@tyvm/knowhow 0.0.145 → 0.0.147

package/autodoc/cli-reference.md

@@ -86,7 +86,7 @@ knowhow chat
 ---
 
 ### `knowhow agent`
-**Purpose:** Run a one-shot agent task directly from the CLI (default agent: `Patcher`). Can also resume a previously started task.
+**Purpose:** Start a new one-shot agent task directly from the CLI (default agent: `Patcher`).
 
 **Usage:**
 ```bash
@@ -114,8 +114,6 @@ knowhow agent [options]
   Custom prompt template file with a `{text}` placeholder
 - `--input <text>`  
   Task input (fallback to stdin if not provided)
-- `--resume`  
-  Resume a previously started task using `--task-id` (local FS or remote)
 - `--renderer <name>`  
   Renderer to use: `basic`, `compact`, `fancy`, or a path/package  
   (default: from config or `basic`)
@@ -136,14 +134,45 @@ Use a custom prompt template file:
 knowhow agent --prompt-file .knowhow/prompts/BasicCodeDocumenter.mdx --input "src/index.ts"
 ```
 
-Resume a task:
+Choose provider + renderer:
 ```bash
-knowhow agent --resume --task-id 123 --message-id 456 --input "Continue where you left off"
+knowhow agent --provider openai --model gpt-4.1-mini --renderer fancy --input "Fix the failing tests"
 ```
 
-Choose provider + renderer:
+---
+
+### `knowhow agents resume` / `knowhow agents fork`
+**Purpose:** Continue an existing agent task, or branch its history into a new task without modifying the source.
+
+**Usage:**
 ```bash
-knowhow agent --provider openai --model gpt-4.1-mini --renderer fancy --input "Fix the failing tests"
+knowhow agents resume [taskId] [options]
+knowhow agents fork [sourceTaskId] [options]
+```
+
+Both commands accept a full or partial task ID. Use `-i <number>` instead to select the corresponding row from `knowhow agents list`.
+
+#### Options
+- `-i, --index <number>` — Select a task by row number from `knowhow agents list`
+- `--rollback <count>` — Discard the newest N agent interactions before continuing (default: `0`)
+- `--input <text>` — Message to send after restoring history
+- `--message-id <messageId>` — Knowhow message ID for remote task lookup
+- `--sync-fs` — Enable filesystem-based synchronization
+- `--provider <provider>` — Override the saved AI provider
+- `--model <model>` — Override the saved model
+- `--agent-name <name>` — Override the saved agent
+- `--reasoning-effort <effort>` — Override the saved reasoning effort
+- `--renderer <name>` — Renderer to use (default: from config or `basic`)
+- `--task-id <taskId>` — Explicit destination task ID (`fork` only)
+
+Resume the first listed task after removing its newest assistant interaction:
+```bash
+knowhow agents resume -i 1 --rollback 1
+```
+
+Fork the third listed task into an explicit destination task ID:
+```bash
+knowhow agents fork -i 3 --rollback 1 --task-id my-new-task
 ```
 
 ---

package/bin/knowhow.js

@@ -1,12 +1,14 @@
-#!/usr/bin/env node --no-node-snapshot
+#!/usr/bin/env node
 
 // knowhow CLI entry point.
 //
-// --no-node-snapshot is required for isolated-vm (used by executeScript).
-// It is declared in the shebang above so that Node starts with it directly —
-// no re-exec needed. This means the process stays as a direct child of the
-// terminal (e.g. Ghostty) and inherits its macOS TCC (Screen Recording /
-// Accessibility) permissions without needing to grant them to node itself.
+// --no-node-snapshot is NOT needed here. The script module (knowhow-module-script)
+// forks a child process with --no-node-snapshot only when executeScript is actually
+// called. This means:
+//   - The shebang works on Linux (GNU env) and macOS without any argument-splitting tricks.
+//   - Ghostty (or whichever terminal launched knowhow) remains the TCC subject for
+//     macOS Screen Recording / Accessibility permissions — computer-use features work
+//     without having to grant those permissions to the node binary itself.
 
