@hilbras/omninode 2.0.0-alpha.14 → 2.0.0-alpha.16

package/dist/cli/index.js

@@ -23,7 +23,49 @@ import { realpathSync } from "fs";
 import { Command } from "commander";
 
 // src/version.ts
-var OMNINODE_VERSION = "2.0.0-alpha.14";
+var OMNINODE_VERSION = "2.0.0-alpha.16";
+
+// src/cli/exit-codes.ts
+var EXIT = {
+  success: 0,
+  general: 1,
+  invalidInput: 2,
+  config: 3,
+  provider: 4,
+  agent: 5,
+  timeout: 6,
+  cancelled: 7,
+  notFound: 8,
+  notImplemented: 9
+};
+function exitCodeFor(error) {
+  if (!isOmniNodeError(error)) return EXIT.general;
+  const code = error.code;
+  if (code === "NOT_IMPLEMENTED") return EXIT.notImplemented;
+  if (code === "AGENT_TIMEOUT") return EXIT.timeout;
+  if (code.startsWith("CONFIG_")) return EXIT.config;
+  if (code.startsWith("PROVIDER_") || code === "MODEL_NOT_FOUND") return EXIT.provider;
+  if (code.startsWith("AGENT_")) return EXIT.agent;
+  if (code.endsWith("_NOT_FOUND")) return EXIT.notFound;
+  if (code.endsWith("_INVALID") || code === "CLI_USAGE" || code === "PROTOCOL_VIOLATION") {
+    return EXIT.invalidInput;
+  }
+  return EXIT.general;
+}
+function exitCodeForStatus(status) {
+  switch (status) {
+    case "completed":
+      return EXIT.success;
+    case "cancelled":
+      return EXIT.cancelled;
+    case "timed_out":
+      return EXIT.timeout;
+    case "failed":
+      return EXIT.general;
+    default:
+      return EXIT.success;
+  }
+}
 
 // src/config/schema.ts
 import { z } from "zod";
@@ -105,6 +147,10 @@ var projectConfigSchema = z.object({
   }).strict().optional()
 }).strict();
 var appConfigSchema = z.object({
+  /** Active profile; overlays live under `profiles` (§16). */
+  profile: z.string().min(1).optional(),
+  /** Named partial overlays, e.g. development/production/testing. */
+  profiles: z.record(z.unknown()).optional(),
   project: projectConfigSchema,
   logging: z.object({
     level: z.enum(["debug", "info", "warn", "error"]),
@@ -145,6 +191,85 @@ ${lines}
 OmniNode never stores credentials in configuration. Replace each value with an environment-variable reference, e.g. api_key_env_var: MY_API_KEY.`;
 }
 
+// src/config/profiles.ts
+import { homedir } from "os";
+import path from "path";
+function userConfigPath(env = process.env) {
+  if (env.OMNINODE_USER_CONFIG) return env.OMNINODE_USER_CONFIG;
+  const home = env.HOME ?? homedir();
+  return path.join(home, ".omninode", "config.yaml");
+}
+function resolveProfile(input, env) {
+  if (env.OMNINODE_PROFILE) return env.OMNINODE_PROFILE;
+  if (typeof input.profile === "string" && input.profile.length > 0) return input.profile;
+  return "default";
+}
+function mergeConfig(base, overlay) {
+  if (!isPlainObject(base) || !isPlainObject(overlay)) {
+    return overlay === void 0 ? base : overlay;
+  }
+  const result = { ...base };
+  for (const [key, value] of Object.entries(overlay)) {
+    const existing = result[key];
+    if (Array.isArray(value)) {
+      result[key] = value;
+    } else if (isPlainObject(value) && isPlainObject(existing)) {
+      result[key] = mergeConfig(existing, value);
+    } else {
+      result[key] = value;
+    }
+  }
+  return result;
+}
+function isPlainObject(value) {
+  return value !== null && typeof value === "object" && !Array.isArray(value);
+}
+function asObject(value) {
+  return isPlainObject(value) ? value : {};
+}
+function applyEnvOverrides(input, env) {
+  const applied = [];
+  const config = mergeConfig(input, {});
+  if (env.OMNINODE_LOG_LEVEL) {
+    config.logging = { ...asObject(config.logging), level: env.OMNINODE_LOG_LEVEL };
+    applied.push("OMNINODE_LOG_LEVEL");
+  }
+  if (env.OMNINODE_LOG_FORMAT) {
+    config.logging = { ...asObject(config.logging), format: env.OMNINODE_LOG_FORMAT };
+    applied.push("OMNINODE_LOG_FORMAT");
+  }
+  const memoryProvider = env.OMNINODE_MEMORY_PROVIDER;
+  const memoryRequired = env.OMNINODE_MEMORY_REQUIRED;
+  if (memoryProvider || memoryRequired) {
+    const project = asObject(config.project);
+    config.project = {
+      ...project,
+      memory: {
+        ...asObject(project.memory ?? { provider: "local" }),
+        ...memoryProvider ? { provider: memoryProvider } : {},
+        ...memoryRequired ? { required: memoryRequired !== "false" } : {}
+      }
+    };
+    if (memoryProvider) applied.push("OMNINODE_MEMORY_PROVIDER");
+    if (memoryRequired) applied.push("OMNINODE_MEMORY_REQUIRED");
+  }
+  return { config, applied };
+}
+function applyDefaults(input) {
+  const applied = [];
+  const config = mergeConfig(input, {});
+  const logging = asObject(config.logging);
+  if (logging.level === void 0) {
+    config.logging = { ...logging, level: "info" };
+    applied.push("logging.level");
+  }
+  if (logging.format === void 0) {
+    config.logging = { ...asObject(config.logging), format: "text" };
+    applied.push("logging.format");
+  }
+  return { config, applied };
+}
+
 // src/config/loader.ts
 import { existsSync, readFileSync } from "fs";
 import { parse as parseYaml } from "yaml";
@@ -171,38 +296,108 @@ function expandEnvRefs(text, env, source = "config") {
     }
   );
 }
-function loadConfig(options = {}) {
+function loadConfigDetailed(options = {}) {
   const env = options.env ?? process.env;
-  const path = options.path ?? (options.directory ? findConfigFile(options.directory) : findConfigFile());
-  if (!path) {
+  const explicitPath = options.path;
+  let input = {};
+  let projectFile;
+  let userFile;
+  if (!explicitPath) {
+    const candidate = userConfigPath(env);
+    if (existsSync(candidate)) {
+      input = mergeConfig(input, readConfigDocument(candidate, env));
+      userFile = candidate;
+    }
+  }
+  const resolvedProject = explicitPath ?? (options.directory ? findConfigFile(options.directory) : findConfigFile());
+  if (resolvedProject) {
+    input = mergeConfig(input, readConfigDocument(resolvedProject, env));
+    projectFile = resolvedProject;
+  }
+  if (!projectFile && !userFile) {
     throw new ConfigError(
       "CONFIG_NOT_FOUND",
       "No omninode.yaml found. Run `omninode init` to create one, or pass an explicit path."
