory (${scope})
+${lines}`);
     }
-    return this.transition(task, "cancelled");
+    let text = parts.join("\n\n");
+    const truncated = text.length > this.maxContextChars;
+    if (truncated) text = `${text.slice(0, this.maxContextChars - 1)}\u2026`;
+    return { text, entries, truncated };
   }
-  /** Error recovery: reset a failed/cancelled/unknown/timed_out task so it can run again. */
-  async retry(id) {
-    const task = await this.mustGet(id);
-    const retryableStates = ["failed", "cancelled", "unknown", "timed_out"];
-    if (!retryableStates.includes(task.status)) {
-      throw new TaskError(
-        "TASK_INVALID",
-        `Only failed, timed out, unknown or cancelled tasks can be retried \u2014 task ${id} is "${task.status}".`
+  /**
+   * Failure policy (§12): continue unless memory is explicitly required.
+   */
+  handleFailure(operation, error, fallback) {
+    const message = error instanceof Error ? error.message : String(error);
+    if (this.required) {
+      throw new MemoryError(
+        `Memory is marked required, but ${operation} failed: ${message}`,
+        { cause: error }
       );
     }
-    const { result: _discarded, ...rest } = task;
-    const reset = {
-      ...rest,
-      status: "created",
-      updatedAt: (/* @__PURE__ */ new Date()).toISOString()
-    };
-    await this.options.store.save(reset);
-    await this.audit("task.retry", id, { from: task.status });
-    this.log.info(`Task ${id} reset for retry.`);
-    return reset;
+    this.log.warn(`Memory ${operation} failed (continuing without memory): ${message}`);
+    return fallback ?? { text: "", entries: [], truncated: false };
+  }
+};
+
+// src/pipelines/store.ts
+var FilePipelineRunStore = class extends JsonFileStore {
+  constructor(directory) {
+    super({ ...directory !== void 0 ? { directory } : {}, fileName: "pipelines.json" });
+  }
+  save(run2) {
+    return this.mutate((runs) => {
+      const index = runs.findIndex((r) => r.id === run2.id);
+      if (index >= 0) runs[index] = run2;
+      else runs.push(run2);
+      return [runs, void 0];
+    });
   }
   async get(id) {
-    return this.options.store.get(id);
+    return (await this.readAll()).find((r) => r.id === id);
   }
-  async list(filter) {
-    return this.options.store.list(filter);
+  async list(filter = {}) {
+    return (await this.readAll()).filter((run2) => filter.pipelineId ? run2.pipelineId === filter.pipelineId : true).filter((run2) => filter.status ? run2.status === filter.status : true).sort((a, b) => (a.startedAt ?? "").localeCompare(b.startedAt ?? ""));
   }
-  async mustGet(id) {
-    const task = await this.options.store.get(id);
-    if (!task) {
-      throw new TaskError("TASK_NOT_FOUND", `Task "${id}" does not exist in this project's task store.`);
-    }
-    return task;
+};
+
+// src/tasks/store.ts
+var FileTaskStore = class extends JsonFileStore {
+  constructor(directory) {
+    super({ ...directory !== void 0 ? { directory } : {}, fileName: "tasks.json" });
   }
-  async transition(task, to, extra = {}) {
-    const allowed = ALLOWED_TRANSITIONS[task.status] ?? [];
-    if (!allowed.includes(to)) {
-      throw new TaskError("TASK_INVALID", `Task ${task.id} cannot move from "${task.status}" to "${to}".`);
-    }
-    const executions = extra.execution ? [...task.executions ?? [], extra.execution].slice(-EXECUTION_HISTORY_LIMIT) : task.executions;
-    const updated = {
-      ...task,
-      status: to,
-      updatedAt: (/* @__PURE__ */ new Date()).toISOString(),
-      ...extra.attempt !== void 0 ? { attempt: extra.attempt } : {},
-      ...extra.lastError !== void 0 ? { lastError: extra.lastError } : {},
-      ...executions !== void 0 ? { executions } : {},
-      ...extra.result !== void 0 ? { result: { ...task.result, ...extra.result } } : {}
-    };
-    await this.options.store.save(updated);
-    await this.audit(`task.${to === "queued" ? "queued" : to}`, updated.id, {
-      from: task.status
+  save(task) {
+    return this.mutate((tasks) => {
+      const index = tasks.findIndex((t) => t.id === task.id);
+      if (index >= 0) tasks[index] = task;
+      else tasks.push(task);
+      return [tasks, void 0];
     });
-    return updated;
   }
-  async audit(action, id, detail) {
-    await this.options.audit?.record({
-      at: (/* @__PURE__ */ new Date()).toISOString(),
-      action,
-      id,
-      ...detail !== void 0 ? { detail } : {}
-    });
+  async get(id) {
+    const tasks = await this.readAll();
+    return tasks.find((t) => t.id === id);
+  }
+  async list(filter = {}) {
+    const tasks = await this.readAll();
+    return tasks.filter((task) => filter.status ? task.status === filter.status : true).filter((task) => filter.project ? task.project === filter.project : true).sort((a, b) => a.createdAt.localeCompare(b.createdAt));
   }
 };
-function generateTaskId() {
-  return `task-${Date.now().toString(36)}-${randomBytes(3).toString("hex")}`;
+
+// src/cli/commands/inspect.ts
+function emit(json, payload, render) {
+  if (json) {
+    console.log(JSON.stringify(payload, null, 2));
+    return;
+  }
+  render();
+}
+function jsonOption(command) {
+  return command.option("--json", "Emit the raw record as JSON.");
+}
+function registerTaskInspect(taskGroup) {
+  jsonOption(
+    taskGroup.command("inspect <id>").description("Show a task with its execution history, result and report references.").action(async (id, options) => {
+      const tasks = await new FileTaskStore().list();
+      const task = tasks.find((t) => t.id === id);
+      if (!task) throw new OmniNodeError("TASK_NOT_FOUND", `No task "${id}" in this project's store.`);
+      emit(options.json ?? false, task, () => {
+        console.log(`Task ${task.id}`);
+        console.log(`  status:    ${task.status}${task.attempt > 0 ? ` (attempt ${task.attempt})` : ""}`);
+        if (task.project) console.log(`  project:   ${task.project}`);
+        if (task.pipelineId) console.log(`  pipeline:  ${task.pipelineId}`);
+        console.log(`  objective: ${task.objective}`);
+        if (task.role) console.log(`  role:      ${task.role}`);
+        if (task.agent) console.log(`  agent:     ${task.agent}`);
+        console.log(`  created:   ${task.createdAt}`);
+        console.log(`  updated:   ${task.updatedAt}`);
+        if (task.lastError) console.log(`  lastError: ${task.lastError}`);
+        if (task.executions && task.executions.length > 0) {
+          console.log("  executions:");
+          for (const execution of task.executions) {
+            console.log(
+              `    #${execution.attempt} ${execution.outcome} (${execution.executionId})${execution.error ? ` \u2014 ${execution.error}` : ""}`
+            );
+          }
+        }
+        if (task.result?.summary) console.log(`  summary:   ${task.result.summary}`);
+        if (task.result?.reports && task.result.reports.length > 0) {
+          console.log(`  reports:   ${task.result.reports.length}`);
+          for (const report of task.result.reports) {
+            console.log(`    - [${report.agent}] ${report.summary}`);
+            for (const finding of report.findings) {
+              console.log(`        \xB7 [${finding.severity ?? "info"}] ${finding.title}`);
+            }
+          }
+        }
+      });
+    })
+  );
 }
-function errorCode(error) {
-  return error?.code ?? "";
+function registerPipelineInspect(pipelineGroup) {
+  jsonOption(
+    pipelineGroup.command("inspect <run-id>").description("Show a pipeline run with per-step status and artifact references.").action(async (runId, options) => {
+      const run2 = await new FilePipelineRunStore().get(runId);
+      if (!run2) throw new OmniNodeError("PIPELINE_NOT_FOUND", `No pipeline run "${runId}" in this project's store.`);
+      emit(options.json ?? false, run2, () => {