 const path = require("node:path");
 const cliJs = path.join(__dirname, "../ts_build/src/cli.js");

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@tyvm/knowhow",
-  "version": "0.0.145",
+  "version": "0.0.147",
   "description": "ai cli with plugins and agents",
   "main": "ts_build/src/index.js",
   "bin": {

package/src/agents/base/base.ts

@@ -22,6 +22,7 @@ import { Models } from "../../ai";
 import { MessageProcessor } from "../../services/MessageProcessor";
 import { DEFAULT_CONTEXT_LIMIT } from "../../clients/contextLimits";
 import { Marked } from "../../utils";
+import { TraceAll } from "../../util/Trace";
 
 export { Message, Tool, ToolCall };
 export interface ModelPreference {
@@ -83,6 +84,7 @@ interface ActiveObservation {
   expiry?: NodeJS.Timeout;
 }
 
+@TraceAll()
 export abstract class BaseAgent implements IAgent {
   abstract name: string;
   abstract description: string;
@@ -471,6 +473,28 @@ export abstract class BaseAgent implements IAgent {
     return this.getEnabledTools().map((t) => t.function.name);
   }
 
+  /** Restore the exact request-visible tool list persisted for a prior run. */
+  restoreEnabledTools(names: string[]) {
+    const uniqueNames = [...new Set(names)];
+    const lazyTools = this.tools as ToolsService & {
+      enableTools?: (patterns: string[]) => unknown;
+      restoreEnabledTools?: (names: string[]) => void;
+    };
+
+    // LazyToolsService only exposes explicitly enabled tools. Materialize the
+    // saved concrete names before applying the agent-level exact-set filter.
+    if (lazyTools.restoreEnabledTools) {
+      lazyTools.restoreEnabledTools(uniqueNames);
+    } else {
+      lazyTools.enableTools?.(uniqueNames);
+    }
+    const savedNames = new Set(uniqueNames);
+    this.disabledTools = this.tools
+      .getTools()
+      .map((tool) => tool.function.name)
+      .filter((name) => !savedNames.has(name));
+  }
+
   disableTool(toolName: string) {
     this.disabledTools.push(toolName);
   }

package/src/agents/historyRollback.ts

@@ -0,0 +1,36 @@
+import { Message } from "../clients/types";
+
+/**
+ * Remove the newest agent interactions from the final persisted thread.
+ *
+ * An interaction starts with an assistant message and includes every following
+ * tool result up to (but not including) the next assistant message. Cutting at
+ * the assistant boundary keeps tool_call/tool-result pairs valid and makes
+ * `rollback: 1` useful for recovering from a failed final tool-use turn.
+ */
+export function rollbackAgentInteractions(
+  threads: Message[][],
+  rollback: number = 0
+): Message[][] {
+  if (!Number.isInteger(rollback) || rollback < 0) {
+    throw new Error("rollback must be a non-negative integer");
+  }
+
+  const cloned = threads.map((thread) => thread.map((message) => ({ ...message })));
+  if (rollback === 0 || cloned.length === 0) return cloned;
+
+  const lastThread = cloned[cloned.length - 1];
+  const assistantIndexes = lastThread
+    .map((message, index) => (message.role === "assistant" ? index : -1))
+    .filter((index) => index >= 0);
+
+  if (rollback > assistantIndexes.length) {
+    throw new Error(
+      `Cannot rollback ${rollback} interaction(s); the latest thread only has ${assistantIndexes.length} assistant interaction(s).`
+    );
+  }
+
+  const cutIndex = assistantIndexes[assistantIndexes.length - rollback];
+  cloned[cloned.length - 1] = lastThread.slice(0, cutIndex);
+  return cloned;
+}