     );
   }
-  const raw = readFileSync(path, "utf8");
+  const profile = options.profile ?? resolveProfile(input, env);
+  const overlay = input.profiles?.[profile];
+  if (overlay !== void 0) {
+    const { profiles: _drop, ...base } = input;
+    input = mergeConfig(base, overlay);
+  } else if (profile !== "default" && profile !== "") {
+    throw new ConfigError(
+      "CONFIG_INVALID",
+      `Profile "${profile}" is not defined in this configuration (known: ${Object.keys(input.profiles ?? {}).join(", ") || "none"}).`
+    );
+  }
+  const withEnv = applyEnvOverrides(input, env);
+  const withDefaults = applyDefaults(withEnv.config);
+  const parsed = appConfigSchema.safeParse(withDefaults.config);
+  if (!parsed.success) {
+    const issues = parsed.error.issues.map((issue) => {
+      const location = issue.path.join(".") || "(root)";
+      return `${location}: ${issue.message}`;
+    });
+    throw new ConfigError(
+      "CONFIG_INVALID",
+      `Invalid configuration:
+  ${issues.join("\n  ")}`,
+      { details: { issues } }
+    );
+  }
+  return {
+    config: toAppConfig(parsed.data),
+    sources: {
+      ...projectFile !== void 0 ? { projectFile } : {},
+      ...userFile !== void 0 ? { userFile } : {},
+      profile,
+      envOverrides: withEnv.applied,
+      defaults: withDefaults.applied
+    }
+  };
+}
+function readConfigDocument(path2, optionsEnv) {
+  const raw = readFileSync(path2, "utf8");
   const secretFindings = scanForInlineSecrets(raw);
   if (secretFindings.length > 0) {
-    throw new ConfigError("CONFIG_INVALID", describeSecretFindings(path, secretFindings));
+    throw new ConfigError("CONFIG_INVALID", describeSecretFindings(path2, secretFindings));
   }
-  const expanded = expandEnvRefs(raw, env, path);
-  let data;
+  const expanded = expandEnvRefs(raw, optionsEnv, path2);
   try {
-    data = parseYaml(expanded);
+    return parseYaml(expanded);
   } catch (error) {
-    throw new ConfigError("CONFIG_INVALID", `Failed to parse ${path}.`, { cause: error });
+    throw new ConfigError("CONFIG_INVALID", `Failed to parse ${path2}.`, { cause: error });
   }
-  const parsed = appConfigSchema.safeParse(data);
-  if (!parsed.success) {
-    const issues = parsed.error.issues.map((issue) => {
-      const location = issue.path.length > 0 ? issue.path.join(".") : "(root)";
-      return `${location}: ${issue.message}`;
-    });
-    throw new ConfigError("CONFIG_INVALID", `Invalid configuration in ${path}.`, {
-      details: { issues }
-    });
+}
+function configDiagnostics(config) {
+  const notes = [];
+  for (const provider of config.project.providers) {
+    if (!provider.apiKeyEnvVar && provider.baseUrl.startsWith("https://")) {
+      notes.push(
+        `Provider "${provider.name}": API key reference is missing \u2014 add api_key_env_var: <ENV_VAR> unless this endpoint is intentionally keyless.`
+      );
+    }
   }
-  return toAppConfig(parsed.data);
+  for (const agent of config.project.agents) {
+    if (!agent.command && agent.integration !== "custom") {
+      notes.push(`Agent "${agent.name}": no command configured \u2014 the process adapter needs one.`);
+    }
+    if (agent.allowExternalCwd) {
+      notes.push(`Agent "${agent.name}": may run outside the project root (allow_external_cwd).`);
+    }
+  }
+  for (const pipeline of config.project.pipelines) {
+    const ids = new Set(pipeline.steps.map((s) => s.id));
+    for (const step of pipeline.steps) {
+      for (const dep of step.dependsOn ?? []) {
+        if (!ids.has(dep)) {
+          notes.push(`Pipeline "${pipeline.id}": step "${step.id}" depends on unknown step "${dep}".`);
+        }
+      }
+    }
+  }
+  return notes;
 }
 function toAppConfig(yaml) {
   return {
@@ -330,6 +525,18 @@ function defaultProjectConfigYaml(projectName = "My Project") {
 `;
 }
 
+// src/cli/options.ts
+var cliConfigOptions = {};
+function loadProjectConfig() {
+  return loadConfigDetailed({
+    ...cliConfigOptions.path !== void 0 ? { path: cliConfigOptions.path } : {},
+    ...cliConfigOptions.profile !== void 0 ? { profile: cliConfigOptions.profile } : {}
+  }).config;
+}
+function activeConfigPath() {
+  return cliConfigOptions.path ?? findConfigFile();
+}
+
 // src/cli/commands/init.ts
 import { existsSync as existsSync2, writeFileSync } from "fs";
 async function runInit(options) {
@@ -357,6 +564,10 @@ function registerProjectCommands(program) {
   project.command("init").description("Alias of `omninode init`.").option("-f, --force", "Overwrite an existing omninode.yaml.").option("-n, --name <name>", "Project name to write into the configuration.", "My Project").action(async (options) => runInit(options));
 }
 
+// src/cli/commands/providers.ts
+import { readFileSync as readFileSync3, writeFileSync as writeFileSync3 } from "fs";
+import { parseDocument as parseDocument2 } from "yaml";
+
 // src/registry/index.ts
 function registryKey(provider, id) {
   return `${provider}:${id}`;
@@ -409,17 +620,11 @@ var ModelRegistry = class {
 // src/cli/commands/shared.ts
 import { readFileSync as readFileSync2, writeFileSync as writeFileSync2 } from "fs";
 import { parseDocument } from "yaml";
-function notImplemented(command, when) {
-  return new OmniNodeError(
-    "NOT_IMPLEMENTED",
-    `${command} is planned for ${when}. Edit omninode.yaml directly for now.`
-  );
-}
 function truncate(text, max) {
   return text.length > max ? `${text.slice(0, max - 1)}\u2026` : text;
 }
 function appendToConfigList(listKey, item) {
-  const configPath = findConfigFile();
+  const configPath = activeConfigPath();
   if (!configPath) {
     throw new OmniNodeError("CONFIG_NOT_FOUND", "No omninode.yaml found. Run `omninode init` first.");
   }
@@ -1325,15 +1530,15 @@ async function writeFileAtomic(target, contents, durability = "rename") {
     }
   }
 }
-async function inspectDocument(path) {
+async function inspectDocument(path2) {
   let raw;
   try {
-    await stat(path);
+    await stat(path2);
   } catch {
     return { status: "missing" };
   }
   try {
-    raw = await readFile(path, "utf8");
+    raw = await readFile(path2, "utf8");
   } catch (error) {
     return { status: "corrupt", detail: `unreadable: ${error instanceof Error ? error.message : String(error)}` };
   }
@@ -1353,21 +1558,21 @@ async function inspectDocument(path) {
   if (version < SCHEMA_VERSION) return { status: "v1-legacy" };
   return { status: "current", schemaVersion: version, count: doc.items.length };
 }
-async function readDocument(path, onCorrupt, quarantine = true) {
-  const state = await inspectDocument(path);
+async function readDocument(path2, onCorrupt, quarantine = true) {
+  const state = await inspectDocument(path2);
   if (state.status === "missing" || state.status === "empty") return [];
   if (state.status === "future") {
     const error = new Error(
-      `${path} was written by a newer OmniNode (schema v${state.schemaVersion} > v${SCHEMA_VERSION})`
+      `${path2} was written by a newer OmniNode (schema v${state.schemaVersion} > v${SCHEMA_VERSION})`
     );
-    onCorrupt?.(path, error);
+    onCorrupt?.(path2, error);
     return [];
   }
   let raw;
   try {
-    raw = await readFile(path, "utf8");
+    raw = await readFile(path2, "utf8");
   } catch (error) {
-    onCorrupt?.(path, error);
+    onCorrupt?.(path2, error);
     return [];
   }
   try {
@@ -1376,16 +1581,16 @@ async function readDocument(path, onCorrupt, quarantine = true) {
     return parsed.items ?? [];
   } catch (error) {
     if (quarantine) {
-      const quarantinePath = `${path}.corrupt-${Date.now()}`;
+      const quarantinePath = `${path2}.corrupt-${Date.now()}`;
       try {
-        await rename(path, quarantinePath);
+        await rename(path2, quarantinePath);
         logger.child({ component: "persistence" }).warn(
-          `Quarantined unreadable store file ${path} \u2192 ${quarantinePath}`
+          `Quarantined unreadable store file ${path2} \u2192 ${quarantinePath}`
         );
       } catch {
       }
     }
-    onCorrupt?.(path, error);
+    onCorrupt?.(path2, error);
     return [];
   }
 }
@@ -1915,7 +2120,7 @@ function registerPipelineInspect(pipelineGroup) {
 function registerAgentInspect(agentGroup) {
   jsonOption(
     agentGroup.command("inspect <name>").description("Show an agent's effective configuration and recent tasks.").action(async (name, options) => {
-      const config = loadConfig();
+      const config = loadProjectConfig();
       const agentConfig = config.project.agents.find((a) => a.name === name);
       if (!agentConfig) throw new OmniNodeError("AGENT_NOT_FOUND", `No agent "${name}" is configured.`);
       const registry = buildAgentRegistry(config);
@@ -1945,7 +2150,7 @@ function registerAgentInspect(agentGroup) {
 function registerProviderInspect(providerGroup) {
   jsonOption(
     providerGroup.command("inspect <name>").description("Show a provider's authentication status and capabilities.").action(async (name, options) => {
-      const config = loadConfig();
+      const config = loadProjectConfig();
       const providerConfig = config.project.providers.find((p) => p.name === name);
       if (!providerConfig) throw new OmniNodeError("PROVIDER_NOT_FOUND", `No provider "${name}" is configured.`);
       const { createProvider: createProvider2 } = await import("./providers-OYXBAQTX.js");
@@ -1977,9 +2182,13 @@ function registerProviderInspect(providerGroup) {
 // src/cli/commands/providers.ts
 function registerProviderCommands(program) {
   const provider = program.command("provider").description("Manage AI providers configured in omninode.yaml.");
-  provider.command("list").description("List configured providers.").action(async () => {
-    const config = loadConfig();
+  provider.command("list").description("List configured providers.").option("--json", "Emit providers as JSON.").action(async (options) => {
+    const config = loadProjectConfig();
     const providers = config.project.providers;
+    if (options.json) {
+      console.log(JSON.stringify(providers, null, 2));
+      return;
+    }
     if (providers.length === 0) {
       console.log(
         "No providers configured. Add one with `omninode provider add` or edit omninode.yaml."
