@oriro/orirocli 0.3.8 → 0.3.9

package/dist/cli.js

@@ -5130,7 +5130,7 @@ var init_assemble = __esm({
 // src/agents/worktree.ts
 import { execFile } from "child_process";
 import { promisify } from "util";
-import { join as join27, basename as basename2 } from "path";
+import { join as join28, basename as basename2 } from "path";
 function parseAgentsSlash(line) {
   const m = /^\/agents(?:\s+(\S[\s\S]*))?$/i.exec(line.trim());
   if (!m) return void 0;
@@ -5152,7 +5152,7 @@ function fanBranch(stamp, i) {
   return `oriro/agents/${stamp}-a${i + 1}`;
 }
 function fanDir(repoRoot, stamp, i) {
-  return join27(oriroDir(), "worktrees", `${basename2(repoRoot)}-${stamp}-a${i + 1}`);
+  return join28(oriroDir(), "worktrees", `${basename2(repoRoot)}-${stamp}-a${i + 1}`);
 }
 async function git(cwd, ...args) {
   try {
@@ -7030,13 +7030,119 @@ function parsePlanSlash(line) {
   return { cmd: "reject" };
 }
 
+// src/repl-ui/slash-imagine.ts
+import { existsSync as existsSync15, writeFileSync as writeFileSync18 } from "fs";
+import { join as join26 } from "path";
+
+// src/repl-ui/artifacts.ts
+var LANG_EXT = {
+  python: "py",
+  py: "py",
+  javascript: "js",
+  js: "js",
+  typescript: "ts",
+  ts: "ts",
+  tsx: "tsx",
+  jsx: "jsx",
+  html: "html",
+  css: "css",
+  json: "json",
+  yaml: "yaml",
+  yml: "yml",
+  bash: "sh",
+  sh: "sh",
+  shell: "sh",
+  sql: "sql",
+  go: "go",
+  rust: "rs",
+  rs: "rs",
+  java: "java",
+  c: "c",
+  cpp: "cpp",
+  "c++": "cpp",
+  ruby: "rb",
+  rb: "rb",
+  php: "php",
+  markdown: "md",
+  md: "md",
+  svg: "svg"
+};
+function extFor(lang) {
+  return LANG_EXT[lang.toLowerCase()] ?? "txt";
+}
+function extractArtifacts(text) {
+  const out = [];
+  if (!text) return out;
+  const fence = /```([\w+#.-]*)\n([\s\S]*?)```/g;
+  let m;
+  while ((m = fence.exec(text)) !== null) {
+    const lang = (m[1] ?? "").trim();
+    const content = (m[2] ?? "").replace(/\n$/, "");
+    if (!content.trim()) continue;
+    const isSvg = lang.toLowerCase() === "svg" || /^\s*<svg[\s>]/.test(content);
+    out.push({
+      kind: isSvg ? "svg" : "code",
+      lang: lang || (isSvg ? "svg" : ""),
+      content,
+      suggestedName: `artifact-${out.length + 1}.${isSvg ? "svg" : extFor(lang)}`
+    });
+  }
+  const svg = /<svg[\s>][\s\S]*?<\/svg>/gi;
+  while ((m = svg.exec(text)) !== null) {
+    const content = m[0];
+    if (out.some((a) => a.content.includes(content))) continue;
+    out.push({ kind: "svg", lang: "svg", content, suggestedName: `artifact-${out.length + 1}.svg` });
+  }
+  return out;
+}
+var current3 = [];
+function setArtifacts(a) {
+  current3 = a;
+}
+function getArtifacts() {
+  return current3;
+}
+
+// src/repl-ui/slash-imagine.ts
+init_theme();
+function isImagineSlash(cmd) {
+  return /^\/imagine(\s|$)/i.test(cmd.trim());
+}
+function imagineTask(raw) {
+  const rest = raw.trim().replace(/^\/imagine\s*/i, "").trim();
+  return rest.length ? rest : void 0;
+}
+var IMAGINE_PRIMER = "IMAGE MODE: you are ORIRO's image engine. Create ONE complete, self-contained SVG artwork for the request below. Reply with ONLY a single fenced ```svg code block containing valid standalone SVG \u2014 root <svg> with xmlns and a viewBox, generous use of shapes/paths/gradients, NO external images, fonts, scripts or links. No prose before or after the block.";
+function imagineDest(now, cwd = process.cwd()) {
+  const p = (n, w = 2) => String(n).padStart(w, "0");
+  const base = `imagine-${p(now.getMonth() + 1)}${p(now.getDate())}-${p(now.getHours())}${p(now.getMinutes())}${p(now.getSeconds())}`;
+  let dest = join26(cwd, `${base}.svg`);
+  for (let i = 2; existsSync15(dest); i++) dest = join26(cwd, `${base}-${i}.svg`);
+  return dest;
+}
+function imagineResultLines(finalText, now = /* @__PURE__ */ new Date(), cwd) {
+  const svg = extractArtifacts(finalText).find((a) => a.kind === "svg");
+  if (!svg) {
+    return [dim("  \u2300 no SVG came back this turn \u2014 /imagine again (free), or rephrase the scene.")];
+  }
+  const dest = imagineDest(now, cwd);
+  try {
+    writeFileSync18(dest, svg.content, "utf8");
+  } catch (e) {
+    return [dim(`  \u2717 could not save the image: ${e instanceof Error ? e.message : String(e)} \u2014 /save it via /review instead`)];
+  }
+  return [
+    `  ${fgHex(PALETTE.success, "\u2713 imagined")} \u2192 ${accent(dest)} ${dim(`(${svg.content.length} bytes \u2014 open it in any browser)`)}`
+  ];
+}
+
 // src/repl-ui/tui-repl.ts
 init_posture_gate();
 init_scribe_pi();
 init_filter();
 
 // src/repl-ui/verify-actions.ts
-import { existsSync as existsSync15 } from "fs";
+import { existsSync as existsSync16 } from "fs";
 import { isAbsolute, resolve } from "path";
 var CLAIM = /\b(?:have|has)\s+been\s+created\b|\b(?:created|wrote|written|saved|generated)\b(?![ \t]*(?:by you|it yourself))/i;
 var SUGGESTION = /\byou\s+(?:can|could|should|may)\s+(?:create|add|save|make|put)\b/i;
@@ -7049,7 +7155,7 @@ function phantomFileWarning(reply, cwd = process.cwd()) {
     if (!p) continue;
     if (/^https?:|node_modules|<[^>]+>|your-|example\./i.test(p)) continue;
     const abs = isAbsolute(p) ? p : resolve(cwd, p.replace(/^[.][\\/]/, ""));
-    if (!existsSync15(abs)) missing.add(p);
+    if (!existsSync16(abs)) missing.add(p);
   }
   if (missing.size === 0) return "";
   if (SUGGESTION.test(reply) && !/\b(?:have|has)\s+been\s+created\b/i.test(reply)) return "";
@@ -7169,78 +7275,7 @@ function handleUsage() {
 }
 
 // src/repl-ui/slash-artifacts.ts
-import { existsSync as existsSync16, writeFileSync as writeFileSync18 } from "fs";
-
-// src/repl-ui/artifacts.ts
-var LANG_EXT = {
-  python: "py",
-  py: "py",
-  javascript: "js",
-  js: "js",
-  typescript: "ts",
-  ts: "ts",
-  tsx: "tsx",
-  jsx: "jsx",
-  html: "html",
-  css: "css",
-  json: "json",
-  yaml: "yaml",
-  yml: "yml",
-  bash: "sh",
-  sh: "sh",
-  shell: "sh",
-  sql: "sql",
-  go: "go",
-  rust: "rs",
-  rs: "rs",
-  java: "java",
-  c: "c",
-  cpp: "cpp",
-  "c++": "cpp",
-  ruby: "rb",
-  rb: "rb",
-  php: "php",
-  markdown: "md",
-  md: "md",
-  svg: "svg"
-};
-function extFor(lang) {
-  return LANG_EXT[lang.toLowerCase()] ?? "txt";
-}
-function extractArtifacts(text) {
-  const out = [];
-  if (!text) return out;
-  const fence = /```([\w+#.-]*)\n([\s\S]*?)```/g;
-  let m;
-  while ((m = fence.exec(text)) !== null) {
-    const lang = (m[1] ?? "").trim();
-    const content = (m[2] ?? "").replace(/\n$/, "");
-    if (!content.trim()) continue;
-    const isSvg = lang.toLowerCase() === "svg" || /^\s*<svg[\s>]/.test(content);
-    out.push({
-      kind: isSvg ? "svg" : "code",
-      lang: lang || (isSvg ? "svg" : ""),
-      content,
-      suggestedName: `artifact-${out.length + 1}.${isSvg ? "svg" : extFor(lang)}`
-    });
-  }
-  const svg = /<svg[\s>][\s\S]*?<\/svg>/gi;
-  while ((m = svg.exec(text)) !== null) {
-    const content = m[0];
-    if (out.some((a) => a.content.includes(content))) continue;
-    out.push({ kind: "svg", lang: "svg", content, suggestedName: `artifact-${out.length + 1}.svg` });
-  }
-  return out;
-}
-var current3 = [];
-function setArtifacts(a) {
-  current3 = a;
-}
-function getArtifacts() {
-  return current3;
-}
-
-// src/repl-ui/slash-artifacts.ts
+import { existsSync as existsSync17, writeFileSync as writeFileSync19 } from "fs";
 init_theme();
 function isArtifactSlash(cmd) {
   return /^\/(review|artifacts?|save)(\s|$)/i.test(cmd.trim());
@@ -7257,9 +7292,9 @@ function handleArtifactSlash(raw) {
     const art = arts[idx - 1];
     if (!art) return [dim("  no such artifact")];
     const dest = parts[2] || art.suggestedName;
-    if (existsSync16(dest)) return [dim(`  \u2717 ${dest} already exists \u2014 give a different path: /save ${idx} <path>`)];
+    if (existsSync17(dest)) return [dim(`  \u2717 ${dest} already exists \u2014 give a different path: /save ${idx} <path>`)];
     try {
-      writeFileSync18(dest, art.content, "utf8");
+      writeFileSync19(dest, art.content, "utf8");
     } catch (e) {
       return [dim(`  \u2717 could not write ${dest}: ${e instanceof Error ? e.message : String(e)}`)];
     }
@@ -7317,8 +7352,8 @@ async function handleCompact(session, cmd) {
 }
 