package/src/agents/tools/startAgentTask.ts

@@ -8,6 +8,8 @@ export interface StartAgentTaskParams {
   syncFs?: boolean;
   taskId?: string;
   resume?: boolean;
+  forkTaskId?: string;
+  rollback?: number;
   prompt: string;
   /**
    * Push this agent's work to a remote Knowhow task identified by taskId.
@@ -104,6 +106,8 @@ export async function startAgentTask(params: StartAgentTaskParams): Promise<stri
     prompt,
     taskId: providedTaskId,
     resume,
+    forkTaskId,
+    rollback = 0,
     syncFs,
     syncRemote,
     provider,
@@ -118,6 +122,18 @@ export async function startAgentTask(params: StartAgentTaskParams): Promise<stri
   if (!prompt) {
     throw new Error("prompt is required to create a chat task");
   }
+  if (resume && forkTaskId) {
+    throw new Error("resume and forkTaskId are mutually exclusive");
+  }
+  if (resume && !providedTaskId) {
+    throw new Error("taskId is required when resuming");
+  }
+  if (!Number.isInteger(rollback) || rollback < 0) {
+    throw new Error("rollback must be a non-negative integer");
+  }
+  if (rollback > 0 && !resume && !forkTaskId) {
+    throw new Error("rollback requires resume or forkTaskId");
+  }
 
   // Default filesystem synchronization ON unless the caller explicitly opts out
   // (syncFs: false) or is using a messageId-based web sync. This ensures spawned
@@ -134,7 +150,14 @@ export async function startAgentTask(params: StartAgentTaskParams): Promise<stri
     explicitParentTaskId ?? _ctx?.taskId ?? (_ctx?.caller as any)?.currentTaskId;
 
   // Build args array (no shell escaping needed - args are passed directly)
-  const args: string[] = ["agent"];
+  const isHistoryRun = !!resume || !!forkTaskId;
+  const args: string[] = resume
+    ? ["agents", "resume", providedTaskId!]
+    : forkTaskId
+      ? ["agents", "fork", forkTaskId]
+      : ["agent"];
+
+  if (forkTaskId) args.push("--task-id", taskId);
 
   if (messageId) {
     args.push("--message-id", messageId);
@@ -144,11 +167,11 @@ export async function startAgentTask(params: StartAgentTaskParams): Promise<stri
   // When syncRemote is requested, pass it through so the spawned agent pushes
   // its work to the remote task identified by --task-id rather than staying
   // local-only.
-  if (syncRemote) {
+  if (syncRemote && !isHistoryRun) {
     args.push("--sync-remote");
   }
 
-  if (useSyncFs || providedTaskId) {
+  if (!isHistoryRun && (useSyncFs || providedTaskId)) {
     // Pass --task-id whenever we have a known taskId (syncFs or explicit taskId)
     args.push("--task-id", taskId);
   }
@@ -165,20 +188,19 @@ export async function startAgentTask(params: StartAgentTaskParams): Promise<stri
     args.push("--agent-name", agentName);
   }
 
-  if (maxTimeLimit !== undefined) {
+  if (maxTimeLimit !== undefined && !isHistoryRun) {
     args.push("--max-time-limit", String(maxTimeLimit));
   }
 
-  if (maxSpendLimit !== undefined) {
+  if (maxSpendLimit !== undefined && !isHistoryRun) {
     args.push("--max-spend-limit", String(maxSpendLimit));
   }
-  if (parentTaskId) {
+  if (parentTaskId && !isHistoryRun) {
     // Tell the child who spawned it so it can report back to the parent.
     args.push("--parent-task-id", parentTaskId);
   }
-  if (resume) {
-    // --resume is a boolean flag; task ID is already passed via --task-id above
-    args.push("--resume");
+  if (rollback > 0) {
+    args.push("--rollback", String(rollback));
   }
 