@@ -2008,13 +2217,13 @@ function registerProviderCommands(program) {
     "--connect",
     "Run the full provider connect flow (authenticate, fetch, validate, register) where the adapter supports it."
   ).action(async (name, options) => testProvider(name, options));
-  provider.command("remove <name>").description("Remove a provider (planned for Phase 1 follow-up).").action(() => {
-    throw notImplemented("omninode provider remove", "a Phase 1 follow-up");
+  provider.command("remove <name>").description("Remove a provider from omninode.yaml.").action((name) => {
+    removeProvider(name);
   });
   registerProviderInspect(provider);
 }
 async function addProvider(options) {
-  const configPath = findConfigFile();
+  const configPath = activeConfigPath();
   if (!configPath) {
     throw new OmniNodeError("CONFIG_NOT_FOUND", "No omninode.yaml found. Run `omninode init` first.");
   }
@@ -2029,11 +2238,11 @@ async function addProvider(options) {
     throw new OmniNodeError("CLI_USAGE", `Invalid provider options: ${issues}`);
   }
   const newProvider = candidate.data;
-  const existing = loadConfig();
+  const existing = loadProjectConfig();
   if (existing.project.providers.some((p) => p.name === newProvider.name)) {
     throw new OmniNodeError(
       "CLI_USAGE",
-      `Provider "${newProvider.name}" already exists in ${findConfigFile() ?? "omninode.yaml"}.`
+      `Provider "${newProvider.name}" already exists in ${activeConfigPath() ?? "omninode.yaml"}.`
     );
   }
   const writtenPath = appendToConfigList("providers", newProvider);
@@ -2046,8 +2255,28 @@ async function addProvider(options) {
     console.log(`Run \`omninode provider test ${newProvider.name}\` to verify connectivity.`);
   }
 }
+function removeProvider(name) {
+  const configPath = activeConfigPath();
+  if (!configPath) {
+    throw new OmniNodeError("CONFIG_NOT_FOUND", "No omninode.yaml found.");
+  }
+  const config = loadProjectConfig();
+  if (!config.project.providers.some((p) => p.name === name)) {
+    throw new ProviderError("PROVIDER_NOT_FOUND", `No provider "${name}" is configured.`);
+  }
+  const doc = parseDocument2(readFileSync3(configPath, "utf8"));
+  const current = doc.getIn(["project", "providers"]);
+  const remaining = (current === void 0 || current === null ? [] : doc.get("project")?.providers ?? []).filter((entry2) => entry2?.name !== name);
+  doc.setIn(["project", "providers"], remaining);
+  const validated = appConfigSchema.safeParse(doc.toJS());
+  if (!validated.success) {
+    throw new OmniNodeError("CONFIG_INVALID", "Removing this provider would produce an invalid configuration.");
+  }
+  writeFileSync3(configPath, doc.toString(), "utf8");
+  console.log(`Removed provider "${name}" from ${configPath}.`);
+}
 async function testProvider(name, options = {}) {
-  const config = loadConfig();
+  const config = loadProjectConfig();
   const providerConfig = config.project.providers.find((p) => p.name === name);
   if (!providerConfig) {
     const available = config.project.providers.map((p) => p.name).join(", ") || "(none)";
@@ -2081,169 +2310,6 @@ function printProviderStatus(status) {
   if (status.message) console.log(`  detail:    ${status.message}`);
 }
 
-// src/cli/commands/models.ts
-var CAPABILITIES = [
-  "chat",
-  "coding",
-  "tools",
-  "vision",
-  "embeddings"
-];
-function registerModelsCommand(program) {
-  program.command("models").description("Discover and list models from configured providers (model registry, \xA78).").argument("[provider]", "Only discover from this provider.").option("-c, --capability <capability>", `Filter by capability: ${CAPABILITIES.join(", ")}.`).action(async (providerName, options) => {
-    const capability = options.capability;
-    if (capability !== void 0 && !CAPABILITIES.includes(capability)) {
-      throw new OmniNodeError(
-        "CLI_USAGE",
-        `Unknown capability "${options.capability}". Valid capabilities: ${CAPABILITIES.join(", ")}.`
-      );
-    }
-    const config = loadConfig();
-    const selected = config.project.providers.filter(
-      (p) => providerName ? p.name === providerName : true
-    );
-    if (selected.length === 0) {
-      throw new OmniNodeError(
-        "PROVIDER_NOT_FOUND",
-        providerName ? `Provider "${providerName}" is not configured.` : "No providers configured. Add one with `omninode provider add`."
-      );
-    }
-    const registry = new ModelRegistry();
-    for (const providerConfig of selected) {
-      try {
-        const provider = createProvider(providerConfig);
-        const discovered = await registry.discoverFrom(provider);
-        console.log(`${providerConfig.name}: ${discovered.length} model(s)`);
-      } catch (error) {
-        const message = error instanceof Error ? error.message : String(error);
-        console.log(`${providerConfig.name}: discovery failed \u2014 ${message}`);
-      }
-    }
-    const models = registry.list({
-      ...providerName !== void 0 ? { provider: providerName } : {},
-      ...capability !== void 0 ? { capability } : {}
-    });
-    if (models.length === 0) {
-      console.log("No models found.");
-      return;
-    }
-    console.log("");
-    for (const model of models) {
-      console.log(`${model.provider}:${model.id}`);
-    }
-  });
-}
-
-// src/cli/commands/agents.ts
-var collectArgs = (value, previous) => [...previous, value];
-function registerAgentCommands(program) {
-  const agent = program.command("agent").description("Manage CLI agents registered with OmniNode.");
-  agent.command("list").description("List configured agents.").action(async () => {
-    const config = loadConfig();
-    const agents = config.project.agents;
-    if (agents.length === 0) {
-      console.log("No agents configured. Add one with `omninode agent add` or edit omninode.yaml.");
-      return;
-    }
-    for (const agent2 of agents) {
-      const command = agent2.command ?? "(no command)";
-      console.log(
-        `${agent2.name}  integration=${agent2.integration}  command=${command}  input=${agent2.inputMode ?? "stdin"}`
-      );
-    }
-  });
-  agent.command("add").description(
-    "Register a CLI agent in omninode.yaml. Agents run as child processes (stdin/stdout); native adapters come in a later phase."
