akemon 0.3.6 → 0.3.7

package/dist/cli.js

@@ -1,8 +1,8 @@
 #!/usr/bin/env node
-import { Command } from "commander";
+import { Command, Option } from "commander";
 import { serve, onOrderNotify } from "./server.js";
 import { addAgent } from "./add.js";
-import { getOrCreateRelayCredentials } from "./config.js";
+import { getLocalManagerName, getOrCreateLocalOwnerSecret, getOrCreateRelayCredentials, setLocalManagerName, } from "./config.js";
 import { connectRelay } from "./relay-client.js";
 import { listAgents } from "./list.js";
 import { connect } from "./connect.js";
@@ -10,14 +10,22 @@ import { PrivacyFilterUnavailableError, sanitizeText, } from "./privacy-filter.j
 import { SoftwareAgentStreamCliRenderer } from "./software-agent-stream-cli.js";
 import { appendWorkMemoryNote, buildWorkMemoryContext, } from "./work-memory.js";
 import { renderSoftwareAgentRunResult } from "./software-agent-result-cli.js";
+import { DEFAULT_RELAY_HTTP, resolveServeRelayMode, } from "./relay-mode.js";
+import { LocalInstanceLookupError, listRunningLocalInstances, resolveDefaultLocalInstance, resolveLocalInstanceByName, } from "./local-registry.js";
+import { appendLocalPeerContact, createLocalAkemonMessage, } from "./local-interconnect.js";
+import { discoverPublicAkemonProfiles, } from "./social-discovery.js";
+import { getMemoryRecorder, listMemoryRecorders, } from "./memory-recorder.js";
+import { listPermissionAuditRecords, } from "./permission-audit.js";
+import { buildPeripheralExploreBriefing, loadPeripheralRecords, upsertPeripheralRecord, } from "./peripheral-registry.js";
+import { openUrl } from "./runtime-platform.js";
+import { createOwnerChatMessage, SecretariatClient, taskIdFromOwnerChatMessage, taskIsTerminal, } from "./secretariat/client.js";
 import { readFileSync } from "fs";
 import { fileURLToPath } from "url";
 import { dirname, join } from "path";
 const __dirname = dirname(fileURLToPath(import.meta.url));
 const pkg = JSON.parse(readFileSync(join(__dirname, "..", "package.json"), "utf-8"));
-const RELAY_WS = "wss://relay.akemon.dev";
-const RELAY_HTTP = "https://relay.akemon.dev";
 const program = new Command();
+const ALL_MODULES = ["biostate", "memory", "task", "social", "longterm", "reflection", "script"];
 function parsePortOption(port) {
     const value = typeof port === "number" ? port : parseInt(String(port || "3000"));
     return Number.isInteger(value) && value > 0 ? value : 3000;
@@ -49,6 +57,57 @@ function parseSoftwareAgentEnvPolicy(value) {
     console.error("--software-agent-env must be one of: inherit, allowlist");
     process.exit(1);
 }
+function parseAkemonMemoryScope(value) {
+    const normalized = (value || "task").trim().toLowerCase();
+    if (normalized === "none" || normalized === "public" || normalized === "task" || normalized === "owner") {
+        return normalized;
+    }
+    console.error("--memory-scope must be one of: none, public, task, owner");
+    process.exit(1);
+}
+function parseMemoryRecorderSource(value) {
+    if (value === undefined)
+        return undefined;
+    const normalized = value.trim().toLowerCase();
+    if (normalized === "builtin" || normalized === "module" || normalized === "skill") {
+        return normalized;
+    }
+    console.error("--source must be one of: builtin, module, skill");
+    process.exit(1);
+}
+function parseMemoryRecorderScope(value) {
+    if (value === undefined)
+        return undefined;
+    const normalized = value.trim().toLowerCase();
+    if (normalized === "self"
+        || normalized === "work"
+        || normalized === "contacts"
+        || normalized === "inbox"
+        || normalized === "events"
+        || normalized === "conversation"
+        || normalized === "product"
+        || normalized === "software-agent"
+        || normalized === "runtime"
+        || normalized === "audit"
+        || normalized === "config") {
+        return normalized;
+    }
+    console.error("--scope must be one of: self, work, contacts, inbox, events, conversation, product, software-agent, runtime, audit, config");
+    process.exit(1);
+}
+function parsePermissionAuditActionKind(value) {
+    if (value === undefined)
+        return undefined;
+    const normalized = value.trim().toLowerCase();
+    if (normalized === "software-agent-task"
+        || normalized === "akemon-message"
+        || normalized === "relay-publication"
+        || normalized === "memory-write") {
+        return normalized;
+    }
+    console.error("--kind must be one of: software-agent-task, akemon-message, relay-publication, memory-write");
+    process.exit(1);
+}
 function parseCommaSeparatedCliOption(value) {
     if (!value)
         return undefined;
@@ -108,12 +167,248 @@ function printSoftwareAgentSessionList(sessions) {
             console.log(`  work memory: ${session.workMemoryDir}`);
     }
 }
+function printProfileDiscoveryResults(results, query) {