+        console.log(`Pipeline run ${run2.id}  (${run2.pipelineId})`);
+        console.log(`  status:     ${run2.status}${run2.attempt > 1 ? ` (attempt ${run2.attempt})` : ""}`);
+        if (run2.objective) console.log(`  objective:  ${run2.objective}`);
+        console.log(`  started:    ${run2.startedAt ?? "?"}`);
+        if (run2.finishedAt) console.log(`  finished:   ${run2.finishedAt}`);
+        if (run2.planId) console.log(`  plan:       ${run2.planId}`);
+        if (run2.combinedReportId) console.log(`  combined:   ${run2.combinedReportId}`);
+        if (run2.resultSummary) console.log(`  result:     ${run2.resultSummary}`);
+        console.log("  steps:");
+        for (const step of run2.stepRuns) {
+          const stepTaskIds = step.taskIds ?? [];
+          const tasks = stepTaskIds.length > 0 ? ` tasks=${stepTaskIds.join(",")}` : "";
+          console.log(`    ${step.stepId.padEnd(14)} ${step.status}${tasks}${step.error ? ` \u2014 ${step.error}` : ""}`);
+        }
+      });
+    })
+  );
 }
-function classifyThrown(error) {
-  if (error instanceof AgentError && error.code === "AGENT_TIMEOUT") {
-    const dispatched = error.details?.dispatched;
-    return dispatched === false ? "timed_out" : "unknown";
-  }
-  return "failed";
+function registerAgentInspect(agentGroup) {
+  jsonOption(
+    agentGroup.command("inspect <name>").description("Show an agent's effective configuration and recent tasks.").action(async (name, options) => {
+      const config = loadConfig();
+      const agentConfig = config.project.agents.find((a) => a.name === name);
+      if (!agentConfig) throw new OmniNodeError("AGENT_NOT_FOUND", `No agent "${name}" is configured.`);
+      const registry = buildAgentRegistry(config);
+      const agent = registry.get(name);
+      const recent = (await new FileTaskStore().list()).filter((task) => task.agent === name).slice(-5).map((task) => ({ id: task.id, status: task.status, updatedAt: task.updatedAt }));
+      const payload = {
+        config: agentConfig,
+        effective: agent?.info,
+        envPolicy: resolveEnvPolicy(agentConfig),
+        recentTasks: recent
+      };
+      emit(options.json ?? false, payload, () => {
+        console.log(`Agent ${name}`);
+        console.log(`  integration: ${agentConfig.integration}`);
+        console.log(`  command:     ${agentConfig.command ?? "(none)"}`);
+        console.log(`  input mode:  ${agentConfig.inputMode ?? "stdin"}`);
+        console.log(`  env policy:  ${resolveEnvPolicy(agentConfig)}`);
+        if (agentConfig.cwd) console.log(`  working dir: ${agentConfig.cwd}`);
+        if (agentConfig.timeoutMs) console.log(`  timeout:     ${agentConfig.timeoutMs}ms`);
+        if (agentConfig.maxOutputBytes) console.log(`  max output:  ${agentConfig.maxOutputBytes} bytes/stream`);
+        if (agentConfig.allowExternalCwd) console.log(`  external cwd allowed`);
+        console.log(`  recent tasks: ${recent.map((t) => `${t.id}:${t.status}`).join(", ") || "(none)"}`);
+      });
+    })
+  );
 }
-function sleep(ms) {
-  return new Promise((resolve2) => setTimeout(resolve2, ms));
+function registerProviderInspect(providerGroup) {
+  jsonOption(
+    providerGroup.command("inspect <name>").description("Show a provider's authentication status and capabilities.").action(async (name, options) => {
+      const config = loadConfig();
+      const providerConfig = config.project.providers.find((p) => p.name === name);
+      if (!providerConfig) throw new OmniNodeError("PROVIDER_NOT_FOUND", `No provider "${name}" is configured.`);
+      const { createProvider: createProvider2 } = await import("./providers-OYXBAQTX.js");
+      const provider = createProvider2(providerConfig);
+      const payload = {
+        config: providerConfig,
+        providerId: provider.providerId,
+        authentication: provider.authentication,
+        capabilities: providerConfig.capabilities ?? [],
+        memoryConfigured: config.project.memory ? { provider: config.project.memory.provider, required: config.project.memory.required ?? false } : void 0,
+        memoryEntries: config.project.memory ? await new MemoryService(createMemoryProvider(config.project.memory)).providerRef.query({ limit: 1e4 }).then((e) => e.length) : void 0,
+        roles: buildRoleRegistry(config).list().length
+      };
+      emit(options.json ?? false, payload, () => {
+        console.log(`Provider ${name}`);
+        console.log(`  providerId:    ${provider.providerId}`);
+        console.log(`  type:          ${providerConfig.type}`);
+        console.log(`  base URL:      ${providerConfig.baseUrl}`);
+        console.log(`  auth:          ${provider.authentication.method}${provider.authentication.envVar ? ` ($${provider.authentication.envVar})` : ""}`);
+        console.log(`  credentials:   ${provider.authentication.configured ? "configured" : "MISSING"}`);
+        if (providerConfig.capabilities?.length) {
+          console.log(`  capabilities:  ${providerConfig.capabilities.join(", ")}`);
+        }
+      });
+    })
+  );
 }
 
-// src/audit/index.ts
-import { mkdir as mkdir2, readFile as readFile2 } from "fs/promises";
-import { dirname as dirname2 } from "path";
-var FileAuditLog = class {
-  filePath;
-  log;
-  constructor(directory = `${process.cwd()}/.omninode`, log = logger) {
-    this.filePath = `${directory}/audit.jsonl`;
-    this.log = log.child({ component: "audit" });
-  }
-  async record(event) {
-    try {
-      await mkdir2(dirname2(this.filePath), { recursive: true });
-      const { open: open2 } = await import("fs/promises");
-      const handle = await open2(this.filePath, "a");
-      try {
-        await handle.appendFile(`${JSON.stringify(event)}
-`, "utf8");
-        await handle.sync();
-      } finally {
-        await handle.close();
-      }
-    } catch (error) {
-      this.log.warn(
-        `Audit write failed: ${error instanceof Error ? error.message : String(error)}`
+// src/cli/commands/providers.ts
+function registerProviderCommands(program) {
+  const provider = program.command("provider").description("Manage AI providers configured in omninode.yaml.");
+  provider.command("list").description("List configured providers.").action(async () => {
+    const config = loadConfig();
+    const providers = config.project.providers;
+    if (providers.length === 0) {
+      console.log(
+        "No providers configured. Add one with `omninode provider add` or edit omninode.yaml."
       );
+      return;
     }
-  }
-  /** Recent events, oldest first; used by the CLI. */
-  async recent(limit = 20) {
-    let raw;
-    try {
-      raw = await readFile2(this.filePath, "utf8");
-    } catch {
-      return [];
+    for (const provider2 of providers) {
+      const key = provider2.apiKeyEnvVar ? `$${provider2.apiKeyEnvVar}` : "none";
+      const enabled = provider2.enabled === false ? "  (disabled)" : "";
+      console.log(
+        `${provider2.name}  type=${provider2.type}  base_url=${provider2.baseUrl}  key=${key}${enabled}`
+      );
     }
-    const events = raw.split("\n").filter((line) => line.length > 0).map((line) => {
-      try {
-        return JSON.parse(line);
-      } catch {
-        return void 0;
-      }
-    }).filter((event) => event !== void 0);
-    return events.slice(-limit);
-  }
-};
-
-// src/memory/base.ts
-function defaultSearch(provider, text, options = {}) {
-  return provider.retrieve({
-    text,
-    ...options.scope !== void 0 ? { scope: options.scope } : {},
-    ...options.limit !== void 0 ? { limit: options.limit } : {}
   });
+  provider.command("add").description(
+    "Add a provider to omninode.yaml. OpenAI-compatible gateways (including OpenRouter and local runtimes) are supported today; OmniHilbras gets its own adapter in Phase 2."