-  ).requiredOption("--name <name>", "Unique agent name.").requiredOption("--command <command>", "Executable command, e.g. opencode").option("--arg <value>", "Additional command argument (repeatable).", collectArgs, []).option("--cwd <dir>", "Working directory for the agent process.").option(
-    "--input-mode <mode>",
-    "How the task is delivered: stdin (prompt on stdin), arg (prompt as last argument) or protocol (\xA721 JSON-lines task protocol).",
-    "stdin"
-  ).option("--env-policy <policy>", "Environment policy: inherit, allowlist, denylist or explicit.").option("--allow-env <name>", "Variable to forward under the allowlist policy (repeatable).", collectArgs).option("--deny-env <name>", "Variable to remove under the denylist policy (repeatable).", collectArgs).option("--max-output-bytes <n>", "Per-stream output budget in bytes (default 5 MiB).", (value) => Number(value)).option("--allow-external-cwd", "Allow a working directory outside the project root.").option(
-    "--timeout-ms <ms>",
-    "Per-task timeout in milliseconds.",
-    (value) => Number(value)
-  ).action(async (options) => addAgent(options));
-  agent.command("test <name>").description("Verify the OmniNode \u2194 agent connection by sending a trivial task.").action(async (name) => testAgent(name));
-  registerAgentInspect(agent);
-}
-async function addAgent(options) {
-  const candidate = agentConfigSchema.safeParse({
-    name: options.name,
-    type: "cli",
-    command: options.command,
-    ...options.arg !== void 0 && options.arg.length > 0 ? { args: options.arg } : {},
-    ...options.cwd !== void 0 ? { cwd: options.cwd } : {},
-    input_mode: options.inputMode,
-    ...options.timeoutMs !== void 0 ? { timeout_ms: options.timeoutMs } : {},
-    ...options.envPolicy !== void 0 ? { env_policy: options.envPolicy } : {},
-    ...options.allowEnv !== void 0 && options.allowEnv.length > 0 ? { env_allowlist: options.allowEnv } : {},
-    ...options.denyEnv !== void 0 && options.denyEnv.length > 0 ? { env_denylist: options.denyEnv } : {},
-    ...options.maxOutputBytes !== void 0 ? { max_output_bytes: options.maxOutputBytes } : {},
-    ...options.allowExternalCwd !== void 0 ? { allow_external_cwd: options.allowExternalCwd } : {}
-  });
-  if (!candidate.success) {
-    const issues = candidate.error.issues.map((issue) => `${issue.path.join(".") || "(root)"}: ${issue.message}`).join("; ");
-    throw new OmniNodeError("CLI_USAGE", `Invalid agent options: ${issues}`);
-  }
-  const newAgent = candidate.data;
-  const existing = loadConfig();
-  if (existing.project.agents.some((a) => a.name === newAgent.name)) {
-    throw new OmniNodeError(
-      "CLI_USAGE",
-      `Agent "${newAgent.name}" already exists in omninode.yaml. Remove it first or pick another name.`
-    );
-  }
-  const configPath = appendToConfigList("agents", newAgent);
-  console.log(`Added agent "${newAgent.name}" (${newAgent.type}, input=${newAgent.input_mode}) to ${configPath}.`);
-  console.log(`Run \`omninode agent test ${newAgent.name}\` to verify the connection.`);
-}
-async function testAgent(name) {
-  const config = loadConfig();
-  const agentConfig = config.project.agents.find((a) => a.name === name);
-  if (!agentConfig) {
-    const available = config.project.agents.map((a) => a.name).join(", ") || "(none)";
-    throw new AgentError(
-      "AGENT_NOT_FOUND",
-      `Agent "${name}" is not configured. Configured agents: ${available}.`
-    );
-  }
-  const agent = createAgent(agentConfig);
-  console.log(
-    `Testing agent "${name}" (${agent.info.integration}, input=${agentConfig.inputMode ?? "stdin"}) \u2014 sending a trivial task.`
-  );
-  const result = await agent.run({
-    taskId: `test-${Date.now()}`,
-    objective: "Reply with the single word: OK"
-  });
-  console.log(`  status: ${result.status}`);
-  if (result.exitCode !== void 0) console.log(`  exit:   ${result.exitCode}`);
-  if (result.summary) console.log(`  output: ${result.summary}`);
-  if (result.rawOutput && result.rawOutput !== result.summary) {
-    console.log(`  raw:    ${result.rawOutput.slice(0, 200).replace(/\n/g, " ")}`);
-  }
-  if (result.error) console.log(`  error:  ${result.error}`);
-  if (result.status !== "completed") process.exitCode = 1;
-}
-
-// src/cli/commands/roles.ts
-function registerRoleCommands(program) {
-  const role = program.command("role").description("Inspect roles defined in omninode.yaml.");
-  role.command("list").description("List configured roles.").action(async () => {
-    const config = loadConfig();
-    const roles = config.project.roles;
-    if (roles.length === 0) {
-      console.log("No roles configured. Add one under `project.roles` in omninode.yaml.");
-      return;
-    }
-    for (const role2 of roles) {
-      console.log(`${role2.id}  ${role2.name}`);
-      for (const responsibility of role2.responsibilities) {
-        console.log(`  - ${responsibility}`);
-      }
-    }
-  });
-}
-
 // src/tasks/engine.ts
 import { randomBytes } from "crypto";
 var ALLOWED_TRANSITIONS = {
@@ -2587,12 +2653,145 @@ function createTaskEngine(config, log = logger, directory) {
   });
 }
 
+// src/cli/commands/agents.ts
+var collectArgs = (value, previous) => [...previous, value];
+function registerAgentCommands(program) {
+  const agent = program.command("agent").description("Manage CLI agents registered with OmniNode.");
+  agent.command("list").description("List configured agents.").option("--json", "Emit agents as JSON.").action(async (options) => {
+    const config = loadProjectConfig();
+    const agents = config.project.agents;
+    if (options.json) {
+      console.log(JSON.stringify(config.project.agents, null, 2));
+      return;
+    }
+    if (agents.length === 0) {
+      console.log("No agents configured. Add one with `omninode agent add` or edit omninode.yaml.");
+      return;
+    }
+    for (const agent2 of agents) {
+      const command = agent2.command ?? "(no command)";
+      console.log(
+        `${agent2.name}  integration=${agent2.integration}  command=${command}  input=${agent2.inputMode ?? "stdin"}`
+      );
+    }
+  });
+  agent.command("add").description(
+    "Register a CLI agent in omninode.yaml. Agents run as child processes (stdin/stdout); native adapters come in a later phase."