 // src/context/init-agents.ts
-import { existsSync as existsSync17, readFileSync as readFileSync21, readdirSync as readdirSync3, statSync as statSync3, writeFileSync as writeFileSync19 } from "fs";
-import { join as join26, basename } from "path";
+import { existsSync as existsSync18, readFileSync as readFileSync21, readdirSync as readdirSync3, statSync as statSync3, writeFileSync as writeFileSync20 } from "fs";
+import { join as join27, basename } from "path";
 var CODE_EXT = {
   ts: "TypeScript",
   tsx: "TypeScript",
@@ -7351,8 +7386,8 @@ function readJson(p) {
 }
 function detectProject(cwd) {
   const facts = { name: basename(cwd) || "project", languages: [], commands: [], topDirs: [] };
-  const pkgPath = join26(cwd, "package.json");
-  if (existsSync17(pkgPath)) {
+  const pkgPath = join27(cwd, "package.json");
+  if (existsSync18(pkgPath)) {
     const pkg = readJson(pkgPath);
     if (typeof pkg.name === "string" && pkg.name) facts.name = pkg.name;
     if (typeof pkg.description === "string" && pkg.description) facts.description = pkg.description;
@@ -7360,11 +7395,11 @@ function detectProject(cwd) {
     for (const key of ["dev", "build", "test", "lint", "start"]) {
       if (scripts[key]) facts.commands.push({ label: key, cmd: `npm run ${key}` });
     }
-  } else if (existsSync17(join26(cwd, "pyproject.toml")) || existsSync17(join26(cwd, "requirements.txt"))) {
+  } else if (existsSync18(join27(cwd, "pyproject.toml")) || existsSync18(join27(cwd, "requirements.txt"))) {
     if (!facts.description) facts.description = "Python project";
-  } else if (existsSync17(join26(cwd, "Cargo.toml"))) {
+  } else if (existsSync18(join27(cwd, "Cargo.toml"))) {
     facts.commands.push({ label: "build", cmd: "cargo build" }, { label: "test", cmd: "cargo test" });
-  } else if (existsSync17(join26(cwd, "go.mod"))) {
+  } else if (existsSync18(join27(cwd, "go.mod"))) {
     facts.commands.push({ label: "build", cmd: "go build ./..." }, { label: "test", cmd: "go test ./..." });
   }
   const langCount = /* @__PURE__ */ new Map();
@@ -7379,7 +7414,7 @@ function detectProject(cwd) {
   } catch {
   }
   for (const e of entries) {
-    const full = join26(cwd, e);
+    const full = join27(cwd, e);
     let isDir = false;
     try {
       isDir = statSync3(full).isDirectory();
@@ -7392,7 +7427,7 @@ function detectProject(cwd) {
       try {
         for (const f of readdirSync3(full)) {
           try {
-            if (statSync3(join26(full, f)).isFile()) tallyExt(f);
+            if (statSync3(join27(full, f)).isFile()) tallyExt(f);
           } catch {
           }
         }
@@ -7426,10 +7461,10 @@ function generateAgentsMd(cwd) {
   return lines.join("\n");
 }
 function writeAgentsMd(cwd = process.cwd(), force = false) {
-  const path = join26(cwd, "AGENTS.md");
+  const path = join27(cwd, "AGENTS.md");
   const facts = detectProject(cwd);
-  if (existsSync17(path) && !force) return { path, created: false, facts };
-  writeFileSync19(path, generateAgentsMd(cwd), "utf8");
+  if (existsSync18(path) && !force) return { path, created: false, facts };
+  writeFileSync20(path, generateAgentsMd(cwd), "utf8");
   return { path, created: true, facts };
 }
 
@@ -7599,6 +7634,7 @@ async function runTuiRepl(session) {
         `  ${accent("/review")} artifacts   ${accent("/save")} <n> [path]   ${accent("/init")} AGENTS.md   ${accent("/skills")}   ${accent("/connectors")}   ${accent("/voice")}`,
         `  ${accent("/sessions")} list saved   ${accent("/undo")} rewind a turn   ${dim("resume:")} ${accent("oriro -c")} / ${accent("oriro --resume <id>")}`,
         `  ${accent("/plan")} <task> plan read-only   ${accent("/approve")} execute it   ${accent("/reject")} discard   ${accent("/agents")} parallel worktree fan-out`,
+        `  ${accent("/imagine")} <scene> draw an SVG artwork (keyless, auto-saved)`,
         `  ${dim("Shift+Tab")} posture   ${dim("Alt+Shift+T")} thinking   ${accent("/help")}   ${accent("/exit")}`
       ].join("\n");
       chat.addChild(new Text(help, 0, 0));
@@ -7726,6 +7762,18 @@ async function runTuiRepl(session) {
         turnText = plan.task;
       }
     }
+    let imagineTurn = false;
+    if (isImagineSlash(slash)) {
+      const task = imagineTask(text);
+      if (!task) {
+        chat.addChild(new Text(dim("  usage: /imagine <what to draw> \u2014 ORIRO draws a self-contained SVG and saves it here"), 0, 0));
+        editor.setText("");
+        tui.requestRender();
+        return;
+      }
+      imagineTurn = true;
+      turnText = task;
+    }
     if (slash === "/voice") {
       editor.setText("");
       const status = new Text(dim("  \u{1F399} listening\u2026 (needs ffmpeg + the transformers voice peer)"), 0, 0);
@@ -7765,6 +7813,9 @@ async function runTuiRepl(session) {
     bumpTurns();
     void (async () => {
       let english = internalPrompt ?? await translateIncoming(turnText);
+      if (imagineTurn) english = `${IMAGINE_PRIMER}
+
+${english}`;
       if (getMode() === "plan") english = `${PLAN_PRIMER}
 