+  ).requiredOption("--name <name>", "Unique provider name used in configuration and the model registry.").requiredOption("--base-url <url>", "Provider base URL, e.g. https://example.com/v1").option(
+    "--type <type>",
+    "Provider type: openai-compatible, omnihilbras, openrouter, local or custom.",
+    "openai-compatible"
+  ).option(
+    "--api-key-env-var <envVar>",
+    "Environment variable holding the API key. Keys are never written to the config file."
+  ).action(async (options) => addProvider(options));
+  provider.command("test <name>").description("Test connectivity, authentication and model discovery for a configured provider.").option(
+    "--connect",
+    "Run the full provider connect flow (authenticate, fetch, validate, register) where the adapter supports it."
+  ).action(async (name, options) => testProvider(name, options));
+  provider.command("remove <name>").description("Remove a provider (planned for Phase 1 follow-up).").action(() => {
+    throw notImplemented("omninode provider remove", "a Phase 1 follow-up");
+  });
+  registerProviderInspect(provider);
 }
-function defaultMetadata(name, options = {}) {
-  return {
-    name,
-    capabilities: options.capabilities ?? ["retrieve", "store", "search"],
-    relevanceRanking: options.relevanceRanking ?? false,
-    ...options.backend !== void 0 ? { backend: options.backend } : {}
-  };
-}
-
-// src/memory/local.ts
-var STOPWORDS = /* @__PURE__ */ new Set([
-  "the",
-  "and",
-  "for",
-  "with",
-  "this",
-  "that",
-  "from",
-  "into",
-  "was",
-  "were",
-  "have",
-  "has",
-  "had",
-  "are",
-  "but",
-  "not",
-  "you",
-  "his",
-  "her",
-  "its",
-  "their",
-  "them",
-  "then",
-  "than",
-  "when",
-  "what",
-  "which",
-  "will",
-  "would",
-  "been",
-  "were",
-  "also",
-  "because",
-  "about",
-  "after",
-  "before"
-]);
-function keywords(text) {
-  return new Set(
-    (text ?? "").toLowerCase().replace(/[^a-z0-9\s]/g, " ").split(/\s+/).filter((t) => t.length >= 4 && !STOPWORDS.has(t))
-  );
-}
-function relevanceScore(queryKeywords, entry2) {
-  if (queryKeywords.size === 0) return 0;
-  const entryKeywords = keywords(`${entry2.content} ${entry2.key}`);
-  let overlap = 0;
-  for (const keyword of queryKeywords) {
-    if (entryKeywords.has(keyword)) overlap += 1;
-  }
-  let tagMatches = 0;
-  for (const tag of entry2.tags ?? []) {
-    if (queryKeywords.has(tag.toLowerCase())) tagMatches += 1;
-  }
-  return overlap * 2 + tagMatches * 1.5;
-}
-var LocalMemoryProvider = class extends JsonFileStore {
-  name = "local";
-  constructor(directory) {
-    super({ ...directory !== void 0 ? { directory } : {}, fileName: "memory.json" });
-  }
-  metadata() {
-    return defaultMetadata(this.name, {
-      capabilities: ["retrieve", "store", "search", "categories", "tags"],
-      relevanceRanking: true,
-      backend: { kind: "json-file", deterministicScoring: true }
-    });
-  }
-  search(text, options = {}) {
-    return defaultSearch(this, text, options);
+async function addProvider(options) {
+  const configPath = findConfigFile();
+  if (!configPath) {
+    throw new OmniNodeError("CONFIG_NOT_FOUND", "No omninode.yaml found. Run `omninode init` first.");
   }
-  /** @deprecated v1 alias of {@link retrieve}. */
-  query(query) {
-    return this.retrieve(query);
+  const candidate = providerConfigSchema.safeParse({
+    name: options.name,
+    type: options.type,
+    base_url: options.baseUrl,
+    ...options.apiKeyEnvVar !== void 0 ? { api_key_env_var: options.apiKeyEnvVar } : {}
+  });
+  if (!candidate.success) {
+    const issues = candidate.error.issues.map((issue) => `${issue.path.join(".") || "(root)"}: ${issue.message}`).join("; ");
+    throw new OmniNodeError("CLI_USAGE", `Invalid provider options: ${issues}`);
   }
-  /** @deprecated v1 alias of {@link store}. */
-  write(entry2) {
-    return this.store(entry2);
+  const newProvider = candidate.data;
+  const existing = loadConfig();
+  if (existing.project.providers.some((p) => p.name === newProvider.name)) {
+    throw new OmniNodeError(
+      "CLI_USAGE",
+      `Provider "${newProvider.name}" already exists in ${findConfigFile() ?? "omninode.yaml"}.`
+    );
   }
-  async retrieve(query) {
-    const entries = await this.readAll();
-    const filtered = entries.filter((entry2) => query.scope ? entry2.scope === query.scope : true).filter((entry2) => query.category ? entry2.category === query.category : true).filter(
-      (entry2) => query.tags && query.tags.length > 0 ? query.tags.every((tag) => (entry2.tags ?? []).includes(tag)) : true
+  const writtenPath = appendToConfigList("providers", newProvider);
+  console.log(`Added provider "${newProvider.name}" (${newProvider.type}) to ${writtenPath}.`);
+  if (newProvider.api_key_env_var) {
+    console.log(
+      `Set $${newProvider.api_key_env_var} in your environment, then run: omninode provider test ${newProvider.name}`
     );
-    if (!query.text || query.text.trim().length === 0) {
-      return filtered.sort((a, b) => (b.updatedAt ?? b.createdAt ?? "").localeCompare(a.updatedAt ?? a.createdAt ?? "")).slice(0, query.limit ?? 10);
-    }
-    const queryKeywords = keywords(query.text);
-    return filtered.map((entry2) => ({ entry: entry2, score: relevanceScore(queryKeywords, entry2) })).filter(({ score }) => score > 0).sort((a, b) => b.score - a.score).slice(0, query.limit ?? 10).map(({ entry: entry2 }) => entry2);
+  } else {
+    console.log(`Run \`omninode provider test ${newProvider.name}\` to verify connectivity.`);
   }
-  store(entry2) {
-    return this.mutate((entries) => {
-      const index = entries.findIndex((e) => e.key === entry2.key);
-      const stamped = {
-        ...entry2,
-        createdAt: entry2.createdAt ?? (/* @__PURE__ */ new Date()).toISOString(),
-        updatedAt: (/* @__PURE__ */ new Date()).toISOString()
-      };
-      if (index >= 0) entries[index] = stamped;
-      else entries.push(stamped);
-      return [entries, void 0];
-    });
+}
+async function testProvider(name, options = {}) {
+  const config = loadConfig();
+  const providerConfig = config.project.providers.find((p) => p.name === name);
+  if (!providerConfig) {
+    const available = config.project.providers.map((p) => p.name).join(", ") || "(none)";
+    throw new ProviderError(
+      "PROVIDER_NOT_FOUND",
+      `Provider "${name}" is not configured. Configured providers: ${available}.`
+    );
   }
-  async count() {
-    return (await this.readAll()).length;
+  const provider = createProvider(providerConfig);
+  console.log(`Testing provider "${name}" (${providerConfig.type}) at ${provider.config.baseUrl}`);
+  if (options.connect && provider instanceof OmniHilbrasProvider) {
+    const registry = new ModelRegistry();
+    try {
+      const result = await provider.connectAndRegister(registry);
+      printProviderStatus(result.status);
+      console.log(`  registered: ${result.registered}`);
+    } catch (error) {
+      console.log(`  connect failed: ${error instanceof Error ? error.message : String(error)}`);