+  ).requiredOption("--name <name>", "Unique agent name.").requiredOption("--command <command>", "Executable command, e.g. opencode").option("--arg <value>", "Additional command argument (repeatable).", collectArgs, []).option("--cwd <dir>", "Working directory for the agent process.").option(
+    "--input-mode <mode>",
+    "How the task is delivered: stdin (prompt on stdin), arg (prompt as last argument) or protocol (\xA721 JSON-lines task protocol).",
+    "stdin"
+  ).option("--env-policy <policy>", "Environment policy: inherit, allowlist, denylist or explicit.").option("--allow-env <name>", "Variable to forward under the allowlist policy (repeatable).", collectArgs).option("--deny-env <name>", "Variable to remove under the denylist policy (repeatable).", collectArgs).option("--max-output-bytes <n>", "Per-stream output budget in bytes (default 5 MiB).", (value) => Number(value)).option("--allow-external-cwd", "Allow a working directory outside the project root.").option(
+    "--timeout-ms <ms>",
+    "Per-task timeout in milliseconds.",
+    (value) => Number(value)
+  ).action(async (options) => addAgent(options));
+  agent.command("run <name> <objective>").description("Run a single task through this agent immediately.").action(async (name, objective) => {
+    const config = loadProjectConfig();
+    const agentConfig = config.project.agents.find((a) => a.name === name);
+    if (!agentConfig) {
+      throw new AgentError("AGENT_NOT_FOUND", `No agent "${name}" is configured.`);
+    }
+    const engine = createTaskEngine(config);
+    const task = await engine.create({ objective, agent: name, project: config.project.name });
+    const finished = await engine.run(task.id);
+    console.log(`  id:      ${finished.id}`);
+    console.log(`  status:  ${finished.status}`);
+    if (finished.result?.summary) console.log(`  summary: ${finished.result.summary}`);
+    if (finished.result?.error) console.log(`  error:   ${finished.result.error}`);
+    process.exitCode = exitCodeForStatus(finished.status);
+  });
+  agent.command("test <name>").description("Verify the OmniNode \u2194 agent connection by sending a trivial task.").action(async (name) => testAgent(name));
+  registerAgentInspect(agent);
+}
+async function addAgent(options) {
+  const candidate = agentConfigSchema.safeParse({
+    name: options.name,
+    type: "cli",
+    command: options.command,
+    ...options.arg !== void 0 && options.arg.length > 0 ? { args: options.arg } : {},
+    ...options.cwd !== void 0 ? { cwd: options.cwd } : {},
+    input_mode: options.inputMode,
+    ...options.timeoutMs !== void 0 ? { timeout_ms: options.timeoutMs } : {},
+    ...options.envPolicy !== void 0 ? { env_policy: options.envPolicy } : {},
+    ...options.allowEnv !== void 0 && options.allowEnv.length > 0 ? { env_allowlist: options.allowEnv } : {},
+    ...options.denyEnv !== void 0 && options.denyEnv.length > 0 ? { env_denylist: options.denyEnv } : {},
+    ...options.maxOutputBytes !== void 0 ? { max_output_bytes: options.maxOutputBytes } : {},
+    ...options.allowExternalCwd !== void 0 ? { allow_external_cwd: options.allowExternalCwd } : {}
+  });
+  if (!candidate.success) {
+    const issues = candidate.error.issues.map((issue) => `${issue.path.join(".") || "(root)"}: ${issue.message}`).join("; ");
+    throw new OmniNodeError("CLI_USAGE", `Invalid agent options: ${issues}`);
+  }
+  const newAgent = candidate.data;
+  const existing = loadProjectConfig();
+  if (existing.project.agents.some((a) => a.name === newAgent.name)) {
+    throw new OmniNodeError(
+      "CLI_USAGE",
+      `Agent "${newAgent.name}" already exists in omninode.yaml. Remove it first or pick another name.`
+    );
+  }
+  const configPath = appendToConfigList("agents", newAgent);
+  console.log(`Added agent "${newAgent.name}" (${newAgent.type}, input=${newAgent.input_mode}) to ${configPath}.`);
+  console.log(`Run \`omninode agent test ${newAgent.name}\` to verify the connection.`);
+}
+async function testAgent(name) {
+  const config = loadProjectConfig();
+  const agentConfig = config.project.agents.find((a) => a.name === name);
+  if (!agentConfig) {
+    const available = config.project.agents.map((a) => a.name).join(", ") || "(none)";
+    throw new AgentError(
+      "AGENT_NOT_FOUND",
+      `Agent "${name}" is not configured. Configured agents: ${available}.`
+    );
+  }
+  const agent = createAgent(agentConfig);
+  console.log(
+    `Testing agent "${name}" (${agent.info.integration}, input=${agentConfig.inputMode ?? "stdin"}) \u2014 sending a trivial task.`
+  );
+  const result = await agent.run({
+    taskId: `test-${Date.now()}`,
+    objective: "Reply with the single word: OK"
+  });
+  console.log(`  status: ${result.status}`);
+  if (result.exitCode !== void 0) console.log(`  exit:   ${result.exitCode}`);
+  if (result.summary) console.log(`  output: ${result.summary}`);
+  if (result.rawOutput && result.rawOutput !== result.summary) {
+    console.log(`  raw:    ${result.rawOutput.slice(0, 200).replace(/\n/g, " ")}`);
+  }
+  if (result.error) console.log(`  error:  ${result.error}`);
+  if (result.status !== "completed") process.exitCode = 1;
+}
+
+// src/cli/commands/roles.ts
+function registerRoleCommands(program) {
+  const role = program.command("role").description("Inspect roles defined in omninode.yaml.");
+  role.command("list").description("List configured roles.").option("--json", "Emit roles as JSON.").action(async (options) => {
+    const config = loadProjectConfig();
+    const roles = config.project.roles;
+    if (options.json) {
+      console.log(JSON.stringify(config.project.roles, null, 2));
+      return;
+    }
+    if (roles.length === 0) {
+      console.log("No roles configured. Add one under `project.roles` in omninode.yaml.");
+      return;
+    }
+    for (const role2 of roles) {
+      console.log(`${role2.id}  ${role2.name}`);
+      for (const responsibility of role2.responsibilities) {
+        console.log(`  - ${responsibility}`);
+      }
+    }
+  });
+}
+
 // src/cli/commands/tasks.ts
 var collectFiles = (value, previous) => [...previous, value];
 function registerTaskCommands(program) {
   const task = program.command("task").description("Create, run and inspect tasks (\xA713).");
   task.command("create <objective>").description("Create a task. Assign a role and/or agent; run it with `omninode task run`.").option("-r, --role <roleId>", "Role id from project.roles (validated at creation).").option("-a, --agent <name>", "Agent name from project.agents (validated at creation).").option("-f, --file <path>", "File or glob relevant to the task (repeatable).", collectFiles).action(async (objective, options) => {
-    const config = loadConfig();
+    const config = loadProjectConfig();
     const engine = createTaskEngine(config);
     const created = await engine.create({
       objective,
@@ -2609,15 +2808,15 @@ function registerTaskCommands(program) {
     console.log(`Run \`omninode task run ${created.id}\` to execute it.`);
   });
   task.command("run <task-id>").description("Run a task through its assigned agent.").action(async (taskId) => {
-    const config = loadConfig();
+    const config = loadProjectConfig();
     const engine = createTaskEngine(config);
     console.log(`Running task ${taskId}...`);
     const finished = await engine.run(taskId);
     printOutcome(finished);
-    if (finished.status !== "completed") process.exitCode = 1;
+    process.exitCode = exitCodeForStatus(finished.status);
   });
   task.command("status <task-id>").description("Show task details and current status.").action(async (taskId) => {
-    const config = loadConfig();
+    const config = loadProjectConfig();
     const engine = createTaskEngine(config);
     const found = await engine.get(taskId);
     if (!found) {
@@ -2628,12 +2827,16 @@ function registerTaskCommands(program) {
     }
     printOutcome(found, { verbose: true });
   });
-  task.command("list").description("List tasks in the project's task store.").option("-s, --status <status>", "Filter by status (created, queued, running, completed, failed, cancelled).").action(async (options) => {
-    const config = loadConfig();