+    if (!results.length) {
+        console.log(`No public Akemon profiles matched: ${query}`);
+        return;
+    }
+    for (const [index, result] of results.entries()) {
+        const profile = result.profile;
+        const tags = [...profile.tags, ...profile.interests].slice(0, 8).join(", ");
+        const details = [
+            profile.status && profile.status !== "unknown" ? profile.status : "",
+            profile.engine ? `engine=${profile.engine}` : "",
+            tags ? `tags=${tags}` : "",
+            `score=${result.score}`,
+        ].filter(Boolean).join("  ");
+        console.log(`${index + 1}. ${profile.name}${details ? `  ${details}` : ""}`);
+        if (profile.description)
+            console.log(`   ${truncateOneLine(profile.description, 120)}`);
+        if (result.reasons.length)
+            console.log(`   reasons: ${result.reasons.join("; ")}`);
+        if (profile.profileUrl)
+            console.log(`   profile: ${profile.profileUrl}`);
+    }
+}
+function printMemoryRecorderList(recorders) {
+    if (!recorders.length) {
+        console.log("No memory recorders found.");
+        return;
+    }
+    const rows = recorders.map((recorder) => ({
+        id: recorder.id,
+        source: recorder.source,
+        owner: recorder.owner,
+        trigger: recorder.trigger.event,
+        destinations: summarizeDestinations(recorder),
+        approval: recorder.privacy.approvalRequired ? "yes" : "no",
+    }));
+    const idW = Math.max(2, ...rows.map((row) => row.id.length)) + 2;
+    const sourceW = Math.max(6, ...rows.map((row) => row.source.length)) + 2;
+    const ownerW = Math.max(5, ...rows.map((row) => row.owner.length)) + 2;
+    const triggerW = Math.max(7, ...rows.map((row) => row.trigger.length)) + 2;
+    const approvalW = 10;
+    console.log(padCli("ID", idW)
+        + padCli("SOURCE", sourceW)
+        + padCli("OWNER", ownerW)
+        + padCli("TRIGGER", triggerW)
+        + padCli("APPROVAL", approvalW)
+        + "DESTINATIONS");
+    for (const row of rows) {
+        console.log(padCli(row.id, idW)
+            + padCli(row.source, sourceW)
+            + padCli(row.owner, ownerW)
+            + padCli(row.trigger, triggerW)
+            + padCli(row.approval, approvalW)
+            + row.destinations);
+    }
+}
+function printMemoryRecorderDetail(recorder) {
+    console.log(`${recorder.id} - ${recorder.title}`);
+    console.log(`Source: ${recorder.source}`);
+    console.log(`Owner: ${recorder.owner}`);
+    console.log(`Enabled: ${recorder.enabled ? "yes" : "no"}`);
+    console.log(`Trigger: ${recorder.trigger.event}`);
+    console.log(`Trigger detail: ${recorder.trigger.description}`);
+    console.log(`Approval required: ${recorder.privacy.approvalRequired ? "yes" : "no"}`);
+    console.log(`Redacts secrets: ${recorder.privacy.redactsSecrets ? "yes" : "no"}`);
+    console.log(`Includes owner memory/content: ${recorder.privacy.includesOwnerMemory ? "yes" : "no"}`);
+    console.log("Destinations:");
+    for (const dest of recorder.destinations) {
+        console.log(`- ${dest.scope} ${dest.path}`);
+        console.log(`  format=${dest.format} mode=${dest.writeMode}`);
+        console.log(`  ${dest.description}`);
+    }
+    if (recorder.sourceFiles.length) {
+        console.log("Source files:");
+        for (const file of recorder.sourceFiles)
+            console.log(`- ${file}`);
+    }
+    if (recorder.notes)
+        console.log(`Notes: ${recorder.notes}`);
+}
+function printPermissionAuditRecords(records) {
+    if (!records.length) {
+        console.log("No permission audit records found.");
+        return;
+    }
+    for (const record of records) {
+        const decision = `${record.decision.result}/${record.decision.mode}`;
+        const requestedBy = `${record.requestedBy.kind}:${record.requestedBy.id}`;
+        const performedBy = `${record.performedBy.kind}:${record.performedBy.id}`;
+        const scope = [
+            record.riskLevel ? `risk=${record.riskLevel}` : "",
+            record.memoryScope ? `memory=${record.memoryScope}` : "",
+            record.transport ? `transport=${record.transport}` : "",
+        ].filter(Boolean).join(" ");
+        console.log(`${record.ts}  ${record.actionKind}  ${record.action}  ${decision}`);
+        console.log(`  requested: ${requestedBy}  performed: ${performedBy}`);
+        if (scope)
+            console.log(`  ${scope}`);
+        if (record.references?.taskId)
+            console.log(`  task: ${record.references.taskId}`);
+        if (record.references?.messageId)
+            console.log(`  message: ${record.references.messageId}`);
+        if (record.references?.noteId)
+            console.log(`  note: ${record.references.noteId}`);
+        if (record.workdir)
+            console.log(`  workdir: ${truncateOneLine(record.workdir, 120)}`);
+        if (record.decision.reason)