+      process.exitCode = 1;
+    }
+    return;
   }
-};
+  const health = await provider.healthCheck();
+  printProviderStatus(health);
+  if (!health.connected) process.exitCode = 1;
+}
+function printProviderStatus(status) {
+  console.log(`  health:    ${status.health}`);
+  console.log(`  connected: ${status.connected}`);
+  console.log(`  models:    ${status.modelCount}`);
+  if (status.message) console.log(`  detail:    ${status.message}`);
+}
 
-// src/memory/remembera.ts
-var RememberaMemoryProvider = class {
-  name = "remembera";
-  baseUrl;
-  apiKeyEnvVar;
-  env;
-  log;
-  constructor(config, log = logger) {
-    this.baseUrl = config.baseUrl.replace(/\/+$/, "");
-    this.apiKeyEnvVar = config.apiKeyEnvVar;
-    this.env = config.env ?? process.env;
-    this.log = log.child({ component: "remembera" });
-  }
-  get authenticationConfigured() {
-    return this.apiKeyEnvVar === void 0 || Boolean(this.env[this.apiKeyEnvVar]);
-  }
-  headers() {
-    const key = this.apiKeyEnvVar ? resolveApiKey({ name: "remembera", apiKeyEnvVar: this.apiKeyEnvVar }, this.env) : void 0;
-    return key ? { authorization: `Bearer ${key}` } : {};
-  }
-  /** Search delegates to the gateway's relevance query. */
-  search(text, options = {}) {
-    return defaultSearch(
-      this,
-      text,
-      {
-        ...options.scope !== void 0 ? { scope: options.scope } : {},
-        ...options.limit !== void 0 ? { limit: options.limit } : {}
-      }
+// src/cli/commands/models.ts
+var CAPABILITIES = [
+  "chat",
+  "coding",
+  "tools",
+  "vision",
+  "embeddings"
+];
+function registerModelsCommand(program) {
+  program.command("models").description("Discover and list models from configured providers (model registry, \xA78).").argument("[provider]", "Only discover from this provider.").option("-c, --capability <capability>", `Filter by capability: ${CAPABILITIES.join(", ")}.`).action(async (providerName, options) => {
+    const capability = options.capability;
+    if (capability !== void 0 && !CAPABILITIES.includes(capability)) {
+      throw new OmniNodeError(
+        "CLI_USAGE",
+        `Unknown capability "${options.capability}". Valid capabilities: ${CAPABILITIES.join(", ")}.`
+      );
+    }
+    const config = loadConfig();
+    const selected = config.project.providers.filter(
+      (p) => providerName ? p.name === providerName : true
     );
-  }
-  metadata() {
-    return defaultMetadata(this.name, {
-      capabilities: ["retrieve", "store", "search", "categories", "tags"],
-      relevanceRanking: true,
-      backend: { kind: "http", baseUrl: this.baseUrl, authenticated: this.authenticationConfigured }
-    });
-  }
-  /** @deprecated v1 alias of {@link retrieve}. */
-  query(query) {
-    return this.retrieve(query);
-  }
-  /** @deprecated v1 alias of {@link store}. */
-  write(entry2) {
-    return this.store(entry2);
-  }
-  async retrieve(query) {
-    const { status, body } = await this.request(`${this.baseUrl}/api/memory/query`, query);
-    if (status !== 200) {
-      throw new MemoryError(`Remembera query returned HTTP ${status}.`);
+    if (selected.length === 0) {
+      throw new OmniNodeError(
+        "PROVIDER_NOT_FOUND",
+        providerName ? `Provider "${providerName}" is not configured.` : "No providers configured. Add one with `omninode provider add`."
+      );
     }
-    const entries = body.entries;
-    if (!Array.isArray(entries)) {
-      throw new MemoryError("Remembera query response had no entries array.");
+    const registry = new ModelRegistry();
+    for (const providerConfig of selected) {
+      try {
+        const provider = createProvider(providerConfig);
+        const discovered = await registry.discoverFrom(provider);
+        console.log(`${providerConfig.name}: ${discovered.length} model(s)`);
+      } catch (error) {
+        const message = error instanceof Error ? error.message : String(error);
+        console.log(`${providerConfig.name}: discovery failed \u2014 ${message}`);
+      }
     }
-    return entries.map((entry2) => this.toEntry(entry2)).filter((entry2) => entry2 !== void 0);
-  }
-  async store(entry2) {
-    const { status } = await this.request(`${this.baseUrl}/api/memory`, entry2);
-    if (status !== 200 && status !== 201) {
-      throw new MemoryError(`Remembera write returned HTTP ${status}.`);
+    const models = registry.list({
+      ...providerName !== void 0 ? { provider: providerName } : {},
+      ...capability !== void 0 ? { capability } : {}
+    });
+    if (models.length === 0) {
+      console.log("No models found.");
+      return;
     }
-  }
-  async request(url, body) {
-    const headers = this.headers();
-    try {
-      return await requestJson(url, {
-        method: "POST",
-        headers,
-        body
-      });
-    } catch (error) {
-      const message = error instanceof Error ? error.message : String(error);
-      throw new MemoryError(`Remembera request to ${url} failed: ${message}`, { cause: error });
+    console.log("");
+    for (const model of models) {
+      console.log(`${model.provider}:${model.id}`);
     }
-  }
-  toEntry(raw) {
-    if (raw === null || typeof raw !== "object") {
-      this.log.warn("Skipping malformed Remembera memory entry.");
-      return void 0;
+  });
+}
+
+// src/cli/commands/agents.ts
+var collectArgs = (value, previous) => [...previous, value];
+function registerAgentCommands(program) {
+  const agent = program.command("agent").description("Manage CLI agents registered with OmniNode.");
+  agent.command("list").description("List configured agents.").action(async () => {
+    const config = loadConfig();
+    const agents = config.project.agents;
+    if (agents.length === 0) {
+      console.log("No agents configured. Add one with `omninode agent add` or edit omninode.yaml.");
+      return;
     }
-    const entry2 = raw;
-    if (typeof entry2.key !== "string" || typeof entry2.content !== "string") {
-      this.log.warn("Skipping Remembera memory entry without key/content.");
-      return void 0;
+    for (const agent2 of agents) {
+      const command = agent2.command ?? "(no command)";
+      console.log(
+        `${agent2.name}  integration=${agent2.integration}  command=${command}  input=${agent2.inputMode ?? "stdin"}`
+      );
     }
-    const scope = entry2.scope;
-    return {
-      key: entry2.key,
-      content: entry2.content,
-      scope: scope === "project" || scope === "role" || scope === "task" || scope === "knowledge" ? scope : "knowledge",
-      ...Array.isArray(entry2.tags) ? { tags: entry2.tags.filter((t) => typeof t === "string") } : {},
-      ...typeof entry2.category === "string" ? { category: entry2.category } : {},
-      ...typeof entry2.createdAt === "string" ? { createdAt: entry2.createdAt } : {},
-      ...typeof entry2.updatedAt === "string" ? { updatedAt: entry2.updatedAt } : {}
-    };
+  });
+  agent.command("add").description(
+    "Register a CLI agent in omninode.yaml. Agents run as child processes (stdin/stdout); native adapters come in a later phase."