 ${english}`;
@@ -7810,6 +7861,7 @@ ${english}`;
       if (getMode() === "plan" && notePlanOutput(finalText)) {
         chat.addChild(new Text(dim("  \u25A2 plan ready \u2014 ") + accent("/approve") + dim(" to execute \xB7 ") + accent("/reject") + dim(" to discard"), 0, 0));
       }
+      if (imagineTurn) chat.addChild(new Text(imagineResultLines(finalText).join("\n"), 0, 0));
       tui.requestRender();
       busy = false;
     })();
@@ -7823,8 +7875,8 @@ ${english}`;
 // src/voice/mic.ts
 import { spawn as spawn3 } from "child_process";
 import { tmpdir as tmpdir3 } from "os";
-import { join as join28 } from "path";
-import { existsSync as existsSync18, statSync as statSync4 } from "fs";
+import { join as join29 } from "path";
+import { existsSync as existsSync19, statSync as statSync4 } from "fs";
 function recorders(outFile, seconds) {
   const dur = String(seconds);
   if (process.platform === "darwin") {
@@ -7845,12 +7897,12 @@ function recorders(outFile, seconds) {
   ];
 }
 async function recordMic(seconds = 6) {
-  const outFile = join28(tmpdir3(), `oriro-voice-${process.pid}-${seconds}.wav`);
+  const outFile = join29(tmpdir3(), `oriro-voice-${process.pid}-${seconds}.wav`);
   for (const r of recorders(outFile, seconds)) {
     const okFile = await new Promise((resolve3) => {
       const child = spawn3(r.cmd, r.args, { stdio: "ignore" });
       child.on("error", () => resolve3(false));
-      child.on("close", (code) => resolve3(code === 0 && existsSync18(outFile) && statSync4(outFile).size > 44));
+      child.on("close", (code) => resolve3(code === 0 && existsSync19(outFile) && statSync4(outFile).size > 44));
     });
     if (okFile) return outFile;
   }
@@ -7922,6 +7974,7 @@ function replHelp() {
   ${dim("Continuity")}         ${accent("/sessions")} list saved sessions   ${dim("resume:")} ${accent("oriro -c")} ${dim("or")} ${accent("oriro --resume <id>")}
   ${dim("Plan loop")}          ${accent("/plan")} <task> read-only plan   ${accent("/approve")} execute it   ${accent("/reject")} discard
   ${dim("Fan-out")}            ${accent("/agents")} <A> | <B> parallel sub-agents in isolated git worktrees
+  ${dim("Images")}             ${accent("/imagine")} <scene> draw an SVG artwork (keyless, auto-saved to cwd)
   ${dim("Artifacts")}          ${accent("/review")} code/SVG from the last reply   ${accent("/save")} <n> [path] write one
   ${dim("Project")}            ${accent("/init")} write a starter AGENTS.md ORIRO reads each session
   ${dim("Capabilities")}       ${accent("/skills")}   ${accent("/connectors")}   ${accent("/voice")} speak a turn
@@ -8054,8 +8107,22 @@ async function runReadlineRepl(session) {
           turnText = plan.task;
         }
       }
+      let imagineTurn = false;
+      if (isImagineSlash(slash)) {
+        const task = imagineTask(line);
+        if (!task) {
+          stdout7.write(`  ${dim("usage: /imagine <what to draw> \u2014 ORIRO draws a self-contained SVG and saves it here")}
+`);
+          continue;
+        }
+        imagineTurn = true;
+        turnText = task;
+      }
       bumpTurns();
       let english = internalPrompt ?? await translateIncoming(turnText);
+      if (imagineTurn) english = `${IMAGINE_PRIMER}
+
+${english}`;
       if (getMode() === "plan") english = `${PLAN_PRIMER}
 
 ${english}`;
@@ -8086,6 +8153,7 @@ ${hint}
         stdout7.write(`  ${dim("\u25A2 plan ready \u2014")} ${accent("/approve")} ${dim("to execute \xB7")} ${accent("/reject")} ${dim("to discard")}
 `);
       }
+      if (imagineTurn) stdout7.write(imagineResultLines(shown).join("\n") + "\n");
     }
   } finally {
     process.removeListener("SIGINT", onSigint);
@@ -8194,8 +8262,8 @@ import jmespath from "jmespath";
 
 // src/config/store.ts
 init_paths();
-import { readFileSync as readFileSync22, writeFileSync as writeFileSync20, mkdirSync as mkdirSync16 } from "fs";
-import { join as join29 } from "path";
+import { readFileSync as readFileSync22, writeFileSync as writeFileSync21, mkdirSync as mkdirSync16 } from "fs";
+import { join as join30 } from "path";
 var KEYS = {
   output: {
     desc: "default output format for list commands: text | json | csv",
@@ -8217,7 +8285,7 @@ function validateConfig(key, value) {
   return KEYS[key].validate?.(value) ?? null;
 }
 function file4() {
-  return join29(oriroDir(), "config.json");
+  return join30(oriroDir(), "config.json");
 }
 var cache = null;
 function readAll() {
@@ -8239,7 +8307,7 @@ function configAll() {
 function configSet(key, value) {
   const all = { ...readAll(), [key]: value };
   mkdirSync16(oriroDir(), { recursive: true });
-  writeFileSync20(file4(), JSON.stringify(all, null, 2), "utf8");
+  writeFileSync21(file4(), JSON.stringify(all, null, 2), "utf8");
   cache = all;
 }
 function configUnset(key) {
@@ -8247,7 +8315,7 @@ function configUnset(key) {
   if (!(key in all)) return false;
   const rest = { ...all };
   delete rest[key];
-  writeFileSync20(file4(), JSON.stringify(rest, null, 2), "utf8");
+  writeFileSync21(file4(), JSON.stringify(rest, null, 2), "utf8");
   cache = rest;
   return true;
 }
@@ -8496,7 +8564,7 @@ init_wal();
 init_retrieval();
 
 // src/scribe/transcript.ts
-import { existsSync as existsSync20, readFileSync as readFileSync23 } from "fs";
+import { existsSync as existsSync21, readFileSync as readFileSync23 } from "fs";
 function parseHookStdin(raw) {
   try {
     const j = JSON.parse(raw);
@@ -8529,7 +8597,7 @@ function isHumanUser(e) {
 }
 var FILE_KEYS = ["file_path", "path", "notebook_path", "filePath"];
 function lastTurnFromTranscript(path) {
-  if (!existsSync20(path)) return null;
+  if (!existsSync21(path)) return null;
   const raw = readFileSync23(path, "utf8");
   const entries = [];
   for (const line of raw.split("\n")) {
@@ -8908,10 +8976,10 @@ function registerConnectorsCommand(program2) {
 
 // src/channels/config.ts
 init_paths();
-import { readFileSync as readFileSync25, writeFileSync as writeFileSync21 } from "fs";
-import { join as join30 } from "path";
+import { readFileSync as readFileSync25, writeFileSync as writeFileSync22 } from "fs";
+import { join as join31 } from "path";
 function file5() {
-  return join30(oriroDir(), "channels.json");
+  return join31(oriroDir(), "channels.json");
 }
 function readChannels() {
   try {
@@ -8924,10 +8992,10 @@ function readChannels() {
 function saveChannel(cfg) {
   const all = readChannels().filter((c) => c.kind !== cfg.kind);
   all.push(cfg);
-  writeFileSync21(join30(ensureOriroDir(), "channels.json"), JSON.stringify(all, null, 2), "utf8");
+  writeFileSync22(join31(ensureOriroDir(), "channels.json"), JSON.stringify(all, null, 2), "utf8");
 }
 function removeChannel(kind) {
-  writeFileSync21(join30(ensureOriroDir(), "channels.json"), JSON.stringify(readChannels().filter((c) => c.kind !== kind), null, 2), "utf8");
+  writeFileSync22(join31(ensureOriroDir(), "channels.json"), JSON.stringify(readChannels().filter((c) => c.kind !== kind), null, 2), "utf8");
 }
 
 // src/channels/telegram.ts
@@ -9048,9 +9116,9 @@ async function startDiscord(token) {
 
 // src/channels/whatsapp.ts
 init_paths();
-import { join as join31 } from "path";
+import { join as join32 } from "path";
 function whatsappAuthDir() {
-  return join31(oriroDir(), "whatsapp-auth");
+  return join32(oriroDir(), "whatsapp-auth");
 }
 async function startWhatsApp() {
   let baileys;
@@ -9170,8 +9238,8 @@ function registerChannelsCommand(program2) {
 
 // src/commands/skills.ts
 init_loader();
-import { existsSync as existsSync21, statSync as statSync5, mkdirSync as mkdirSync17, cpSync, rmSync as rmSync4 } from "fs";
-import { resolve as resolve2, join as join32, basename as basename3, dirname as dirname4 } from "path";
+import { existsSync as existsSync22, statSync as statSync5, mkdirSync as mkdirSync17, cpSync, rmSync as rmSync4 } from "fs";
+import { resolve as resolve2, join as join33, basename as basename3, dirname as dirname4 } from "path";
 init_theme();
 function registerSkillsCommand(program2) {
   const skills = program2.command("skills").description("the ORIRO skill library \u2014 bundled + your own");
@@ -9204,28 +9272,28 @@ function registerSkillsCommand(program2) {
   });
   skills.command("add <path>").description("add your own skill \u2014 a folder containing SKILL.md, or a SKILL.md file").action((p) => {
     const src = resolve2(p);
-    if (!existsSync21(src)) die(`not found: ${src}`);
+    if (!existsSync22(src)) die(`not found: ${src}`);
     const dest = userSkillsDir();
     mkdirSync17(dest, { recursive: true });
     const st = statSync5(src);
     if (st.isDirectory()) {
-      if (!existsSync21(join32(src, "SKILL.md"))) die(`no SKILL.md in ${src} \u2014 a skill folder must contain SKILL.md`);
+      if (!existsSync22(join33(src, "SKILL.md"))) die(`no SKILL.md in ${src} \u2014 a skill folder must contain SKILL.md`);
       const name = basename3(src);
-      cpSync(src, join32(dest, name), { recursive: true });
-      ok(`added skill ${accent(name)} \u2192 ${join32(dest, name)}`);
+      cpSync(src, join33(dest, name), { recursive: true });
+      ok(`added skill ${accent(name)} \u2192 ${join33(dest, name)}`);
     } else if (basename3(src).toLowerCase() === "skill.md") {
       const name = basename3(dirname4(src)) || "custom-skill";
-      mkdirSync17(join32(dest, name), { recursive: true });
-      cpSync(src, join32(dest, name, "SKILL.md"));
-      ok(`added skill ${accent(name)} \u2192 ${join32(dest, name)}`);
+      mkdirSync17(join33(dest, name), { recursive: true });
+      cpSync(src, join33(dest, name, "SKILL.md"));
+      ok(`added skill ${accent(name)} \u2192 ${join33(dest, name)}`);
     } else {
       die("expected a folder containing SKILL.md, or a SKILL.md file");
     }
     info("It loads on next launch \u2014 and is available in chat via /skill.");
   });
   skills.command("remove <name>").description("remove a skill you added").option("-f, --force", "skip the confirmation prompt").action(async (name, opts) => {
-    const target = join32(userSkillsDir(), name);
-    if (!existsSync21(target)) {
+    const target = join33(userSkillsDir(), name);
+    if (!existsSync22(target)) {
       info(`'${name}' is not a user-added skill \u2014 nothing to remove`);
       return;
     }
@@ -9829,7 +9897,7 @@ function registerConfigCommand(program2) {
 