+  task.command("list").description("List tasks in the project's task store.").option("-s, --status <status>", "Filter by status (created, queued, running, completed, failed, cancelled).").option("--json", "Emit tasks as JSON.").action(async (options) => {
+    const config = loadProjectConfig();
     const engine = createTaskEngine(config);
     const tasks = await engine.list(
       options.status !== void 0 ? { status: options.status } : {}
     );
+    if (options.json) {
+      console.log(JSON.stringify(tasks, null, 2));
+      return;
+    }
     if (tasks.length === 0) {
       console.log("No tasks found. Create one with `omninode task create`.");
       return;
@@ -2643,13 +2846,13 @@ function registerTaskCommands(program) {
     }
   });
   task.command("cancel <task-id>").description("Cancel a task that has not finished yet.").action(async (taskId) => {
-    const config = loadConfig();
+    const config = loadProjectConfig();
     const engine = createTaskEngine(config);
     const cancelled = await engine.cancel(taskId);
     console.log(`Task ${cancelled.id} is now "${cancelled.status}".`);
   });
   task.command("retry <task-id>").description("Reset a failed, timed out, unknown or cancelled task to created; combine with --run to execute it again.").option("--run", "Run the task again immediately after resetting it.").action(async (taskId, options) => {
-    const config = loadConfig();
+    const config = loadProjectConfig();
     const engine = createTaskEngine(config);
     const reset = await engine.retry(taskId);
     console.log(`Task ${reset.id} reset to "${reset.status}".`);
@@ -2657,7 +2860,7 @@ function registerTaskCommands(program) {
     console.log(`Running task ${reset.id}...`);
     const finished = await engine.run(reset.id);
     printOutcome(finished);
-    if (finished.status !== "completed") process.exitCode = 1;
+    process.exitCode = exitCodeForStatus(finished.status);
   });
   registerTaskInspect(task);
 }
@@ -3128,12 +3331,16 @@ function service() {
 }
 function registerReportCommands(program) {
   const report = program.command("report").description("Inspect AI reports collected from tasks and pipelines (\xA716\u2013\xA717).");
-  report.command("list").description("List stored reports.").option("--task <taskId>", "Only reports for this task.").option("--agent <name>", "Only reports from this agent.").action(async (options) => {
+  report.command("list").description("List stored reports.").option("--task <taskId>", "Only reports for this task.").option("--agent <name>", "Only reports from this agent.").option("--json", "Emit reports as JSON.").action(async (options) => {
     const svc = service();
     const reports = await svc.storeRef.listReports({
       ...options.task !== void 0 ? { taskId: options.task } : {},
       ...options.agent !== void 0 ? { agent: options.agent } : {}
     });
+    if (options.json) {
+      console.log(JSON.stringify(reports, null, 2));
+      return;
+    }
     if (reports.length === 0) {
       console.log("No reports stored yet. Run a pipeline to collect some.");
       return;
@@ -3142,11 +3349,15 @@ function registerReportCommands(program) {
       console.log(`${r.id}  ${r.agent.padEnd(10)} ${truncate(r.summary, 60)}`);
     }
   });
-  report.command("combined").description("List combined reports (aggregated intelligence, \xA717).").option("--run <pipelineRunId>", "Only combined reports for this pipeline run.").action(async (options) => {
+  report.command("combined").description("List combined reports (aggregated intelligence, \xA717).").option("--run <pipelineRunId>", "Only combined reports for this pipeline run.").option("--json", "Emit combined reports as JSON.").action(async (options) => {
     const svc = service();
     const combined = await svc.storeRef.listCombined({
       ...options.run !== void 0 ? { pipelineRunId: options.run } : {}
     });
+    if (options.json) {
+      console.log(JSON.stringify(combined, null, 2));
+      return;
+    }
     if (combined.length === 0) {
       console.log("No combined reports stored yet. Run a pipeline to generate one.");
       return;
@@ -3226,6 +3437,10 @@ function registerReportCommands(program) {
   });
 }
 
+// src/cli/commands/pipelines.ts
+import { readFileSync as readFileSync4, writeFileSync as writeFileSync4 } from "fs";
+import { parseDocument as parseDocument3 } from "yaml";
+
 // src/pipelines/engine.ts
 import { randomBytes as randomBytes5 } from "crypto";
 
@@ -4177,9 +4392,13 @@ function buildPipelineEngine(config, log = logger) {
 // src/cli/commands/pipelines.ts
 function registerPipelineCommands(program) {
   const pipeline = program.command("pipeline").description("Run multi-step AI pipelines defined in omninode.yaml (\xA714).");
-  pipeline.command("list").description("List configured pipelines.").action(async () => {
-    const config = loadConfig();
+  pipeline.command("list").description("List configured pipelines.").option("--json", "Emit pipelines as JSON.").action(async (options) => {
+    const config = loadProjectConfig();
     const pipelines = config.project.pipelines;
+    if (options.json) {
+      console.log(JSON.stringify(config.project.pipelines, null, 2));
+      return;
+    }
     if (pipelines.length === 0) {
       console.log("No pipelines configured. Add one under `project.pipelines` in omninode.yaml.");
       return;
@@ -4195,7 +4414,7 @@ function registerPipelineCommands(program) {
   pipeline.command("retry <run-id> [objective]").description(
     "Error recovery: re-run a recorded pipeline run as a new run, reusing its objective."
   ).action(async (runId, objective) => {
-    const config = loadConfig();
+    const config = loadProjectConfig();
     const engine = buildPipelineEngine(config);
     const previous = await engine.get(runId);
     if (!previous) {
@@ -4214,14 +4433,17 @@ function registerPipelineCommands(program) {
     await runPipelineAction(def.id, objective ?? previous.objective);
   });
   pipeline.command("cancel <run-id>").description("Request cancellation of a pipeline run (stops scheduling and cancels running tasks).").action(async (runId) => {
-    const config = loadConfig();
+    const config = loadProjectConfig();
     const engine = buildPipelineEngine(config);
     await engine.cancel(runId);
     console.log(`Cancellation requested for run ${runId}.`);
     console.log("A run executing in another process stops at its next check point.");
   });
+  pipeline.command("create <id>").description("Create a pipeline from a YAML/JSON file and append it to omninode.yaml.").requiredOption("--from <file>", "File containing { objective?, steps: [...] } (YAML or JSON).").action(async (id, options) => {
+    await createPipelineFromFile(id, options.from);
+  });
   pipeline.command("validate <id>").description("Validate a pipeline definition before running it (\xA79.5).").action(async (id) => {
-    const config = loadConfig();
+    const config = loadProjectConfig();
     const def = findPipeline(config, id);
     const engine = buildPipelineEngine(config);
     engine.validate(def);
@@ -4232,7 +4454,7 @@ function registerPipelineCommands(program) {
     }
   });
   pipeline.command("runs <id>").description("List recorded runs of a pipeline.").action(async (id) => {
-    const config = loadConfig();
+    const config = loadProjectConfig();
     const engine = buildPipelineEngine(config);
     const runs = await engine.listRuns({ pipelineId: id });
     if (runs.length === 0) {
@@ -4245,7 +4467,7 @@ function registerPipelineCommands(program) {
     }
   });
   pipeline.command("status <run-id>").description("Show the recorded state of a pipeline run.").action(async (runId) => {
-    const config = loadConfig();
+    const config = loadProjectConfig();
     const engine = buildPipelineEngine(config);
     const run2 = await engine.get(runId);
     if (!run2) {
@@ -4277,7 +4499,7 @@ function registerPipelineCommands(program) {
   registerPipelineInspect(pipeline);
 }
 async function runPipelineAction(id, objective) {
-  const config = loadConfig();
+  const config = loadProjectConfig();
   const def = findPipeline(config, id);
   const engine = buildPipelineEngine(config);
   console.log(
@@ -4303,11 +4525,45 @@ async function runPipelineAction(id, objective) {