+  ).requiredOption("--name <name>", "Unique agent name.").requiredOption("--command <command>", "Executable command, e.g. opencode").option("--arg <value>", "Additional command argument (repeatable).", collectArgs, []).option("--cwd <dir>", "Working directory for the agent process.").option(
+    "--input-mode <mode>",
+    "How the task is delivered: stdin (prompt on stdin), arg (prompt as last argument) or protocol (\xA721 JSON-lines task protocol).",
+    "stdin"
+  ).option("--env-policy <policy>", "Environment policy: inherit, allowlist, denylist or explicit.").option("--allow-env <name>", "Variable to forward under the allowlist policy (repeatable).", collectArgs).option("--deny-env <name>", "Variable to remove under the denylist policy (repeatable).", collectArgs).option("--max-output-bytes <n>", "Per-stream output budget in bytes (default 5 MiB).", (value) => Number(value)).option("--allow-external-cwd", "Allow a working directory outside the project root.").option(
+    "--timeout-ms <ms>",
+    "Per-task timeout in milliseconds.",
+    (value) => Number(value)
+  ).action(async (options) => addAgent(options));
+  agent.command("test <name>").description("Verify the OmniNode \u2194 agent connection by sending a trivial task.").action(async (name) => testAgent(name));
+  registerAgentInspect(agent);
+}
+async function addAgent(options) {
+  const candidate = agentConfigSchema.safeParse({
+    name: options.name,
+    type: "cli",
+    command: options.command,
+    ...options.arg !== void 0 && options.arg.length > 0 ? { args: options.arg } : {},
+    ...options.cwd !== void 0 ? { cwd: options.cwd } : {},
+    input_mode: options.inputMode,
+    ...options.timeoutMs !== void 0 ? { timeout_ms: options.timeoutMs } : {},
+    ...options.envPolicy !== void 0 ? { env_policy: options.envPolicy } : {},
+    ...options.allowEnv !== void 0 && options.allowEnv.length > 0 ? { env_allowlist: options.allowEnv } : {},
+    ...options.denyEnv !== void 0 && options.denyEnv.length > 0 ? { env_denylist: options.denyEnv } : {},
+    ...options.maxOutputBytes !== void 0 ? { max_output_bytes: options.maxOutputBytes } : {},
+    ...options.allowExternalCwd !== void 0 ? { allow_external_cwd: options.allowExternalCwd } : {}
+  });
+  if (!candidate.success) {
+    const issues = candidate.error.issues.map((issue) => `${issue.path.join(".") || "(root)"}: ${issue.message}`).join("; ");
+    throw new OmniNodeError("CLI_USAGE", `Invalid agent options: ${issues}`);
   }
-};
-
-// src/memory/factory.ts
-function createMemoryProvider(config) {
-  if (!config || config.provider === "local") {
-    return new LocalMemoryProvider();
+  const newAgent = candidate.data;
+  const existing = loadConfig();
+  if (existing.project.agents.some((a) => a.name === newAgent.name)) {
+    throw new OmniNodeError(
+      "CLI_USAGE",
+      `Agent "${newAgent.name}" already exists in omninode.yaml. Remove it first or pick another name.`
+    );
   }
-  if (config.provider === "remembera") {
-    if (!config.baseUrl) {
-      throw new ConfigError(
-        "CONFIG_INVALID",
-        `Memory provider "remembera" needs a base_url in omninode.yaml.`
-      );
-    }
-    return new RememberaMemoryProvider({
-      baseUrl: config.baseUrl,
-      apiKeyEnvVar: config.apiKeyEnvVar
-    });
+  const configPath = appendToConfigList("agents", newAgent);
+  console.log(`Added agent "${newAgent.name}" (${newAgent.type}, input=${newAgent.input_mode}) to ${configPath}.`);
+  console.log(`Run \`omninode agent test ${newAgent.name}\` to verify the connection.`);
+}
+async function testAgent(name) {
+  const config = loadConfig();
+  const agentConfig = config.project.agents.find((a) => a.name === name);
+  if (!agentConfig) {
+    const available = config.project.agents.map((a) => a.name).join(", ") || "(none)";
+    throw new AgentError(
+      "AGENT_NOT_FOUND",
+      `Agent "${name}" is not configured. Configured agents: ${available}.`
+    );
   }
-  throw new ConfigError(
-    "CONFIG_INVALID",
-    `Unknown memory provider "${config.provider}". Available: local, remembera.`
+  const agent = createAgent(agentConfig);
+  console.log(
+    `Testing agent "${name}" (${agent.info.integration}, input=${agentConfig.inputMode ?? "stdin"}) \u2014 sending a trivial task.`
   );
+  const result = await agent.run({
+    taskId: `test-${Date.now()}`,
+    objective: "Reply with the single word: OK"
+  });
+  console.log(`  status: ${result.status}`);
+  if (result.exitCode !== void 0) console.log(`  exit:   ${result.exitCode}`);
+  if (result.summary) console.log(`  output: ${result.summary}`);
+  if (result.rawOutput && result.rawOutput !== result.summary) {
+    console.log(`  raw:    ${result.rawOutput.slice(0, 200).replace(/\n/g, " ")}`);
+  }
+  if (result.error) console.log(`  error:  ${result.error}`);
+  if (result.status !== "completed") process.exitCode = 1;
 }
 
-// src/memory/service.ts
-var DEFAULT_ENTRY_LIMIT = 8;
-var MAX_CONTEXT_CHARS = 4e3;
-var MemoryService = class {
-  constructor(provider, log = logger, options = {}) {
-    this.provider = provider;
-    this.log = log.child({ component: "memory", provider: provider.name });
-    this.required = options.required ?? false;
-    this.maxContextChars = options.maxContextChars ?? MAX_CONTEXT_CHARS;
+// src/cli/commands/roles.ts
+function registerRoleCommands(program) {
+  const role = program.command("role").description("Inspect roles defined in omninode.yaml.");
+  role.command("list").description("List configured roles.").action(async () => {
+    const config = loadConfig();
+    const roles = config.project.roles;
+    if (roles.length === 0) {
+      console.log("No roles configured. Add one under `project.roles` in omninode.yaml.");
+      return;
+    }
+    for (const role2 of roles) {
+      console.log(`${role2.id}  ${role2.name}`);
+      for (const responsibility of role2.responsibilities) {
+        console.log(`  - ${responsibility}`);
+      }
+    }
+  });
+}
+
+// src/tasks/engine.ts
+import { randomBytes } from "crypto";
+var ALLOWED_TRANSITIONS = {
+  created: ["queued", "running", "cancelled"],
+  queued: ["running", "cancelled"],
+  running: ["completed", "failed", "timed_out", "unknown", "cancelled", "partially_completed"],
+  waiting: ["running", "cancelled"],
+  completed: [],
+  // failed → running is the only re-entry: bounded automatic retry (§6.4).
+  failed: ["running"],
+  timed_out: [],
+  cancelled: [],
+  unknown: [],
+  partially_completed: []
+};
+var RETRYABLE_ERROR_CODES = ["AGENT_FAILED"];
+var EXECUTION_HISTORY_LIMIT = 10;
+var TaskEngine = class {
+  constructor(options) {
+    this.options = options;
+    this.log = (options.log ?? logger).child({ component: "tasks" });
   }
-  provider;
+  options;
   log;
-  required;
-  maxContextChars;
-  get providerRef() {
-    return this.provider;
+  get store() {
+    return this.options.store;
   }
-  get providerName() {
-    return this.provider.name;
+  async create(input) {
+    if (!input.objective || input.objective.trim().length === 0) {
+      throw new TaskError("TASK_INVALID", "Task objective must not be empty.");
+    }
+    if (input.role && !this.options.roles.get(input.role)) {
+      throw new TaskError(
+        "TASK_INVALID",
+        `Role "${input.role}" is not defined. Add it under project.roles in omninode.yaml.`
+      );
+    }
+    if (input.agent && !this.options.agents.get(input.agent)) {
+      throw new TaskError(
+        "TASK_INVALID",
+        `Agent "${input.agent}" is not registered. Add it with \`omninode agent add\`.`
+      );
+    }
+    const now = (/* @__PURE__ */ new Date()).toISOString();
+    const task = {
+      id: generateTaskId(),
+      objective: input.objective.trim(),
+      status: "created",
+      attempt: 0,
+      createdAt: now,
+      updatedAt: now,
+      ...input.project !== void 0 ? { project: input.project } : {},
+      ...input.pipelineId !== void 0 ? { pipelineId: input.pipelineId } : {},
+      ...input.role !== void 0 ? { role: input.role } : {},
+      ...input.agent !== void 0 ? { agent: input.agent } : {},
+      ...input.context !== void 0 ? { context: input.context } : {}
+    };
+    await this.options.store.save(task);
+    this.log.info(`Created task ${task.id}.`);
+    await this.audit("task.created", task, { objective: task.objective });
+    return task;
   }
-  get isRequired() {
-    return this.required;
+  async queue(id) {
+    const task = await this.mustGet(id);
+    return this.transition(task, "queued");
   }
-  /** Structured, budgeted context for a task (§12 — avoid loading all memory). */
-  async contextFor(query) {
-    let entries;
-    try {
-      entries = await this.provider.retrieve({
-        text: query.objective,
-        ...query.role ? { tags: [query.role] } : {},
-        limit: query.limit ?? DEFAULT_ENTRY_LIMIT
+  /** Runs the task through its assigned agent and records the result.