 // src/commands/setup.ts
 import { rmSync as rmSync5 } from "fs";
-import { join as join33 } from "path";
+import { join as join34 } from "path";
 import { stdin as stdin12, stdout as stdout11 } from "process";
 init_paths();
 init_theme();
@@ -9839,14 +9907,14 @@ var MARKERS = [
   "skills-onboarded.json",
   "connectors-onboarded.json",
   "models-onboarded.json",
-  join33("routers", "onboarded.json")
+  join34("routers", "onboarded.json")
 ];
 function registerSetupCommand(program2) {
   program2.command("setup").description("run the guided setup wizard (language \xB7 routers \xB7 connectors \xB7 skills \xB7 avatar)").option("--reset", "clear your settled choices and re-ask every step").action(async (opts) => {
     if (opts.reset) {
       for (const m of MARKERS) {
         try {
-          rmSync5(join33(oriroDir(), m), { force: true });
+          rmSync5(join34(oriroDir(), m), { force: true });
         } catch {
         }
       }
@@ -9862,9 +9930,942 @@ function registerSetupCommand(program2) {
   });
 }
 
+// src/config/session.ts
+init_paths();
+import { readFileSync as readFileSync27, writeFileSync as writeFileSync23, rmSync as rmSync6, chmodSync } from "fs";
+import { join as join35 } from "path";
+function sessionPath() {
+  return join35(ensureOriroDir(), "session.json");
+}
+function saveSession(setupToken) {
+  const p = sessionPath();
+  writeFileSync23(p, JSON.stringify({ setup_token: setupToken, saved_at: Date.now() }), "utf8");
+  try {
+    chmodSync(p, 384);
+  } catch {
+  }
+}
+function readSetupToken() {
+  if (process.env.ORIRO_SETUP_TOKEN) return process.env.ORIRO_SETUP_TOKEN;
+  try {
+    const s = JSON.parse(readFileSync27(sessionPath(), "utf8"));
+    return s.setup_token || void 0;
+  } catch {
+    return void 0;
+  }
+}
+function readLicense() {
+  return process.env.ORIRO_LICENSE_KEY ?? "oriro-local-v1";
+}
+function isLoggedIn() {
+  return !!readSetupToken();
+}
+function clearSession() {
+  try {
+    rmSync6(sessionPath(), { force: true });
+  } catch {
+  }
+}
+
+// src/commands/login.ts
+init_theme();
+function registerLoginCommand(program2) {
+  program2.command("login [code]").description("authorize model downloads on this machine (paste the code from oriro.app)").option("--status", "show whether this machine is authorized").action((code, opts) => {
+    if (opts.status) {
+      info(isLoggedIn() ? "this machine is authorized for downloads" : `not authorized \u2014 run ${accent("oriro login <code>")}`);
+      return;
+    }
+    if (!code) {
+      die(`paste your setup code: ${accent("oriro login <code>")} \u2014 get it on oriro.app \u2192 Download \u2192 \u201CConnect this computer\u201D.`);
+    }
+    if (!/^[a-f0-9]{32,64}$/i.test(code)) die("that doesn't look like a valid setup code (expected a 32\u201364 char hex code).");
+    saveSession(code);
+    heading("Authorized");
+    ok(`this machine can now download models \u2014 run ${accent("oriro models pull")}`);
+    info(dim("stored locally in ~/.oriro/session.json (0600); run `oriro logout` to remove."));
+  });
+  program2.command("logout").description("remove this machine's download authorization").action(() => {
+    clearSession();
+    ok("logged out \u2014 download authorization removed from this machine");
+  });
+}
+
+// src/commands/models.ts
+init_paths();
+import { existsSync as existsSync27, statSync as statSync8 } from "fs";
+import { join as join40 } from "path";
+
+// src/weights/container-stream.ts
+import { createCipheriv, createDecipheriv, randomBytes, createHash } from "crypto";
+import { open, stat } from "fs/promises";
+var MAGIC = Buffer.from("ORX1", "ascii");
+var VERSION = 1;
+var IO_CHUNK = 4 * 1024 * 1024;
+function u32(n) {
+  const b = Buffer.alloc(4);
+  b.writeUInt32BE(n, 0);
+  return b;
+}
+async function packOrxToFile(srcGgufPath, destOrxPath, opts) {
+  if (opts.kek.length !== 32) throw new Error("KEK must be 32 bytes (AES-256)");
+  const { size } = await stat(srcGgufPath);
+  const hash = createHash("sha256");
+  {
+    const fh = await open(srcGgufPath, "r");
+    try {
+      const b = Buffer.alloc(IO_CHUNK);
+      let pos = 0;
+      for (; ; ) {
+        const { bytesRead } = await fh.read(b, 0, IO_CHUNK, pos);
+        if (!bytesRead) break;
+        hash.update(b.subarray(0, bytesRead));
+        pos += bytesRead;
+      }
+    } finally {
+      await fh.close();
+    }
+  }
+  const sha256 = hash.digest("hex");
+  const cek = randomBytes(32);
+  const payloadNonce = randomBytes(12);
+  const aad = Buffer.from(
+    JSON.stringify({ v: VERSION, modelId: opts.meta.modelId, version: opts.meta.version, watermark: opts.watermark, sha256 }),
+    "utf8"
+  );
+  const wrapNonce = randomBytes(12);
+  const wc = createCipheriv("aes-256-gcm", opts.kek, wrapNonce);
+  wc.setAAD(aad);
+  const wrappedCek = Buffer.concat([wc.update(cek), wc.final()]);
+  const wrapTag = wc.getAuthTag();
+  const header2 = {
+    ...opts.meta,
+    cipher: "AES-256-GCM",
+    wrapNonce: wrapNonce.toString("base64"),
+    wrappedCek: wrappedCek.toString("base64"),
+    wrapTag: wrapTag.toString("base64"),
+    payloadNonce: payloadNonce.toString("base64"),
+    watermark: opts.watermark,
+    sha256,
+    payloadLen: size
+    // GCM ciphertext length == plaintext length
+  };
+  const headerJson = Buffer.from(JSON.stringify(header2), "utf8");
+  const out = await open(destOrxPath, "w");
+  try {
+    await out.write(Buffer.concat([MAGIC, Buffer.from([VERSION]), u32(headerJson.length), headerJson]));
+    const pc = createCipheriv("aes-256-gcm", cek, payloadNonce);
+    pc.setAAD(aad);
+    const fh = await open(srcGgufPath, "r");
+    try {
+      const b = Buffer.alloc(IO_CHUNK);
+      let pos = 0;
+      for (; ; ) {
+        const { bytesRead } = await fh.read(b, 0, IO_CHUNK, pos);
+        if (!bytesRead) break;
+        const enc = pc.update(b.subarray(0, bytesRead));
+        if (enc.length) await out.write(enc);
+        pos += bytesRead;
+      }
+    } finally {
+      await fh.close();
+    }
+    const fin = pc.final();
+    await out.write(Buffer.concat([fin, pc.getAuthTag()]));
+  } finally {
+    await out.close();
+  }
+  return header2;
+}
+async function unpackOrxToFile(srcOrxPath, destGgufPath, kek) {
+  if (kek.length !== 32) throw new Error("KEK must be 32 bytes (AES-256)");
+  const src = await open(srcOrxPath, "r");
+  try {
+    const pre = Buffer.alloc(9);
+    const { bytesRead: pr } = await src.read(pre, 0, 9, 0);
+    if (pr < 9 || !pre.subarray(0, 4).equals(MAGIC)) throw new Error("not an ORX container");
+    if (pre[4] !== VERSION) throw new Error(`unsupported ORX version ${pre[4]}`);
+    const headerLen = pre.readUInt32BE(5);
+    const hbuf = Buffer.alloc(headerLen);
+    await src.read(hbuf, 0, headerLen, 9);
+    const header2 = JSON.parse(hbuf.toString("utf8"));
+    const aad = Buffer.from(
+      JSON.stringify({ v: VERSION, modelId: header2.modelId, version: header2.version, watermark: header2.watermark, sha256: header2.sha256 }),
+      "utf8"
+    );
+    const wc = createDecipheriv("aes-256-gcm", kek, Buffer.from(header2.wrapNonce, "base64"));
+    wc.setAAD(aad);
+    wc.setAuthTag(Buffer.from(header2.wrapTag, "base64"));
+    let cek;
+    try {
+      cek = Buffer.concat([wc.update(Buffer.from(header2.wrappedCek, "base64")), wc.final()]);
+    } catch {
+      throw new Error("ORX unlock failed \u2014 wrong device/license, or the container was tampered with");
+    }
+    const cipherStart = 9 + headerLen;
+    const cipherLen = header2.payloadLen;
+    const tag = Buffer.alloc(16);
+    await src.read(tag, 0, 16, cipherStart + cipherLen);