   const timeoutMs = maxTimeLimit ? maxTimeLimit * 60 * 1000 : 60 * 60 * 1000;
@@ -320,6 +342,16 @@ export const startAgentTaskDefinition: Tool = {
           description:
             "Resume a previously started task from where it left off. Must be used together with taskId which identifies the task to resume.",
         },
+        forkTaskId: {
+          type: "string",
+          description:
+            "Fork this existing task into a new task. The source remains unchanged; taskId optionally selects the new task ID.",
+        },
+        rollback: {
+          type: "number",
+          description:
+            "Discard this many newest agent interactions before resuming or forking. Must be a non-negative integer.",
+        },
         parentTaskId: {
           type: "string",
           description:

package/src/auth/browserLogin.ts

@@ -1,6 +1,7 @@
 import http from "../utils/http";
 import { exec } from "child_process";
 import { promisify } from "util";
+import crypto from "crypto";
 import * as os from "os";
 import * as fs from "fs";
 import * as path from "path";
@@ -28,6 +29,8 @@ interface RetrieveTokenResponse {
 
 export class BrowserLoginService {
   private baseUrl: string;
+  /** PKCE verifier — generated once per login attempt, never sent in a URL */
+  private verifier: string = crypto.randomBytes(32).toString("hex");
 
   constructor(baseUrl: string = KNOWHOW_API_URL, private orgId?: string) {
     if (!baseUrl) {
@@ -100,9 +103,10 @@ export class BrowserLoginService {
             spinner.stop();
             spinner.start("Authentication successful! Retrieving token");
 
-            // Step 4: Retrieve JWT token
+            // Step 4: Redeem session using PKCE verifier (never sent in URL)
             const tokenResponse = await http.post(
-              `${this.baseUrl}/api/cli-login/session/${sessionData.sessionId}/token`
+              `${this.baseUrl}/api/cli-login/session/${sessionData.sessionId}/redeem`,
+              { verifier: this.verifier }
             );
 
             const tokenData = tokenResponse.data as RetrieveTokenResponse;
@@ -170,9 +174,11 @@ export class BrowserLoginService {
    */
   private async createSession(): Promise<CreateSessionResponse> {
     try {
+      // Compute the PKCE challenge (sha256 of verifier) to store server-side
+      const challenge = crypto.createHash("sha256").update(this.verifier, "utf8").digest("hex");
       const response = await http.post<CreateSessionResponse>(
         `${this.baseUrl}/api/cli-login/session`,
-        {},
+        { challenge },
         { headers: { "User-Agent": getCliUserAgent() } }
       );
       return response.data;