+   *  `maxAttempts` enables bounded automatic retries of *retryable* errors
+   *  with linear backoff; unknown/timed_out outcomes are never auto-retried. */
+  async run(id, options = {}) {
+    const task = await this.mustGet(id);
+    if (task.status !== "created" && task.status !== "queued") {
+      throw new TaskError("TASK_INVALID", `Task ${id} is "${task.status}" and cannot be run.`);
+    }
+    if (!task.agent) {
+      throw new TaskError("TASK_INVALID", `Task ${id} has no agent assigned. Re-create it with --agent.`);
+    }
+    const agent = this.options.agents.get(task.agent);
+    if (!agent) {
+      throw new TaskError("TASK_INVALID", `Agent "${task.agent}" is not registered anymore.`);
+    }
+    const role = task.role ? this.options.roles.get(task.role) : void 0;
+    this.log.info(`Running task ${task.id} on agent "${task.agent}".`);
+    let background = task.context?.background;
+    if (this.options.memory) {
+      const memoryContext = await this.options.memory.gatherContext({
+        objective: task.objective,
+        ...task.role ? { role: task.role } : {},
+        ...task.project ? { project: task.project } : {}
       });
-    } catch (error) {
-      return this.handleFailure("retrieve", error, { text: "", entries: [], truncated: false });
+      if (memoryContext.length > 0) {
+        background = [memoryContext, background].filter((part) => part && part.length > 0).join("\n\n");
+      }
     }
-    return this.format(entries);
-  }
-  /** Prompt-ready context text (v1 convenience wrapper). */
-  async gatherContext(query) {
-    return (await this.contextFor(query)).text;
-  }
-  /** Records a finished task's outcome — task history plus "known problems" (§12). */
-  async recordTaskOutcome(task) {
-    const outcome = task.result?.summary ?? task.result?.error ?? "(no output)";
-    try {
-      await this.provider.store({
-        key: `task:${task.id}`,
-        scope: "task",
-        category: "tasks",
-        content: `Objective: ${task.objective}
-Status: ${task.status}
-Outcome: ${outcome}`,
-        tags: ["task", ...task.agent ? [task.agent] : [], ...task.role ? [task.role] : []],
-        createdAt: task.createdAt
+    const maxAttempts = Math.max(1, options.maxAttempts ?? 1);
+    const backoffMs = options.retryBackoffMs ?? 0;
+    let current = task;
+    for (let i = 0; i < maxAttempts; i += 1) {
+      const attempt = current.attempt + 1;
+      const executionId = `exec-${Date.now().toString(36)}-${randomBytes(3).toString("hex")}`;
+      const startedAt = (/* @__PURE__ */ new Date()).toISOString();
+      current = await this.transition(current, "running", { attempt });
+      await this.options.audit?.record({
+        at: startedAt,
+        action: "agent.started",
+        id: current.id,
+        taskId: current.id,
+        ...current.pipelineId !== void 0 ? { pipelineId: current.pipelineId } : {},
+        agentId: task.agent,
+        executionId,
+        detail: { attempt }
       });
-      const significant = (task.result?.reports ?? []).flatMap(
-        (report) => report.findings.filter((finding) => finding.severity === "high" || finding.severity === "critical").map((finding) => ({ report, finding }))
-      );
-      for (const { report, finding } of significant) {
-        await this.provider.store({
-          key: `finding:${report.id}:${finding.id}`,
-          scope: "project",
-          category: "problems",
-          content: `[${finding.severity}] ${finding.title} \u2014 ${finding.detail}`,
-          tags: ["known-problem", report.agent]
+      let output;
+      let thrown;
+      try {
+        output = await agent.run({
+          taskId: current.id,
+          objective: current.objective,
+          executionId,
+          ...current.pipelineId !== void 0 ? { pipelineId: current.pipelineId } : {},
+          ...role ? { role } : {},
+          ...background !== void 0 ? { context: background } : {}
+        });
+      } catch (error) {
+        thrown = error;
+      }
+      const finishedAt = (/* @__PURE__ */ new Date()).toISOString();
+      await this.options.audit?.record({
+        at: finishedAt,
+        action: "agent.completed",
+        id: current.id,
+        taskId: current.id,
+        ...current.pipelineId !== void 0 ? { pipelineId: current.pipelineId } : {},
+        agentId: task.agent,
+        executionId,
+        detail: { attempt, outcome: thrown !== void 0 || output === void 0 ? "threw" : "returned" }
+      });
+      if (thrown !== void 0 || output === void 0) {
+        const outcome = classifyThrown(thrown);
+        const message = thrown instanceof Error ? thrown.message : String(thrown);
+        const retryable = outcome === "failed" && RETRYABLE_ERROR_CODES.includes(errorCode(thrown)) && i < maxAttempts - 1;
+        current = await this.transition(current, outcome, {
+          attempt,
+          lastError: message,
+          execution: {
+            executionId,
+            attempt,
+            startedAt,
+            finishedAt,
+            outcome,
+            error: message
+          }
         });
+        this.log.warn(`Task ${current.id} attempt ${attempt} \u2192 ${outcome}: ${message}`);
+        if (retryable) {
+          if (backoffMs > 0) await sleep(backoffMs * attempt);
+          continue;
+        }
+        if (this.options.memory) await this.options.memory.recordTaskOutcome(current);
+        return current;
       }
-    } catch (error) {
-      this.handleFailure("store", error, void 0);
+      const currentState = await this.options.store.get(current.id);
+      if (currentState?.status === "cancelled") {
+        current = currentState;
+        break;
+      }
+      const result = {
+        ...output.summary !== void 0 ? { summary: output.summary } : {},
+        ...output.reports !== void 0 && output.reports.length > 0 ? { reports: output.reports } : {},
+        // Keep the verbatim output (bounded) for report extraction and audit.
+        ...output.rawOutput !== void 0 && output.rawOutput.length > 0 ? { rawOutput: output.rawOutput.slice(0, 1e4) } : {},
+        ...output.error !== void 0 ? { error: output.error } : {},
+        finishedAt
+      };
+      const finalStatus = output.status === "completed" ? "completed" : "failed";
+      current = await this.transition(current, finalStatus, {
+        attempt,
+        result,
+        execution: { executionId, attempt, startedAt, finishedAt, outcome: finalStatus }
+      });
+      this.log.info(`Task ${current.id} finished: ${finalStatus}.`);
+      break;
+    }
+    if (this.options.memory) {
+      await this.options.memory.recordTaskOutcome(current);
     }
+    return current;
   }
-  format(entries) {
-    if (entries.length === 0) return { text: "", entries, truncated: false };
-    const byScope = /* @__PURE__ */ new Map();
-    for (const entry2 of entries) {
-      byScope.set(entry2.scope, [...byScope.get(entry2.scope) ?? [], entry2]);
+  async cancel(id) {
+    const task = await this.mustGet(id);
+    if (!ALLOWED_TRANSITIONS[task.status].includes("cancelled")) {
+      throw new TaskError("TASK_INVALID", `Task ${id} is "${task.status}" and cannot be cancelled.`);
     }
-    const parts = [];
-    for (const scope of ["project", "task", "role", "knowledge"]) {
-      const scopeEntries = byScope.get(scope) ?? [];
-      if (scopeEntries.length === 0) continue;
-      const lines = scopeEntries.map((entry2) => {
-        const category = entry2.category ? `[${entry2.category}] ` : "";
-        return `- ${category}${entry2.content}`;
-      }).join("\n");
-      parts.push(`### Relevant memory (${scope})
-${lines}`);
+    if (task.agent) {
+      const agent = this.options.agents.get(task.agent);
+      await agent?.cancel?.(task.id);
     }
-    let text = parts.join("\n\n");
-    const truncated = text.length > this.maxContextChars;
-    if (truncated) text = `${text.slice(0, this.maxContextChars - 1)}\u2026`;
-    return { text, entries, truncated };
+    return this.transition(task, "cancelled");
   }
-  /**
-   * Failure policy (§12): continue unless memory is explicitly required.