+    const pc = createDecipheriv("aes-256-gcm", cek, Buffer.from(header2.payloadNonce, "base64"));
+    pc.setAAD(aad);
+    pc.setAuthTag(tag);
+    const hash = createHash("sha256");
+    const out = await open(destGgufPath, "w");
+    try {
+      const b = Buffer.alloc(IO_CHUNK);
+      let pos = cipherStart;
+      let remaining = cipherLen;
+      while (remaining > 0) {
+        const { bytesRead } = await src.read(b, 0, Math.min(IO_CHUNK, remaining), pos);
+        if (!bytesRead) break;
+        const dec = pc.update(b.subarray(0, bytesRead));
+        if (dec.length) {
+          await out.write(dec);
+          hash.update(dec);
+        }
+        pos += bytesRead;
+        remaining -= bytesRead;
+      }
+      let fin;
+      try {
+        fin = pc.final();
+      } catch {
+        throw new Error("ORX payload decryption failed \u2014 container corrupt or tampered");
+      }
+      if (fin.length) {
+        await out.write(fin);
+        hash.update(fin);
+      }
+    } finally {
+      await out.close();
+    }
+    if (hash.digest("hex") !== header2.sha256) {
+      throw new Error("ORX integrity check failed \u2014 decrypted weights do not match the manifest");
+    }
+    return header2;
+  } finally {
+    await src.close();
+  }
+}
+
+// src/weights/binding.ts
+init_paths();
+import { randomBytes as randomBytes2, scryptSync, createHash as createHash2 } from "crypto";
+import { existsSync as existsSync23, mkdirSync as mkdirSync18, readFileSync as readFileSync28, writeFileSync as writeFileSync24, chmodSync as chmodSync2 } from "fs";
+import { hostname, userInfo, platform as platform2, arch } from "os";
+import { join as join36 } from "path";
+var SCRYPT_N = 1 << 15;
+var SCRYPT_R = 8;
+var SCRYPT_P = 1;
+function weightsDir() {
+  const d = join36(oriroDir(), "weights");
+  mkdirSync18(d, { recursive: true });
+  return d;
+}
+function installSecret() {
+  const p = join36(weightsDir(), ".install");
+  if (existsSync23(p)) {
+    const b = Buffer.from(readFileSync28(p, "utf8").trim(), "hex");
+    if (b.length === 32) return b;
+  }
+  const secret = randomBytes2(32);
+  writeFileSync24(p, secret.toString("hex"), "utf8");
+  try {
+    chmodSync2(p, 384);
+  } catch {
+  }
+  return secret;
+}
+function deviceFingerprint() {
+  const u = userInfo();
+  return createHash2("sha256").update([hostname(), u.username, platform2(), arch(), String(u.uid)].join("|")).digest("hex");
+}
+function deriveKek(licenseKey) {
+  const salt = createHash2("sha256").update("oriro-orx-v1|" + deviceFingerprint()).digest();
+  const material = Buffer.concat([installSecret(), Buffer.from(licenseKey, "utf8")]);
+  return scryptSync(material, salt, 32, { N: SCRYPT_N, r: SCRYPT_R, p: SCRYPT_P, maxmem: 128 * 1024 * 1024 });
+}
+
+// src/weights/pull.ts
+init_paths();
+import { createHash as createHash3 } from "crypto";
+import { open as open2, stat as stat2, mkdir, unlink } from "fs/promises";
+import { existsSync as existsSync24 } from "fs";
+import { join as join37 } from "path";
+function nextRange(offset, total, chunk) {
+  if (offset >= total) return null;
+  return { start: offset, end: Math.min(offset + chunk, total) - 1 };
+}
+async function probeSize(url, signal) {
+  const r = await fetch(url, { headers: { Range: "bytes=0-0" }, signal });
+  const cr = r.headers.get("content-range");
+  await r.arrayBuffer().catch(() => void 0);
+  if (!r.ok && r.status !== 206) throw new Error(`size probe HTTP ${r.status}`);
+  if (!cr) throw new Error("server did not return a byte range \u2014 cannot size the model");
+  const total = Number(cr.split("/")[1]);
+  if (!Number.isFinite(total) || total <= 1) throw new Error("could not determine model size");
+  return total;
+}
+async function sha256File(path) {
+  const hash = createHash3("sha256");
+  const fh = await open2(path, "r");
+  try {
+    const b = Buffer.alloc(4 * 1024 * 1024);
+    let pos = 0;
+    for (; ; ) {
+      const { bytesRead } = await fh.read(b, 0, b.length, pos);
+      if (!bytesRead) break;
+      hash.update(b.subarray(0, bytesRead));
+      pos += bytesRead;
+    }
+  } finally {
+    await fh.close();
+  }
+  return hash.digest("hex");
+}
+async function fetchRange(urlRef, range, spec, retries) {
+  let attempt = 0;
+  let refreshes = 0;
+  for (; ; ) {
+    if (spec.signal?.aborted) throw new DOMException("Aborted", "AbortError");
+    try {
+      const r = await fetch(urlRef.url, { headers: { Range: `bytes=${range.start}-${range.end}` }, signal: spec.signal });
+      if (r.status === 401 && spec.refresh && refreshes < 3) {
+        refreshes++;
+        urlRef.url = await spec.refresh();
+        continue;
+      }
+      if (r.status === 200) throw new Error("server ignored Range (200) \u2014 refusing to write a full body at an offset");
+      if (r.status !== 206) throw new Error(`chunk HTTP ${r.status}`);
+      const ab = await r.arrayBuffer();
+      const want = range.end - range.start + 1;
+      if (ab.byteLength !== want) throw new Error(`short chunk (${ab.byteLength}/${want})`);
+      return Buffer.from(ab);
+    } catch (e) {
+      attempt++;
+      if (spec.signal?.aborted || attempt >= retries) throw e;
+      await new Promise((res) => setTimeout(res, Math.min(500 * 2 ** (attempt - 1), 4e3)));
+    }
+  }
+}
+async function pullModelToOrx(spec) {
+  const stageDir = join37(oriroDir(), "weights", "staging");
+  await mkdir(stageDir, { recursive: true });
+  const part = join37(stageDir, `${spec.modelId}.gguf.part`);
+  const chunk = spec.chunkBytes ?? 16 * 1024 * 1024;
+  const retries = spec.retries ?? 5;
+  const urlRef = { url: spec.url };
+  let offset = existsSync24(part) ? (await stat2(part)).size : 0;
+  if (offset > spec.sizeBytes) {
+    await unlink(part);
+    offset = 0;
+  }
+  spec.onProgress?.(offset, spec.sizeBytes);
+  const fh = await open2(part, offset > 0 ? "r+" : "w");
+  try {
+    let cursor = offset;
+    for (let range = nextRange(cursor, spec.sizeBytes, chunk); range; range = nextRange(cursor, spec.sizeBytes, chunk)) {
+      const buf = await fetchRange(urlRef, range, spec, retries);
+      await fh.write(buf, 0, buf.length, cursor);
+      cursor += buf.length;
+      spec.onProgress?.(cursor, spec.sizeBytes);
+    }
+  } finally {
+    await fh.close();
+  }
+  const actual = await sha256File(part);
+  if (spec.sha256 && actual !== spec.sha256) {
+    await unlink(part);
+    throw new Error(`${spec.modelId}: download failed the integrity check (sha256 mismatch) \u2014 please retry`);
+  }
+  const orxPath2 = join37(oriroDir(), "weights", `${spec.modelId}.orx`);
+  await packOrxToFile(part, orxPath2, {
+    kek: deriveKek(spec.licenseKey),
+    watermark: spec.watermark ?? `orx:${spec.modelId}-v${spec.version ?? "2.4"}:${actual.slice(0, 12)}`,
+    meta: { modelId: spec.modelId, version: spec.version ?? "2.4", createdTs: spec.createdTs }
+  });
+  await unlink(part);
+  return { orxPath: orxPath2, modelId: spec.modelId, bytes: spec.sizeBytes };
+}
+
+// src/weights/serve.ts
+import { createServer } from "http";
+import { randomBytes as randomBytes4 } from "crypto";
+import { existsSync as existsSync26 } from "fs";
+import { join as join39 } from "path";
+
+// src/weights/secure-load.ts
+init_paths();
+import {
+  chmodSync as chmodSync3,
+  mkdirSync as mkdirSync19,
+  writeFileSync as writeFileSync25,
+  existsSync as existsSync25,
+  statSync as statSync6,
+  openSync as openSync5,
+  writeSync as writeSync5,
+  closeSync as closeSync5,
+  unlinkSync
+} from "fs";
+import { join as join38 } from "path";
+import { randomBytes as randomBytes3 } from "crypto";
+function secureDir() {