package/src/auth/keyAuth.ts

@@ -0,0 +1,115 @@
+import fs from "fs";
+import os from "os";
+import path from "path";
+import http from "../utils/http";
+import { getCliUserAgent } from "./browserLogin";
+import { keyPairExists, loadKeyPair, signMessage } from "./keyManager";
+
+const JWT_FILE_PATH = path.join(process.cwd(), ".knowhow", ".jwt");
+const DEFAULT_API_URL = process.env.KNOWHOW_API_URL || "https://api.knowhow.tyvm.ai";
+
+/**
+ * This is intentionally based only on the selected identity. Registration is
+ * server-side and scoped to its environment/user/org; a local `.registered`
+ * marker cannot safely represent that state. An unknown or revoked key is
+ * cheaply rejected by the selected API and login then falls back to PKCE.
+ */
+export function hasKeyPair(privateKeyPath?: string): boolean {
+  return keyPairExists(privateKeyPath);
+}
+
+/** Exchange a registered Ed25519 identity for a new short-lived JWT. */
+export async function exchangePublicKeyJwt(
+  orgId: string,
+  apiUrl: string = DEFAULT_API_URL,
+  privateKeyPath?: string
+): Promise<string> {
+  if (!keyPairExists(privateKeyPath)) {
+    throw new Error("CLI identity is unavailable");
+  }
+
+  const keyPair = loadKeyPair(privateKeyPath);
+  const headers = { "User-Agent": getCliUserAgent() };
+  const challengeResponse = await http.post<{
+    challengeId: string;
+    message: string;
+    expiresAt: string;
+  }>(
+    `${apiUrl}/api/public-keys/challenge`,
+    { publicKey: keyPair.publicKeyBase64, orgId },
+    { headers }
+  );
+  const { challengeId, message } = challengeResponse.data;
+  if (
+    typeof challengeId !== "string" ||
+    challengeId.length === 0 ||
+    challengeId.length > 128 ||
+    !/^[A-Za-z0-9_-]+$/.test(challengeId) ||
+    typeof message !== "string" ||
+    message.length === 0
+  ) {
+    throw new Error("Public-key challenge response is invalid");
+  }
+
+  const response = await http.post<{ jwt: string }>(
+    `${apiUrl}/api/public-keys/authenticate`,
+    { challengeId, signature: signMessage(message, privateKeyPath) },
+    { headers }
+  );
+  if (!response.data.jwt) {
+    throw new Error("Public-key authentication returned no JWT");
+  }
+  return response.data.jwt;
+}
+
+export async function authenticateWithKey(
+  orgId: string,
+  apiUrl: string = DEFAULT_API_URL,
+  privateKeyPath?: string
+): Promise<boolean> {
+  if (!keyPairExists(privateKeyPath)) return false;
+
+  try {
+    storeJwt(await exchangePublicKeyJwt(orgId, apiUrl, privateKeyPath));
+    return true;
+  } catch (error: unknown) {
+    // The identity is not registered for this environment/org (or was revoked).
+    if (http.isHttpError(error) && (error.status === 401 || error.status === 404)) {
+      return false;
+    }
+    throw error;
+  }
+}
+
+/** Register an Ed25519 CLI-auth key using the JWT obtained by browser PKCE. */
+export async function registerPublicKey(
+  jwt: string,
+  publicKeyBase64: string,
+  apiUrl: string = DEFAULT_API_URL
+): Promise<void> {
+  const rawPublicKey = Buffer.from(publicKeyBase64, "base64");
+  if (rawPublicKey.length !== 32 || rawPublicKey.toString("base64") !== publicKeyBase64) {
+    throw new Error("CLI authentication requires a 32-byte Ed25519 public key");
+  }
+
+  await http.post(
+    `${apiUrl}/api/public-keys/register`,
+    {
+      publicKey: publicKeyBase64,
+      label: os.hostname(),
+    },
+    {
+      headers: {
+        Authorization: `Bearer ${jwt}`,
+        "User-Agent": getCliUserAgent(),
+      },
+    }
+  );
+}
+
+export function storeJwt(jwt: string): void {
+  const directory = path.dirname(JWT_FILE_PATH);
+  fs.mkdirSync(directory, { recursive: true });
+  fs.writeFileSync(JWT_FILE_PATH, jwt, { mode: 0o600 });
+  fs.chmodSync(JWT_FILE_PATH, 0o600);
+}