-   */
-  handleFailure(operation, error, fallback) {
-    const message = error instanceof Error ? error.message : String(error);
-    if (this.required) {
-      throw new MemoryError(
-        `Memory is marked required, but ${operation} failed: ${message}`,
-        { cause: error }
+  /** Error recovery: reset a failed/cancelled/unknown/timed_out task so it can run again. */
+  async retry(id) {
+    const task = await this.mustGet(id);
+    const retryableStates = ["failed", "cancelled", "unknown", "timed_out"];
+    if (!retryableStates.includes(task.status)) {
+      throw new TaskError(
+        "TASK_INVALID",
+        `Only failed, timed out, unknown or cancelled tasks can be retried \u2014 task ${id} is "${task.status}".`
       );
     }
-    this.log.warn(`Memory ${operation} failed (continuing without memory): ${message}`);
-    return fallback ?? { text: "", entries: [], truncated: false };
+    const { result: _discarded, ...rest } = task;
+    const reset = {
+      ...rest,
+      status: "created",
+      updatedAt: (/* @__PURE__ */ new Date()).toISOString()
+    };
+    await this.options.store.save(reset);
+    await this.audit("task.retry", reset, { from: task.status });
+    this.log.info(`Task ${id} reset for retry.`);
+    return reset;
   }
-};
-
-// src/roles/index.ts
-var RoleRegistry = class {
-  roles = /* @__PURE__ */ new Map();
-  register(role) {
-    this.roles.set(role.id, role);
+  async get(id) {
+    return this.options.store.get(id);
   }
-  registerAll(roles) {
-    for (const role of roles) this.register(role);
+  async list(filter) {
+    return this.options.store.list(filter);
   }
-  get(id) {
-    return this.roles.get(id);
+  async mustGet(id) {
+    const task = await this.options.store.get(id);
+    if (!task) {
+      throw new TaskError("TASK_NOT_FOUND", `Task "${id}" does not exist in this project's task store.`);
+    }
+    return task;
   }
-  list() {
-    return [...this.roles.values()].sort((a, b) => a.id.localeCompare(b.id));
+  async transition(task, to, extra = {}) {
+    const allowed = ALLOWED_TRANSITIONS[task.status] ?? [];
+    if (!allowed.includes(to)) {
+      throw new TaskError("TASK_INVALID", `Task ${task.id} cannot move from "${task.status}" to "${to}".`);
+    }
+    const executions = extra.execution ? [...task.executions ?? [], extra.execution].slice(-EXECUTION_HISTORY_LIMIT) : task.executions;
+    const updated = {
+      ...task,
+      status: to,
+      updatedAt: (/* @__PURE__ */ new Date()).toISOString(),
+      ...extra.attempt !== void 0 ? { attempt: extra.attempt } : {},
+      ...extra.lastError !== void 0 ? { lastError: extra.lastError } : {},
+      ...executions !== void 0 ? { executions } : {},
+      ...extra.result !== void 0 ? { result: { ...task.result, ...extra.result } } : {}
+    };
+    await this.options.store.save(updated);
+    await this.audit(`task.${to === "queued" ? "queued" : to}`, updated, {
+      from: task.status
+    });
+    return updated;
+  }
+  async audit(action, task, detail, executionId) {
+    await this.options.audit?.record({
+      at: (/* @__PURE__ */ new Date()).toISOString(),
+      action,
+      id: task.id,
+      taskId: task.id,
+      ...task.project !== void 0 ? { project: task.project } : {},
+      ...task.pipelineId !== void 0 ? { pipelineId: task.pipelineId } : {},
+      ...task.agent !== void 0 ? { agentId: task.agent } : {},
+      ...executionId !== void 0 ? { executionId } : {},
+      ...detail !== void 0 ? { detail } : {}
+    });
   }
 };
-function buildRoleRegistry(config) {
-  const registry = new RoleRegistry();
-  registry.registerAll(config.project.roles);
-  return registry;
+function generateTaskId() {
+  return `task-${Date.now().toString(36)}-${randomBytes(3).toString("hex")}`;
+}
+function errorCode(error) {
+  return error?.code ?? "";
+}
+function classifyThrown(error) {
+  if (error instanceof AgentError && error.code === "AGENT_TIMEOUT") {
+    const dispatched = error.details?.dispatched;
+    return dispatched === false ? "timed_out" : "unknown";
+  }
+  return "failed";
 }
+function sleep(ms) {
+  return new Promise((resolve2) => setTimeout(resolve2, ms));
+}
+
+// src/audit/index.ts
+import { appendFile, mkdir as mkdir2, readFile as readFile2 } from "fs/promises";
+import { dirname as dirname2 } from "path";
+var FileAuditLog = class {
+  filePath;
+  log;
+  constructor(directory = `${process.cwd()}/.omninode`, log = logger) {
+    this.filePath = `${directory}/audit.jsonl`;
+    this.log = log.child({ component: "audit" });
+  }
+  async record(event) {
+    try {
+      await mkdir2(dirname2(this.filePath), { recursive: true });
+      await appendFile(this.filePath, `${JSON.stringify(event)}
+`, "utf8");
+    } catch (error) {
+      this.log.warn(
+        `Audit write failed: ${error instanceof Error ? error.message : String(error)}`
+      );
+    }
+  }
+  /** Recent events, oldest first; used by the CLI. */
+  async recent(limit = 20) {
+    let raw;
+    try {
+      raw = await readFile2(this.filePath, "utf8");
+    } catch {
+      return [];
+    }
+    const events = raw.split("\n").filter((line) => line.length > 0).map((line) => {
+      try {
+        return JSON.parse(line);
+      } catch {
+        return void 0;
+      }
+    }).filter((event) => event !== void 0);
+    return events.slice(-limit);
+  }
+};
 
 // src/tasks/engine-factory.ts
 function createTaskEngine(config, log = logger, directory) {
@@ -3038,6 +2659,7 @@ function registerTaskCommands(program) {
     printOutcome(finished);
     if (finished.status !== "completed") process.exitCode = 1;
   });
+  registerTaskInspect(task);
 }
 function printOutcome(task, options = {}) {
   console.log(`  id:      ${task.id}`);
@@ -3384,6 +3006,7 @@ function truncate4(text, max) {
 }
 
 // src/reports/service.ts
+var MAX_REPORT_BYTES = 256 * 1024;
 var ReportService = class {
   constructor(store, log = logger) {
     this.store = store;
@@ -3418,6 +3041,16 @@ var ReportService = class {
     const reports = [];
     const rejected = [];
     for (const candidate of candidates) {
+      const size = Buffer.byteLength(JSON.stringify(candidate), "utf8");
+      if (size > MAX_REPORT_BYTES) {
+        rejected.push({
+          key: candidate?.id ?? "(unknown)",
+          reason: `report exceeds the ${MAX_REPORT_BYTES} byte limit (${size} bytes)`,
+          issues: []
+        });
+        this.log.warn(`Rejected oversized report (${size} bytes).`);
+        continue;
+      }
       const result = validateReport(candidate);
       if (result.valid) {
         reports.push(result.report);
@@ -4082,6 +3715,7 @@ var PipelineEngine = class {
       at: (/* @__PURE__ */ new Date()).toISOString(),
       action: "pipeline.run.started",
       id: run2.id,
+      pipelineId: def.id,
       detail: { pipeline: def.id, objective }
     });
     const deps = this.effectiveDependencies(def);
@@ -4122,7 +3756,9 @@ var PipelineEngine = class {
             combinedContext: contextParts.join("\n\n"),
             reports: [...allReports],
             pipelineRunId: run2.id,
-            runId: run2.id
+            runId: run2.id,
+            pipelineDefId: def.id,
+            taskId: run2.id
           };
           return this.executeStep(step, ctx);
         })
@@ -4199,8 +3835,9 @@ ${contribution}`);
     this.log.info(`Pipeline ${def.id} finished: ${finalStatus}.`);
     await this.options.audit?.record({
       at: (/* @__PURE__ */ new Date()).toISOString(),