+  const d = join38(ensureOriroDir(), "weights", "run");
+  mkdirSync19(d, { recursive: true });
+  try {
+    chmodSync3(d, 448);
+  } catch {
+  }
+  return d;
+}
+function shredAndUnlink(path) {
+  try {
+    if (!existsSync25(path)) return;
+    const size = statSync6(path).size;
+    const fd = openSync5(path, "r+");
+    try {
+      const chunk = randomBytes3(1024 * 1024);
+      for (let off = 0; off < size; off += chunk.length) {
+        writeSync5(fd, chunk, 0, Math.min(chunk.length, size - off), off);
+      }
+    } finally {
+      closeSync5(fd);
+    }
+    unlinkSync(path);
+  } catch {
+  }
+}
+var live = /* @__PURE__ */ new Set();
+var exitHooked = false;
+function hookExit() {
+  if (exitHooked) return;
+  exitHooked = true;
+  const cleanup = () => {
+    for (const p of live) shredAndUnlink(p);
+    live.clear();
+  };
+  process.once("exit", cleanup);
+  for (const sig of ["SIGINT", "SIGTERM", "SIGHUP"]) {
+    process.once(sig, () => {
+      cleanup();
+      process.exit(130);
+    });
+  }
+}
+async function decryptToSecureFile(orxPath2, licenseKey) {
+  hookExit();
+  const path = join38(secureDir(), `run-${randomBytes3(6).toString("hex")}.gguf`);
+  live.add(path);
+  let header2;
+  try {
+    header2 = await unpackOrxToFile(orxPath2, path, deriveKek(licenseKey));
+  } catch (e) {
+    live.delete(path);
+    shredAndUnlink(path);
+    throw e;
+  }
+  try {
+    chmodSync3(path, 384);
+  } catch {
+  }
+  let disposed = false;
+  return {
+    path,
+    modelId: header2.modelId,
+    dispose() {
+      if (disposed) return;
+      disposed = true;
+      live.delete(path);
+      shredAndUnlink(path);
+    }
+  };
+}
+
+// src/weights/template.ts
+var IM_START = "<|im_start|>";
+var IM_END = "<|im_end|>";
+var STOP_SEQUENCES = [IM_END, "<|endoftext|>"];
+var SYSTEM = {
+  gauss: "You are Gauss, ORIRO's builder intelligence \u2014 you help people build websites, apps, and APIs and ship software. Lead with the deliverable immediately, no preamble. You are part of ORIRO (oriro.ai), the free AI platform. You never mention any other AI model \u2014 you are Gauss, and that is all.",
+  avila: "You are Avila, ORIRO's orchestration intelligence. You help users plan, coordinate ORIRO's features, and manage multi-step workflows. You are part of ORIRO (oriro.ai), the free AI platform. You never mention any other AI model \u2014 you are Avila, and that is all."
+};
+function systemFor(modelId) {
+  const s = SYSTEM[modelId.toLowerCase()];
+  if (!s) throw new Error(`no system prompt for model "${modelId}"`);
+  return s;
+}
+function buildPrompt(modelId, messages, systemOverride) {
+  const sys = systemOverride ?? systemFor(modelId);
+  let prompt = `${IM_START}system
+${sys}${IM_END}
+`;
+  for (const m of messages) {
+    if (m.role === "system") continue;
+    prompt += `${IM_START}${m.role}
+${m.content}${IM_END}
+`;
+  }
+  prompt += `${IM_START}assistant
+`;
+  return { prompt, stops: STOP_SEQUENCES };
+}
+
+// src/weights/think-strip.ts
+var OPEN = "<think>";
+var CLOSE = "</think>";
+function thinkFilter() {
+  let state = "before";
+  let buf = "";
+  return {
+    push(chunk) {
+      if (state === "after") return chunk;
+      buf += chunk;
+      if (state === "before") {
+        const trimmed = buf.replace(/^\s+/, "");
+        if (trimmed === "") return "";
+        if (OPEN.startsWith(trimmed)) return "";
+        if (trimmed.startsWith(OPEN)) {
+          state = "inside";
+          buf = trimmed.slice(OPEN.length);
+        } else {
+          state = "after";
+          const out = buf;
+          buf = "";
+          return out;
+        }
+      }
+      const idx = buf.indexOf(CLOSE);
+      if (idx === -1) {
+        const keep = Math.min(buf.length, CLOSE.length - 1);
+        buf = buf.slice(buf.length - keep);
+        return "";
+      }
+      state = "after";
+      const after = buf.slice(idx + CLOSE.length).replace(/^\s+/, "");
+      buf = "";
+      return after;
+    },
+    end() {
+      if (state === "before") {
+        const out = buf;
+        buf = "";
+        return out;
+      }
+      buf = "";
+      return "";
+    }
+  };
+}
+
+// src/weights/engine.ts
+async function importLlama() {
+  try {
+    return await import("node-llama-cpp");
+  } catch {
+    throw new Error(
+      "The on-device engine isn't available. The ORIRO app ships it prebuilt; from source, install the optional dependency with: npm i node-llama-cpp"
+    );
+  }
+}
+async function loadEngine(modelPath, modelId, nCtx, mmprojPath) {
+  const mod = await importLlama();
+  const getLlama = mod.getLlama;
+  const LlamaCompletion = mod.LlamaCompletion;
+  const llama = await getLlama();
+  const model = await llama.loadModel(mmprojPath ? { modelPath, mmproj: mmprojPath } : { modelPath });
+  const context = await model.createContext({ contextSize: nCtx });
+  return {
+    async chat(messages, onToken, opts) {
+      const { prompt, stops } = buildPrompt(modelId, messages, opts?.systemOverride);
+      const completion = new LlamaCompletion({ contextSequence: context.getSequence() });
+      const filter = thinkFilter();
+      let visible = "";
+      await completion.generateCompletion(prompt, {
+        onTextChunk: (t) => {
+          const v = filter.push(t);
+          if (v) {
+            visible += v;
+            onToken(v);
+          }
+        },
+        customStopTriggers: stops,
+        maxTokens: opts?.maxTokens,
+        signal: opts?.signal
+      });
+      const tail = filter.end();
+      if (tail) {
+        visible += tail;
+        onToken(tail);
+      }
+      completion.dispose?.();
+      return visible;
+    },
+    async dispose() {
+      await context.dispose();
+      await model.dispose();
+    }
+  };
+}
+
+// src/weights/preflight.ts
+import { freemem } from "os";
+var MiB = 1024 * 1024;
+var GiB = 1024 * MiB;
+var DEFAULT_CTX = 8192;
+var CTX_FLOOR = 2048;
+var HEADROOM = 1.25;
+function kvBytesPerToken(paramsB) {
+  return Math.max(0.05, paramsB * 0.014) * MiB;
+}
+function planContext(fp, requestedCtx, freeBytes = freemem()) {
+  const weights = fp.fileBytes;
+  const budget = freeBytes / HEADROOM - weights;
+  if (budget <= 0) {
+    return {
+      decision: "refuse",
+      nCtx: 0,
+      reason: `Not enough free memory: this model needs about ${(weights / GiB).toFixed(1)} GB resident and only ${(freeBytes / GiB).toFixed(1)} GB is free. Close some apps and try again.`
+    };
+  }
+  const maxCtxByRam = Math.floor(budget / kvBytesPerToken(fp.paramsB));
+  const want = requestedCtx > 0 ? requestedCtx : DEFAULT_CTX;
+  const nCtx = Math.max(0, Math.min(want, maxCtxByRam));
+  if (nCtx < CTX_FLOOR) {
+    return {
+      decision: "refuse",
+      nCtx: 0,
+      reason: `Not enough free memory for a usable context window (only ${nCtx.toLocaleString()} tokens fit). Close some apps and try again.`
+    };
+  }
+  if (nCtx < want) {
+    return {
+      decision: "reduced",
+      nCtx,
+      reason: `Context set to ${nCtx.toLocaleString()} tokens to fit your free memory (${(freeBytes / GiB).toFixed(1)} GB). The model still works \u2014 just a shorter memory per chat.`
+    };
+  }
+  return { decision: "ok", nCtx, reason: `Ready \u2014 ${nCtx.toLocaleString()} tokens of context.` };
+}
+
+// src/weights/local-runtime.ts
+import { statSync as statSync7 } from "fs";
+async function startLocalModel(orxPath2, licenseKey, paramsB, opts = {}) {
+  const secure = await decryptToSecureFile(orxPath2, licenseKey);
+  let mmproj = null;
+  try {
+    if (opts.mmprojOrxPath) mmproj = await decryptToSecureFile(opts.mmprojOrxPath, licenseKey);