package/src/auth/keyManager.ts

@@ -0,0 +1,166 @@
+import crypto from "crypto";
+import fs from "fs";
+import os from "os";
+import path from "path";
+
+const ED25519_KEY_TYPE = "ssh-ed25519";
+const ED25519_RAW_KEY_LENGTH = 32;
+const ED25519_SPKI_PREFIX = Buffer.from("302a300506032b6570032100", "hex");
+
+export interface KeyPair {
+  privateKeyPath: string;
+  publicKeyPath: string;
+  /** Raw 32-byte Ed25519 key, base64 encoded for the authentication API. */
+  publicKeyBase64: string;
+  /** OpenSSH SHA-256 fingerprint (hashes the SSH wire-format public key). */
+  fingerprint: string;
+}
+
+export function getKeyDir(): string {
+  return path.join(os.homedir(), ".knowhow", "keys");
+}
+
+export function getDefaultPrivateKeyPath(): string {
+  return path.join(getKeyDir(), "id_ed25519");
+}
+
+export function getDefaultPublicKeyPath(): string {
+  return `${getDefaultPrivateKeyPath()}.pub`;
+}
+
+export function keyPairExists(privateKeyPath?: string): boolean {
+  const privatePath = privateKeyPath ?? getDefaultPrivateKeyPath();
+  return fs.existsSync(privatePath) && fs.existsSync(`${privatePath}.pub`);
+}
+
+/** Generate a CLI-only Ed25519 key and an OpenSSH-compatible public-key file. */
+export function generateKeyPair(privateKeyPath?: string): KeyPair {
+  const privatePath = privateKeyPath ?? getDefaultPrivateKeyPath();
+  const publicPath = `${privatePath}.pub`;
+
+  fs.mkdirSync(path.dirname(privatePath), { recursive: true, mode: 0o700 });
+  const { privateKey, publicKey } = crypto.generateKeyPairSync("ed25519", {
+    privateKeyEncoding: { type: "pkcs8", format: "pem" },
+    publicKeyEncoding: { type: "spki", format: "der" },
+  });
+  const rawPublicKey = extractRawPublicKey(publicKey);
+
+  // Refuse to overwrite either half of an identity. Partial identities should be
+  // repaired explicitly rather than silently replacing a user's key.
+  if (fs.existsSync(privatePath) || fs.existsSync(publicPath)) {
+    throw new Error(`Cannot generate identity: a key file already exists at ${privatePath} or ${publicPath}`);
+  }
+
+  fs.writeFileSync(privatePath, privateKey, { mode: 0o600, flag: "wx" });
+  try {
+    fs.writeFileSync(publicPath, formatOpenSshPublicKey(rawPublicKey), {
+      mode: 0o644,
+      flag: "wx",
+    });
+  } catch (error) {
+    fs.rmSync(privatePath, { force: true });
+    throw error;
+  }
+
+  return keyPairMetadata(privatePath, rawPublicKey);
+}
+
+/** Load and validate an Ed25519 identity. Legacy raw-base64 .pub files remain supported. */
+export function loadKeyPair(privateKeyPath?: string): KeyPair {
+  const privatePath = privateKeyPath ?? getDefaultPrivateKeyPath();
+  const publicPath = `${privatePath}.pub`;
+  if (!fs.existsSync(privatePath)) throw new Error(`Private key not found at: ${privatePath}`);
+  if (!fs.existsSync(publicPath)) throw new Error(`Public key not found at: ${publicPath}`);
+
+  const privateKey = readEd25519PrivateKey(privatePath);
+  const publicKey = parsePublicKey(fs.readFileSync(publicPath, "utf8"));
+  const derivedPublicKey = extractRawPublicKey(
+    crypto.createPublicKey(privateKey).export({ type: "spki", format: "der" })
+  );
+  if (!crypto.timingSafeEqual(publicKey, derivedPublicKey)) {
+    throw new Error(`Public key does not match private key: ${publicPath}`);
+  }
+
+  return keyPairMetadata(privatePath, publicKey);
+}
+
+export function getOrCreatePublicKey(privateKeyPath?: string): KeyPair {
+  return keyPairExists(privateKeyPath)
+    ? loadKeyPair(privateKeyPath)
+    : generateKeyPair(privateKeyPath);
+}
+
+export function signMessage(message: string, privateKeyPath?: string): string {
+  const privatePath = privateKeyPath ?? getDefaultPrivateKeyPath();
+  if (!fs.existsSync(privatePath)) throw new Error(`Private key not found at: ${privatePath}`);