     console.log(`  result: ${finished.resultSummary}`);
   }
   console.log(`Pipeline ${finished.status}. Run id: ${finished.id}`);
-  if (finished.status !== "completed") process.exitCode = 1;
+  process.exitCode = exitCodeForStatus(finished.status);
 }
 function registerRunAlias(program) {
   program.command("run <id> [objective]").description("Alias of `omninode pipeline run` \u2014 execute a configured pipeline end to end.").action(async (id, objective) => runPipelineAction(id, objective));
 }
+async function createPipelineFromFile(id, file) {
+  const configPath = activeConfigPath();
+  if (!configPath) {
+    throw new OmniNodeError("CONFIG_NOT_FOUND", "No omninode.yaml found. Run `omninode init` first.");
+  }
+  let definition;
+  try {
+    definition = parseDocument3(readFileSync4(file, "utf8")).toJS();
+  } catch (error) {
+    throw new PipelineError("PIPELINE_INVALID", `Could not read pipeline definition from ${file}.`, {
+      cause: error
+    });
+  }
+  const candidate = pipelineConfigSchema.safeParse({ id, ...definition });
+  if (!candidate.success) {
+    const issues = candidate.error.issues.map((i) => `${i.path.join(".") || "(root)"}: ${i.message}`).join("; ");
+    throw new PipelineError("PIPELINE_INVALID", `Invalid pipeline definition: ${issues}`);
+  }
+  const engine = buildPipelineEngine(loadProjectConfig());
+  engine.validate({ id, ...candidate.data });
+  const doc = parseDocument3(readFileSync4(configPath, "utf8"));
+  if (doc.getIn(["project", "pipelines"]) === void 0) {
+    doc.setIn(["project", "pipelines"], [candidate.data]);
+  } else {
+    doc.addIn(["project", "pipelines"], candidate.data);
+  }
+  const validated = appConfigSchema.safeParse(doc.toJS());
+  if (!validated.success) {
+    throw new PipelineError("PIPELINE_INVALID", "Adding this pipeline would produce an invalid configuration.");
+  }
+  writeFileSync4(configPath, doc.toString(), "utf8");
+  console.log(`Created pipeline "${id}" (${candidate.data.steps.length} step(s)) in ${configPath}.`);
+  console.log(`Run it with: omninode pipeline run ${id} "<objective>"`);
+}
 function isInterrupted(run2) {
   return run2.status === "running" && run2.finishedAt === void 0;
 }
@@ -4327,7 +4583,7 @@ function findPipeline(config, id) {
 function registerMemoryCommands(program) {
   const memory = program.command("memory").description("Inspect and manage persistent project memory (\xA719\u2013\xA720).");
   memory.command("status").description("Show the active memory provider and how much is stored.").action(async () => {
-    const config = loadConfig();
+    const config = loadProjectConfig();
     const configured = config.project.memory?.provider ?? "local (default \u2014 add a `memory:` section to opt in)";
     const svc = new MemoryService(createMemoryProvider(config.project.memory));
     const entries = await svc.providerRef.query({ limit: 1e4 });
@@ -4341,14 +4597,18 @@ function registerMemoryCommands(program) {
       console.log(`  ${scope}: ${count}`);
     }
   });
-  memory.command("query <text>").description("Search memory for entries relevant to the text.").option("-s, --scope <scope>", "Restrict to a scope: project, task, role or knowledge.").option("-n, --limit <count>", "Maximum entries to return.", (value) => Number(value), 10).action(async (text, options) => {
-    const config = loadConfig();
+  memory.command("query <text>").description("Search memory for entries relevant to the text.").option("-s, --scope <scope>", "Restrict to a scope: project, task, role or knowledge.").option("-n, --limit <count>", "Maximum entries to return.", (value) => Number(value), 10).option("--json", "Emit entries as JSON.").action(async (text, options) => {
+    const config = loadProjectConfig();
     const svc = new MemoryService(createMemoryProvider(config.project.memory));
     const entries = await svc.providerRef.query({
       text,
       ...options.scope !== void 0 ? { scope: options.scope } : {},
       limit: options.limit
     });
+    if (options.json) {
+      console.log(JSON.stringify(entries, null, 2));
+      return;
+    }
     if (entries.length === 0) {
       console.log("No relevant memory found.");
       return;
@@ -4363,7 +4623,7 @@ function registerMemoryCommands(program) {
     "Comma-separated tags.",
     (value) => value.split(",").map((tag) => tag.trim()).filter((tag) => tag.length > 0)
   ).option("-k, --key <key>", "Entry key (defaults to a generated note key).").action(async (text, options) => {
-    const config = loadConfig();
+    const config = loadProjectConfig();
     const svc = new MemoryService(createMemoryProvider(config.project.memory));
     const key = options.key ?? `note:${Date.now().toString(36)}`;
     await svc.providerRef.write({
@@ -4379,11 +4639,15 @@ function registerMemoryCommands(program) {
 // src/cli/commands/plan.ts
 function registerPlanCommands(program) {
   const plan = program.command("plan").description("Inspect implementation plans produced by the planner layer (\xA718).");
-  plan.command("list").description("List stored plans.").option("--run <pipelineRunId>", "Only plans for this pipeline run.").action(async (options) => {
+  plan.command("list").description("List stored plans.").option("--run <pipelineRunId>", "Only plans for this pipeline run.").option("--json", "Emit plans as JSON.").action(async (options) => {
     const store = new FilePlanStore();
     const plans = await store.list({
       ...options.run !== void 0 ? { pipelineRunId: options.run } : {}
     });
+    if (options.json) {
+      console.log(JSON.stringify(plans, null, 2));
+      return;
+    }
     if (plans.length === 0) {
       console.log("No plans stored yet. Run a pipeline with a plan step to generate one.");
       return;
@@ -4442,7 +4706,7 @@ function countBy(items, key) {
 }
 function registerStatusCommand(program) {
   program.command("status").description("Show the project's OmniNode state overview (config, tasks, runs, reports, plans, memory).").option("--json", "Emit machine-readable JSON (for scripts and CI).").action(async (options) => {
-    const config = loadConfig();
+    const config = loadProjectConfig();
     const tasks = await new FileTaskStore().list();
     const runs = await new FilePipelineRunStore().list();
     const reportStore = new FileReportStore();
@@ -4523,8 +4787,8 @@ var STORE_FILES = [
 async function migrateProjectStores(directory = `${process.cwd()}/.omninode`, options = {}) {
   const reports = [];
   for (const file of STORE_FILES) {
-    const path = `${directory}/${file}`;
-    const state = await inspectDocument(path);
+    const path2 = `${directory}/${file}`;
+    const state = await inspectDocument(path2);
     if (state.status === "missing") {
       reports.push({ file, state: state.status, migrated: false });
       continue;
@@ -4546,9 +4810,9 @@ async function migrateProjectStores(directory = `${process.cwd()}/.omninode`, op
       reports.push({ file, state: state.status, migrated: false, note: state.detail });
       continue;
     }
-    const items = await readDocument(path, void 0, false);
+    const items = await readDocument(path2, void 0, false);
     if (!options.checkOnly) {
-      await writeFileAtomic(path, `${JSON.stringify({ schemaVersion: SCHEMA_VERSION, items }, null, 2)}
+      await writeFileAtomic(path2, `${JSON.stringify({ schemaVersion: SCHEMA_VERSION, items }, null, 2)}
 `);
     }
     const beforeCount = items.length;
@@ -4591,7 +4855,7 @@ function registerSecurityCommand(program) {
       console.log(`Unknown security action "${action}". Available: audit.`);
       return;
     }
-    const config = loadConfig();
+    const config = loadProjectConfig();
     const findings = [];
     for (const agent of config.project.agents) {
       const policy = resolveEnvPolicy(agent);
@@ -4650,12 +4914,155 @@ Trust model: agents execute with the permissions of the OS user running OmniNode
   });
 }
 
+// src/cli/commands/config.ts
+import { readFileSync as readFileSync5 } from "fs";
+import { parse as parseYaml2 } from "yaml";
+function registerConfigCommands(program) {
+  const config = program.command("config").description("Inspect the project configuration (omninode.yaml).");