+    const plan = planContext({ paramsB, fileBytes: statSync7(secure.path).size }, opts.requestedCtx ?? 0);
+    if (plan.decision === "refuse") throw new Error(plan.reason);
+    const engine = await loadEngine(secure.path, secure.modelId, plan.nCtx, mmproj?.path);
+    let disposed = false;
+    return {
+      modelId: secure.modelId,
+      plan,
+      async chat(messages, onToken, o) {
+        const last = messages[messages.length - 1];
+        const answer = await engine.chat(messages, onToken, { signal: o?.signal });
+        if (opts.capture && last?.role === "user") {
+          opts.capture.captureConsentedTurn(secure.modelId, last.content, answer);
+        }
+        return answer;
+      },
+      async dispose() {
+        if (disposed) return;
+        disposed = true;
+        await engine.dispose();
+        mmproj?.dispose();
+        secure.dispose();
+      }
+    };
+  } catch (e) {
+    mmproj?.dispose();
+    secure.dispose();
+    throw e;
+  }
+}
+
+// src/weights/serve.ts
+init_paths();
+var KNOWN_MODELS = ["gauss", "avila"];
+var MODEL_PARAMS_B = { gauss: 9, avila: 9 };
+var DEFAULT_PORT = 11435;
+var ORIRO_ORIGIN = /^https:\/\/(www\.)?oriro\.(ai|app)$/;
+function orxPathFor(modelId) {
+  return join39(oriroDir(), "weights", `${modelId}.orx`);
+}
+function normalizeModel(raw) {
+  const s = String(raw ?? "").toLowerCase();
+  for (const m of KNOWN_MODELS) if (s.includes(m)) return m;
+  return "gauss";
+}
+function sseData(obj) {
+  return `data: ${JSON.stringify(obj)}
+
+`;
+}
+function deltaChunk(model, id, content) {
+  return { id, object: "chat.completion.chunk", model, choices: [{ index: 0, delta: { content }, finish_reason: null }] };
+}
+function finalChunk(model, id) {
+  return { id, object: "chat.completion.chunk", model, choices: [{ index: 0, delta: {}, finish_reason: "stop" }] };
+}
+async function readJson2(req) {
+  const chunks = [];
+  for await (const c of req) chunks.push(c);
+  try {
+    return JSON.parse(Buffer.concat(chunks).toString("utf8"));
+  } catch {
+    return {};
+  }
+}
+async function startLocalServer(opts) {
+  const warm = /* @__PURE__ */ new Map();
+  const getModel = (modelId) => {
+    let p = warm.get(modelId);
+    if (!p) {
+      const mmprojPath = orxPathFor(`${modelId}-mmproj`);
+      p = startLocalModel(orxPathFor(modelId), opts.licenseKey, MODEL_PARAMS_B[modelId] ?? 9, {
+        mmprojOrxPath: existsSync26(mmprojPath) ? mmprojPath : void 0
+      });
+      warm.set(modelId, p);
+    }
+    return p;
+  };
+  const server = createServer((req, res) => {
+    void handle(req, res, getModel).catch(() => {
+      if (!res.headersSent) res.writeHead(500);
+      res.end();
+    });
+  });
+  const port = opts.port ?? DEFAULT_PORT;
+  await new Promise((resolve3) => server.listen(port, opts.host ?? "127.0.0.1", resolve3));
+  return {
+    port,
+    async close() {
+      await new Promise((r) => server.close(() => r()));
+      for (const p of warm.values()) {
+        try {
+          (await p).dispose();
+        } catch {
+        }
+      }
+    }
+  };
+}
+async function handle(req, res, getModel) {
+  const origin = req.headers.origin;
+  if (origin && ORIRO_ORIGIN.test(origin)) {
+    res.setHeader("access-control-allow-origin", origin);
+    res.setHeader("vary", "origin");
+  }
+  if (req.method === "OPTIONS") {
+    if (origin && ORIRO_ORIGIN.test(origin)) {
+      res.setHeader("access-control-allow-methods", "GET, POST, OPTIONS");
+      res.setHeader("access-control-allow-headers", "content-type, authorization");
+      res.setHeader("access-control-allow-private-network", "true");
+    }
+    res.writeHead(204).end();
+    return;
+  }
+  const url = new URL(req.url ?? "/", "http://localhost");
+  if (url.pathname === "/health") {
+    res.writeHead(200, { "content-type": "application/json" }).end(JSON.stringify({ status: "ok" }));
+    return;
+  }
+  if (url.pathname === "/v1/models") {
+    const data = KNOWN_MODELS.filter((m) => existsSync26(orxPathFor(m))).map((id) => ({ id, object: "model" }));
+    res.writeHead(200, { "content-type": "application/json" }).end(JSON.stringify({ object: "list", data }));
+    return;
+  }
+  if (url.pathname === "/v1/chat/completions" && req.method === "POST") {
+    await chatCompletions(req, res, getModel);
+    return;
+  }
+  res.writeHead(404).end();
+}
+async function chatCompletions(req, res, getModel) {
+  const body = await readJson2(req);
+  const modelId = normalizeModel(body.model);
+  const messages = Array.isArray(body.messages) ? body.messages : [];
+  const id = `chatcmpl-${randomBytes4(8).toString("hex")}`;
+  let model;
+  try {
+    model = await getModel(modelId);
+  } catch (e) {
+    res.writeHead(503, { "content-type": "application/json" }).end(JSON.stringify({ error: { message: e.message } }));
+    return;
+  }
+  res.writeHead(200, { "content-type": "text/event-stream", "cache-control": "no-cache", connection: "keep-alive" });
+  try {
+    await model.chat(messages, (t) => {
+      res.write(sseData(deltaChunk(modelId, id, t)));
+    });
+    res.write(sseData(finalChunk(modelId, id)));
+    res.write("data: [DONE]\n\n");
+  } catch (e) {
+    res.write(sseData({ error: { message: e.message } }));
+  }
+  res.end();
+}
+
+// src/commands/models.ts
+init_theme();
+var MODELS = [
+  { id: "gauss", label: "Gauss V2.4", paramsB: 9 },
+  { id: "avila", label: "Avila V2.4", paramsB: 9 }
+];
+function orxPath(id) {
+  return join40(oriroDir(), "weights", `${id}.orx`);
+}
+function gb(n) {
+  return (n / 1e9).toFixed(2) + " GB";
+}
+function modelIdFromFilename(p) {
+  const base = (p.replace(/\\/g, "/").split("/").pop() ?? "").toLowerCase().replace(/\.gguf$/, "");
+  const root = base.includes("gauss") ? "gauss" : base.includes("avila") ? "avila" : null;
+  if (!root) return null;
+  return base.includes("mmproj") ? `${root}-mmproj` : root;
+}
+async function fetchManifest(base, setupToken) {
+  const r = await fetch(`${base}/api/weights/manifest`, {
+    method: "POST",
+    headers: { "content-type": "application/json" },
+    body: JSON.stringify({ setup_token: setupToken })
+  });
+  if (r.status === 401 || r.status === 403) {
+    throw new Error(`downloads refused (HTTP ${r.status}) \u2014 run \`oriro login\` to authorize this machine${r.status === 403 ? " (device attestation required)" : ""}.`);
+  }
+  if (!r.ok) throw new Error(`weights manifest HTTP ${r.status}`);
+  const d = await r.json();
+  return d.models ?? {};
+}
+async function resumeUrl(base, setupToken, modelId) {
+  const r = await fetch(`${base}/api/weights/resume`, {
+    method: "POST",
+    headers: { "content-type": "application/json" },
+    body: JSON.stringify({ key: `${modelId}.gguf`, setup_token: setupToken })
+  });
+  const d = await r.json().catch(() => ({}));
+  if (!r.ok || !d.model?.url) throw new Error("link refresh failed");
+  return d.model.url;
+}
+function registerModelsCommand(program2) {
+  const models = program2.command("models").description("run Gauss & Avila on this machine \u2014 download, serve, status (no Ollama)");
+  models.command("status").description("show which models are installed on this machine").action(() => {
+    heading("ORIRO models \u2014 on this machine");
+    for (const m of MODELS) {
+      const p = orxPath(m.id);
+      if (existsSync27(p)) ok(`${m.label} \u2014 installed (${gb(statSync8(p).size)}, device-locked)`);
+      else info(`${m.label} \u2014 ${dim("not downloaded")}`);
+    }
+    info(dim(`location: ${join40(oriroDir(), "weights")}`));
+  });
+  models.command("pull").description("download Gauss then Avila to this machine (one at a time, resumable)").option("--only <id>", "download just one model (gauss|avila)").action(async (opts) => {