+  return crypto.sign(null, Buffer.from(message, "utf8"), readEd25519PrivateKey(privatePath)).toString("base64");
+}
+
+function readEd25519PrivateKey(privatePath: string): crypto.KeyObject {
+  let key: crypto.KeyObject;
+  try {
+    key = crypto.createPrivateKey(fs.readFileSync(privatePath));
+  } catch {
+    throw new Error(`Identity at ${privatePath} is not a supported PEM Ed25519 private key`);
+  }
+  if (key.asymmetricKeyType !== "ed25519") {
+    throw new Error(`Identity at ${privatePath} must be an Ed25519 private key`);
+  }
+  return key;
+}
+
+function extractRawPublicKey(spkiDer: Buffer): Buffer {
+  if (
+    spkiDer.length !== ED25519_SPKI_PREFIX.length + ED25519_RAW_KEY_LENGTH ||
+    !spkiDer.subarray(0, ED25519_SPKI_PREFIX.length).equals(ED25519_SPKI_PREFIX)
+  ) {
+    throw new Error("Invalid Ed25519 public key");
+  }
+  return spkiDer.subarray(ED25519_SPKI_PREFIX.length);
+}
+
+function sshPublicKeyBlob(rawPublicKey: Buffer): Buffer {
+  const type = Buffer.from(ED25519_KEY_TYPE, "ascii");
+  const typeLength = Buffer.alloc(4);
+  const keyLength = Buffer.alloc(4);
+  typeLength.writeUInt32BE(type.length);
+  keyLength.writeUInt32BE(rawPublicKey.length);
+  return Buffer.concat([typeLength, type, keyLength, rawPublicKey]);
+}
+
+function formatOpenSshPublicKey(rawPublicKey: Buffer): string {
+  return `${ED25519_KEY_TYPE} ${sshPublicKeyBlob(rawPublicKey).toString("base64")} knowhow-cli\n`;
+}
+
+function parsePublicKey(value: string): Buffer {
+  const trimmed = value.trim();
+  if (trimmed.startsWith(`${ED25519_KEY_TYPE} `)) {
+    const parts = trimmed.split(/\s+/);
+    const blob = Buffer.from(parts[1] ?? "", "base64");
+    const expected = sshPublicKeyBlob(blob.subarray(blob.length - ED25519_RAW_KEY_LENGTH));
+    if (blob.length !== expected.length || !blob.equals(expected)) {
+      throw new Error("Invalid OpenSSH Ed25519 public key");
+    }
+    return blob.subarray(blob.length - ED25519_RAW_KEY_LENGTH);
+  }
+
+  // Compatibility with key files written by early CLI builds.
+  if (!/^[A-Za-z0-9+/]+={0,2}$/.test(trimmed)) {
+    throw new Error("Public key must be an OpenSSH Ed25519 key");
+  }
+  const raw = Buffer.from(trimmed, "base64");
+  if (raw.length !== ED25519_RAW_KEY_LENGTH || raw.toString("base64") !== trimmed) {
+    throw new Error("Ed25519 public key must contain exactly 32 bytes");
+  }
+  return raw;
+}
+
+function keyPairMetadata(privatePath: string, rawPublicKey: Buffer): KeyPair {
+  const hash = crypto.createHash("sha256").update(sshPublicKeyBlob(rawPublicKey)).digest("base64").replace(/=+$/, "");
+  return {
+    privateKeyPath: privatePath,
+    publicKeyPath: `${privatePath}.pub`,
+    publicKeyBase64: rawPublicKey.toString("base64"),
+    fingerprint: `SHA256:${hash}`,
+  };
+}

package/src/chat/CliChatService.ts

@@ -43,6 +43,22 @@ export class CliChatService implements ChatService {
       chatHistory: this.chatHistory,
       plugins,
     };
+    this.registerCommand({
+      name: "reload",
+      description: "Reload configuration, tools, MCP connections, and modules",
+      handler: async () => {
+        try {
+          console.log("Reloading configuration...");
+          const result = await services().RuntimeReload.reload();
+          console.log(
+            `✓ Reloaded ${result.tools} tools, ${result.mcps} MCP servers, and ${result.modules} modules`
+          );
+        } catch (error) {
+          const message = error instanceof Error ? error.message : String(error);
+          console.error(`⚠ Reload failed: ${message}`);
+        }
+      },
+    });
     this.loadInputHistory();
 
     // Set up callback to add entries to inputHistory immediately when user presses Enter