-      action: "pipeline.run.finished",
+      action: cancelled ? "pipeline.run.cancelled" : finalStatus === "failed" ? "pipeline.run.failed" : "pipeline.run.finished",
       id: run2.id,
+      pipelineId: def.id,
       detail: { pipeline: def.id, status: finalStatus }
     });
     return finished;
@@ -4281,6 +3918,7 @@ ${contribution}`);
       agentNames.map(
         (name) => this.options.tasks.create({
           objective: ctx.objective,
+          ...ctx.pipelineRunId !== void 0 ? { pipelineId: ctx.pipelineRunId } : {},
           agent: name,
           ...ctx.role ? { role: ctx.role.id } : {},
           ...ctx.combinedContext.length > 0 ? { context: { background: ctx.combinedContext } } : {}
@@ -4323,6 +3961,7 @@ ${contribution}`);
   async runSingle(step, ctx, agentName) {
     const task = await this.options.tasks.create({
       objective: ctx.objective,
+      ...ctx.pipelineRunId !== void 0 ? { pipelineId: ctx.pipelineRunId } : {},
       agent: agentName,
       ...ctx.role ? { role: ctx.role.id } : {},
       ...ctx.combinedContext.length > 0 ? { context: { background: ctx.combinedContext } } : {}
@@ -4393,7 +4032,13 @@ ${contribution}`);
       at: (/* @__PURE__ */ new Date()).toISOString(),
       action: "plan.generated",
       id: plan.id,
-      detail: { generatedBy: plan.generatedBy, steps: plan.steps.length }
+      ...ctx.pipelineDefId !== void 0 ? { pipelineId: ctx.pipelineDefId } : {},
+      detail: {
+        generatedBy: plan.generatedBy,
+        steps: plan.steps.length,
+        run: ctx.pipelineRunId,
+        taskId: ctx.taskId
+      }
     });
     return {
       status: "completed",
@@ -4427,7 +4072,7 @@ function formatPlan(plan) {
   }
   return lines.join("\n");
 }
-function createDefaultChatFn(providers) {
+function createDefaultChatFn(providers, options = {}) {
   return async (modelRef, messages) => {
     const separator = modelRef.indexOf(":");
     if (separator <= 0 || separator === modelRef.length - 1) {
@@ -4445,33 +4090,15 @@ function createDefaultChatFn(providers) {
         `Provider "${providerName}" (model "${modelRef}") is not configured.`
       );
     }
-    const provider = createProvider(providerConfig);
+    const provider = createProvider(providerConfig, {
+      ...options.audit !== void 0 ? { audit: options.audit } : {},
+      ...options.env !== void 0 ? { env: options.env } : {}
+    });
     const response = await provider.chat({ model: modelId, messages });
     return response.content;
   };
 }
 
-// src/pipelines/store.ts
-var FilePipelineRunStore = class extends JsonFileStore {
-  constructor(directory) {
-    super({ ...directory !== void 0 ? { directory } : {}, fileName: "pipelines.json" });
-  }
-  save(run2) {
-    return this.mutate((runs) => {
-      const index = runs.findIndex((r) => r.id === run2.id);
-      if (index >= 0) runs[index] = run2;
-      else runs.push(run2);
-      return [runs, void 0];
-    });
-  }
-  async get(id) {
-    return (await this.readAll()).find((r) => r.id === id);
-  }
-  async list(filter = {}) {
-    return (await this.readAll()).filter((run2) => filter.pipelineId ? run2.pipelineId === filter.pipelineId : true).filter((run2) => filter.status ? run2.status === filter.status : true).sort((a, b) => (a.startedAt ?? "").localeCompare(b.startedAt ?? ""));
-  }
-};
-
 // src/planner/store.ts
 var FilePlanStore = class extends JsonFileStore {
   constructor(directory) {
@@ -4516,9 +4143,10 @@ function buildPlanner(plannerConfig, chat, log = logger) {
 
 // src/pipelines/engine-factory.ts
 function buildPipelineEngine(config, log = logger) {
+  const auditLog = new FileAuditLog();
   const agents = buildAgentRegistry(config, log);
   const roles = buildRoleRegistry(config);
-  const chat = createDefaultChatFn(config.project.providers);
+  const chat = createDefaultChatFn(config.project.providers, { audit: auditLog });
   const tasks = new TaskEngine({
     agents,
     roles,
@@ -4646,6 +4274,7 @@ function registerPipelineCommands(program) {
       console.log(`  reports:    ${run2.reports.length}`);
     }
   });
+  registerPipelineInspect(pipeline);
 }
 async function runPipelineAction(id, objective) {
   const config = loadConfig();
@@ -4955,6 +4584,72 @@ function registerMigrateCommand(program) {
   });
 }
 
+// src/cli/commands/security.ts
+function registerSecurityCommand(program) {
+  program.command("security").description("Inspect a project's security posture (advisory).").argument("[action]", "Action to perform.", "audit").action(async (action) => {
+    if (action !== "audit") {
+      console.log(`Unknown security action "${action}". Available: audit.`);
+      return;
+    }
+    const config = loadConfig();
+    const findings = [];
+    for (const agent of config.project.agents) {
+      const policy = resolveEnvPolicy(agent);
+      if (policy === "inherit") {
+        findings.push({
+          severity: "warn",
+          subject: `agent "${agent.name}"`,
+          message: "inherits the full environment \u2014 provider keys in OmniNode's environment are visible to it. Consider env_policy: allowlist|denylist|explicit."
+        });
+      }
+      if (agent.allowExternalCwd) {
+        findings.push({
+          severity: "info",
+          subject: `agent "${agent.name}"`,
+          message: "may run outside the project root (allow_external_cwd)."
+        });
+      }
+      if (agent.env && Object.keys(agent.env).length > 0) {
+        findings.push({
+          severity: "info",
+          subject: `agent "${agent.name}"`,
+          message: `receives ${Object.keys(agent.env).length} explicit environment variable(s).`
+        });
+      }
+    }
+    for (const provider of config.project.providers) {
+      if (!provider.apiKeyEnvVar) {
+        findings.push({
+          severity: "info",
+          subject: `provider "${provider.name}"`,
+          message: "no api_key_env_var \u2014 fine for keyless local endpoints, otherwise credentials cannot be resolved."
+        });
+      }
+    }
+    if (config.project.memory?.provider === "remembera" && !config.project.memory.apiKeyEnvVar) {
+      findings.push({
+        severity: "warn",
+        subject: "memory",
+        message: "Remembera is configured without api_key_env_var; requests will be unauthenticated."
+      });
+    }
+    console.log(`OmniNode security audit \u2014 project "${config.project.name}"`);
+    if (findings.length === 0) {
+      console.log("  no findings.");
+    }
+    for (const finding of findings) {
+      console.log(`  [${finding.severity.toUpperCase()}] ${finding.subject}: ${finding.message}`);
+    }
+    console.log(
+      `
+Trust model: agents execute with the permissions of the OS user running OmniNode.`
+    );
+    console.log(
+      `OmniNode does not sandbox agents \u2014 run untrusted agents in a container or as a dedicated user.`
+    );
+  });
+}
+
 // src/cli/index.ts
 function createProgram() {
   const program = new Command();
@@ -4975,10 +4670,21 @@ function createProgram() {
   registerStatusCommand(program);
   registerAuditCommand(program);
   registerMigrateCommand(program);
+  registerSecurityCommand(program);
   registerRunAlias(program);
   return program;
 }
+function applyLoggingConfig() {
+  try {
+    if (findConfigFile()) {
+      const logging = loadConfig().logging;
+      if (logging) configureLogger(logging);
+    }
+  } catch {
+  }
+}
 async function run(argv) {
+  applyLoggingConfig();
   const program = createProgram();
   try {
     await program.parseAsync(argv);