+    const base = process.env.ORIRO_API_BASE ?? "https://oriro.ai";
+    const license = readLicense();
+    const setupToken = readSetupToken();
+    if (!setupToken) die("not authorized for downloads \u2014 run `oriro login <code>` first (code from oriro.app).");
+    const pick = opts.only ? MODELS.filter((m) => m.id === opts.only.toLowerCase()) : [...MODELS];
+    if (!pick.length) die(`unknown model "${opts.only}" (use gauss|avila)`);
+    let manifest;
+    try {
+      manifest = await fetchManifest(base, setupToken);
+    } catch (e) {
+      return die(e.message);
+    }
+    for (const m of pick) {
+      const entry = manifest[m.id];
+      if (!entry?.url) return die(`the weights manifest has no entry for ${m.id}`);
+      heading(m.label);
+      const size = await probeSize(entry.url).catch((e) => die(e.message));
+      info(`downloading ${gb(size)} \u2014 resumable, streams straight to disk`);
+      let lastPct = -1;
+      await pullModelToOrx({
+        modelId: m.id,
+        url: entry.url,
+        sizeBytes: size,
+        sha256: entry.sha256 ?? "",
+        licenseKey: license,
+        createdTs: Date.now(),
+        version: "2.4",
+        refresh: () => resumeUrl(base, setupToken, m.id),
+        onProgress: (done, total) => {
+          const pct = Math.floor(done / total * 100);
+          if (pct !== lastPct) {
+            lastPct = pct;
+            process.stdout.write(`\r  ${accent(String(pct).padStart(3))}%  ${gb(done)} / ${gb(total)}   `);
+          }
+        }
+      });
+      process.stdout.write("\n");
+      ok(`${m.label} ready \u2014 locked to this device`);
+      const vision = manifest[`${m.id}-mmproj`];
+      if (vision?.url) {
+        info(`${m.label} vision projector \u2026`);
+        const vsize = await probeSize(vision.url).catch(() => 0);
+        if (vsize > 0) {
+          await pullModelToOrx({
+            modelId: `${m.id}-mmproj`,
+            url: vision.url,
+            sizeBytes: vsize,
+            sha256: vision.sha256 ?? "",
+            licenseKey: license,
+            createdTs: Date.now(),
+            version: "2.4",
+            refresh: () => resumeUrl(base, setupToken, `${m.id}-mmproj`)
+          });
+          ok(`${m.label} vision ready`);
+        }
+      }
+    }
+    ok("all set \u2014 run `oriro models serve` to use them locally");
+  });
+  models.command("import <files...>").description("device-lock GGUFs you downloaded from oriro.app into runnable .orx (local, no login)").action(async (files) => {
+    const license = readLicense();
+    heading("Import models to this machine");
+    let done = 0;
+    for (const f of files) {
+      if (!existsSync27(f)) {
+        info(`skip ${f} \u2014 file not found`);
+        continue;
+      }
+      const id = modelIdFromFilename(f);
+      if (!id) {
+        info(`skip ${f} \u2014 filename must contain 'gauss' or 'avila'`);
+        continue;
+      }
+      const label = MODELS.find((m) => m.id === id)?.label ?? id;
+      info(`device-locking ${label} \u2026`);
+      await packOrxToFile(f, orxPath(id), {
+        kek: deriveKek(license),
+        watermark: `orx:${id}-import`,
+        meta: { modelId: id, version: "2.4", createdTs: Date.now() }
+      });
+      ok(`${label} imported (${gb(statSync8(orxPath(id)).size)}, locked to this device)`);
+      done++;
+    }
+    if (!done) die("nothing imported \u2014 pass the gauss.gguf / avila.gguf you downloaded from oriro.app");
+    ok("run `oriro models serve` to use them locally (no Ollama)");
+  });
+  models.command("serve").description("run the models locally on an OpenAI-compatible endpoint (no Ollama)").option("-p, --port <n>", "port (default 11435)", (v) => parseInt(v, 10)).action(async (opts) => {
+    const license = readLicense();
+    const installed = MODELS.filter((m) => existsSync27(orxPath(m.id)));
+    if (!installed.length) die("no models installed \u2014 run `oriro models pull` first.");
+    const server = await startLocalServer({ licenseKey: license, port: opts.port });
+    heading("ORIRO local endpoint");
+    ok(`serving ${installed.map((m) => m.label).join(" + ")} on http://127.0.0.1:${server.port}`);
+    info(dim("OpenAI-compatible: POST /v1/chat/completions \xB7 GET /v1/models \xB7 GET /health"));
+    info(dim("oriro.ai / oriro.app reach it directly (CORS built in). Ctrl-C to stop."));
+    await new Promise((resolve3) => {
+      process.on("SIGINT", () => {
+        void server.close().then(resolve3);
+      });
+    });
+  });
+}
+
 // src/commands/import.ts
-import { existsSync as existsSync22, readFileSync as readFileSync27, readdirSync as readdirSync4, statSync as statSync6, cpSync as cpSync2, mkdirSync as mkdirSync18 } from "fs";
-import { join as join34, basename as basename4 } from "path";
+import { existsSync as existsSync28, readFileSync as readFileSync29, readdirSync as readdirSync4, statSync as statSync9, cpSync as cpSync2, mkdirSync as mkdirSync20 } from "fs";
+import { join as join41, basename as basename4 } from "path";
 init_mcp_client();
 init_custom();
 init_loader();
@@ -9872,10 +10873,10 @@ init_theme();
 function registerImportCommand(program2) {
   const imp = program2.command("import").description("migrate from another CLI (MCP servers, skills)");
   imp.command("mcp <file>").description("import MCP servers from a Claude-compatible mcp.json (Guardian-vetted)").action((file6) => {
-    if (!existsSync22(file6)) die(`no such file: ${file6}`);
+    if (!existsSync28(file6)) die(`no such file: ${file6}`);
     let servers;
     try {
-      const j = JSON.parse(readFileSync27(file6, "utf8"));
+      const j = JSON.parse(readFileSync29(file6, "utf8"));
       servers = j.mcpServers ?? j.servers ?? {};
     } catch (e) {
       die(`could not parse ${file6}: ${e instanceof Error ? e.message : String(e)}`);
@@ -9921,14 +10922,14 @@ function registerImportCommand(program2) {
     info(`${imported} imported \xB7 ${blocked2} blocked${imported ? ` \u2014 they connect in-session; see \`oriro connectors custom\`` : ""}`);
   });
   imp.command("skills <dir>").description("import SKILL.md skill folders from another CLI's skills directory").action((dir) => {
-    if (!existsSync22(dir) || !statSync6(dir).isDirectory()) die(`no such directory: ${dir}`);
+    if (!existsSync28(dir) || !statSync9(dir).isDirectory()) die(`no such directory: ${dir}`);
     const dest = userSkillsDir();
-    mkdirSync18(dest, { recursive: true });
+    mkdirSync20(dest, { recursive: true });
     heading("Import skills");
-    const sources = existsSync22(join34(dir, "SKILL.md")) ? [dir] : readdirSync4(dir).map((e) => join34(dir, e)).filter((p) => statSync6(p).isDirectory() && existsSync22(join34(p, "SKILL.md")));
+    const sources = existsSync28(join41(dir, "SKILL.md")) ? [dir] : readdirSync4(dir).map((e) => join41(dir, e)).filter((p) => statSync9(p).isDirectory() && existsSync28(join41(p, "SKILL.md")));
     let n = 0;
     for (const src of sources) {
-      cpSync2(src, join34(dest, basename4(src)), { recursive: true });
+      cpSync2(src, join41(dest, basename4(src)), { recursive: true });
       process.stdout.write(`  ${fgHex(PALETTE.success, "\u2713")} ${accent(basename4(src))}
 `);
       n++;
@@ -10039,6 +11040,8 @@ registerVoiceCommand(program);
 registerAgentsCommand(program);
 registerConfigCommand(program);
 registerSetupCommand(program);
+registerLoginCommand(program);
+registerModelsCommand(program);
 registerImportCommand(program);
 registerCompletionCommand(program);
 enableHelpOnError(program);