+  config.command("path").description("Print the path of the configuration file in use.").action(() => {
+    const path2 = activeConfigPath();
+    console.log(path2 ?? "no omninode.yaml found");
+  });
+  config.command("show").description("Print the effective configuration (credential references only, never values).").option("--json", "Emit the configuration as JSON.").action((options) => {
+    const resolved = loadConfigDetailed().config;
+    const payload = {
+      project: resolved.project.name,
+      providers: resolved.project.providers.map((p) => ({
+        name: p.name,
+        type: p.type,
+        baseUrl: p.baseUrl,
+        apiKeyEnvVar: p.apiKeyEnvVar ?? null
+      })),
+      agents: resolved.project.agents.map((a) => ({ name: a.name, command: a.command ?? null, inputMode: a.inputMode })),
+      roles: resolved.project.roles.map((r) => r.id),
+      pipelines: resolved.project.pipelines.map((p) => p.id),
+      memory: resolved.project.memory ?? null,
+      logging: resolved.logging ?? null
+    };
+    if (options.json) {
+      console.log(JSON.stringify(payload, null, 2));
+      return;
+    }
+    console.log(`project:   ${payload.project}`);
+    console.log(`providers: ${payload.providers.map((p) => `${p.name} (${p.type}, key=${p.apiKeyEnvVar ? `$${p.apiKeyEnvVar}` : "none"})`).join(", ") || "none"}`);
+    console.log(`agents:    ${payload.agents.map((a) => a.name).join(", ") || "none"}`);
+    console.log(`roles:     ${payload.roles.join(", ") || "none"}`);
+    console.log(`pipelines: ${payload.pipelines.join(", ") || "none"}`);
+    console.log(`memory:    ${payload.memory ? `${payload.memory.provider}${payload.memory.required ? " (required)" : ""}` : "not configured"}`);
+  });
+  config.command("profiles").description("List the configuration profiles defined in this project.").action(() => {
+    const path2 = activeConfigPath();
+    const raw = path2 ? parseYaml2(readFileSync5(path2, "utf8")) : {};
+    const names = Object.keys(raw.profiles ?? {});
+    const active = loadConfigDetailed().sources.profile;
+    console.log(`active:  ${active}`);
+    console.log(`defined: ${names.length > 0 ? names.join(", ") : "none (add a `profiles:` section)"}`);
+  });
+  config.command("validate").description("Validate the configuration file, including the inline-secret scan.").action(() => {
+    const path2 = activeConfigPath();
+    if (!path2) throw new OmniNodeError("CONFIG_NOT_FOUND", "No omninode.yaml found.");
+    const findings = scanForInlineSecrets(readFileSync5(path2, "utf8"));
+    if (findings.length > 0) {
+      throw new OmniNodeError(
+        "CONFIG_INVALID",
+        `${path2} contains ${findings.length} inline secret(s) (line ${findings.map((f) => f.line).join(", ")}). Use environment-variable references.`
+      );
+    }
+    const { config: resolved, sources } = loadConfigDetailed();
+    console.log(
+      `${path2} is valid \u2014 project "${resolved.project.name}" with ${resolved.project.providers.length} provider(s), ${resolved.project.agents.length} agent(s), ${resolved.project.pipelines.length} pipeline(s).`
+    );
+    console.log(`  profile:  ${sources.profile}`);
+    if (sources.userFile) console.log(`  user cfg: ${sources.userFile}`);
+    if (sources.envOverrides.length > 0) {
+      console.log(`  env overrides: ${sources.envOverrides.join(", ")}`);
+    }
+    if (sources.defaults.length > 0) {
+      console.log(`  defaults applied: ${sources.defaults.join(", ")}`);
+    }
+    const diagnostics = configDiagnostics(resolved);
+    if (diagnostics.length > 0) {
+      console.log("  diagnostics:");
+      for (const note of diagnostics) console.log(`    - ${note}`);
+    }
+  });
+}
+
+// src/cli/commands/models.ts
+var CAPABILITIES = [
+  "chat",
+  "coding",
+  "tools",
+  "vision",
+  "embeddings"
+];
+function registerModelsCommand(program) {
+  for (const name of ["models", "model"]) {
+    registerModelGroup(program, name);
+  }
+}
+function registerModelGroup(program, name) {
+  program.command(name).description("Discover and list models from configured providers (model registry, \xA78).").argument("[provider]", "Only discover from this provider.").option("-c, --capability <capability>", `Filter by capability: ${CAPABILITIES.join(", ")}.`).option("--json", "Emit the discovered models as JSON.").action(async (providerName, options) => {
+    const capability = options.capability;
+    if (capability !== void 0 && !CAPABILITIES.includes(capability)) {
+      throw new OmniNodeError(
+        "CLI_USAGE",
+        `Unknown capability "${options.capability}". Valid capabilities: ${CAPABILITIES.join(", ")}.`
+      );
+    }
+    const config = loadProjectConfig();
+    const selected = config.project.providers.filter(
+      (p) => providerName ? p.name === providerName : true
+    );
+    if (selected.length === 0) {
+      if (options.json) {
+        console.log("[]");
+        return;
+      }
+      throw new OmniNodeError(
+        "PROVIDER_NOT_FOUND",
+        providerName ? `Provider "${providerName}" is not configured.` : "No providers configured. Add one with `omninode provider add`."
+      );
+    }
+    const registry = new ModelRegistry();
+    for (const providerConfig of selected) {
+      try {
+        const provider = createProvider(providerConfig);
+        const discovered = await registry.discoverFrom(provider);
+        console.log(`${providerConfig.name}: ${discovered.length} model(s)`);
+      } catch (error) {
+        const message = error instanceof Error ? error.message : String(error);
+        console.log(`${providerConfig.name}: discovery failed \u2014 ${message}`);
+      }
+    }
+    const models = registry.list({
+      ...providerName !== void 0 ? { provider: providerName } : {},
+      ...capability !== void 0 ? { capability } : {}
+    });
+    if (options.json) {
+      console.log(JSON.stringify(models, null, 2));
+      return;
+    }
+    if (models.length === 0) {
+      console.log("No models found.");
+      return;
+    }
+    console.log("");
+    for (const model of models) {
+      console.log(`${model.provider}:${model.id}`);
+    }
+  });
+}
+
 // src/cli/index.ts
 function createProgram() {
   const program = new Command();
   program.name("omninode").description(
     "Provider-agnostic multi-AI orchestration platform: coordinate CLI agents, AI providers, memory, roles, reports and planning in one execution system."
-  ).version(OMNINODE_VERSION, "-v, --version", "Print the OmniNode version.");
+  ).version(OMNINODE_VERSION, "-v, --version", "Print the OmniNode version.").option("-c, --config <file>", "Use a specific configuration file instead of ./omninode.yaml.").option("-p, --profile <name>", "Apply a named configuration profile (development/production/testing).").hook("preAction", (thisCommand) => {
+    cliConfigOptions.path = thisCommand.opts().config;
+    cliConfigOptions.profile = thisCommand.opts().profile;
+  });
   registerInitCommand(program);
   registerProjectCommands(program);
   registerProviderCommands(program);
@@ -4671,15 +5078,14 @@ function createProgram() {
   registerAuditCommand(program);
   registerMigrateCommand(program);
   registerSecurityCommand(program);
+  registerConfigCommands(program);
   registerRunAlias(program);
   return program;
 }
 function applyLoggingConfig() {
   try {
-    if (findConfigFile()) {
-      const logging = loadConfig().logging;
-      if (logging) configureLogger(logging);
-    }
+    const resolved = loadProjectConfig();
+    if (resolved.logging) configureLogger(resolved.logging);
   } catch {
   }
 }
@@ -4693,15 +5099,16 @@ async function run(argv) {
   }
 }
 function handleError(error) {
+  const code = exitCodeFor(error);
   if (isOmniNodeError(error)) {
     console.error(`error: [${error.code}] ${error.message}`);
     if (error.details !== void 0) {
       console.error(JSON.stringify(error.details, null, 2));
     }
-    process.exit(1);
+    process.exit(code);
   }
   console.error(error instanceof Error ? error.message : String(error));
-  process.exit(1);
+  process.exit(code);
 }
 var entry = process.argv[1] ? pathToFileURL(realpathSync(process.argv[1])).href : "";
 if (import.meta.url === entry) {