+            console.log(`  ${truncateOneLine(record.decision.reason, 140)}`);
+    }
+}
+function printPeripheralRecords(records) {
+    if (!records.length) {
+        console.log("No peripheral records found.");
+        return;
+    }
+    const idWidth = Math.min(Math.max(...records.map((record) => record.id.length), 2), 32);
+    const typeWidth = Math.min(Math.max(...records.map((record) => record.type.length), 4), 16);
+    console.log(`${padCli("ID", idWidth)}  ${padCli("TYPE", typeWidth)}  RISK    STATUS       CAPABILITIES`);
+    for (const record of records) {
+        console.log([
+            padCli(truncateOneLine(record.id, idWidth), idWidth),
+            padCli(record.type, typeWidth),
+            padCli(record.riskLevel, 7),
+            padCli(record.status, 12),
+            truncateOneLine(record.capabilities.join(", ") || "-", 80),
+        ].join("  "));
+    }
+}
+function parsePeripheralRecordType(value) {
+    const normalized = (value || "custom").trim().toLowerCase();
+    if (normalized === "engine"
+        || normalized === "relay"
+        || normalized === "software-agent"
+        || normalized === "mcp"
+        || normalized === "service"
+        || normalized === "hardware"
+        || normalized === "custom") {
+        return normalized;
+    }
+    console.error("--type must be one of: engine, relay, software-agent, mcp, service, hardware, custom");
+    process.exit(1);
+}
+function parsePeripheralRiskLevel(value) {
+    const normalized = (value || "medium").trim().toLowerCase();
+    if (normalized === "low" || normalized === "medium" || normalized === "high")
+        return normalized;
+    console.error("--risk must be one of: low, medium, high");
+    process.exit(1);
+}
+function parsePeripheralExploreMode(value) {
+    const normalized = (value || "none").trim().toLowerCase();
+    if (normalized === "none" || normalized === "plain-text")
+        return normalized;
+    console.error("--explore must be one of: none, plain-text");
+    process.exit(1);
+}
+async function resolvePermissionAuditAgentName(value) {
+    const explicit = value?.trim();
+    if (explicit)
+        return explicit;
+    const manager = await getLocalManagerName();
+    if (manager)
+        return manager;
+    console.error("No Akemon name specified for audit. Use --name <name> or set a local manager.");
+    process.exit(1);
+}
+async function resolvePeripheralRegistryAgentName(value) {
+    const explicit = value?.trim();
+    if (explicit)
+        return explicit;
+    const manager = await getLocalManagerName();
+    if (manager)
+        return manager;
+    console.error("No Akemon name specified for peripherals. Use --name <name> or set a local manager.");
+    process.exit(1);
+}
+async function runPermissionAuditListCli(opts) {
+    const decision = opts.decision === undefined ? undefined : String(opts.decision).trim().toLowerCase();
+    if (decision !== undefined && decision !== "allowed" && decision !== "denied") {
+        console.error("--decision must be one of: allowed, denied");
+        process.exit(1);
+    }
+    const agentName = await resolvePermissionAuditAgentName(opts.name);
+    const records = await listPermissionAuditRecords(agentName, {
+        limit: clampPositiveInt(opts.limit, 20, 500),
+        actionKind: parsePermissionAuditActionKind(opts.kind),
+        decision: decision,
+    });
+    if (opts.json) {
+        console.log(JSON.stringify(records, null, 2));
+        return;
+    }
+    printPermissionAuditRecords(records);
+}
+function summarizeDestinations(recorder) {
+    return recorder.destinations
+        .map((dest) => `${dest.scope}:${dest.path}`)
+        .join("; ");
+}
+function padCli(value, width) {
+    return value.padEnd(width);
+}
+async function fetchPublicRelayAgentsForDiscovery(relayUrl) {
+    const baseUrl = relayUrl.replace(/\/+$/, "");
+    const url = `${baseUrl}/v1/agents?online=true&public=true`;
+    let res;
+    try {
+        res = await fetch(url);
+    }
+    catch (error) {
+        throw new Error(`Failed to connect to relay: ${error instanceof Error ? error.message : String(error)}`);
+    }
+    if (!res.ok)
+        throw new Error(`Failed to fetch public agents: HTTP ${res.status}`);
+    const data = await res.json();
+    if (!Array.isArray(data))
+        throw new Error("Relay returned an invalid agent list");
+    return data;
+}
 function truncateOneLine(value, max) {
     const oneLine = value.replace(/\s+/g, " ").trim();
     if (oneLine.length <= max)
         return oneLine;
     return `${oneLine.slice(0, Math.max(0, max - 3))}...`;
 }
+function formatLocalInstanceRecord(record) {
+    return `${record.name}  port=${record.port}  pid=${record.pid}  mode=${record.mode}  workdir=${record.workdir}`;
+}
+function printLocalInstanceCandidates(candidates) {
+    for (const candidate of candidates) {
+        console.error(`  ${formatLocalInstanceRecord(candidate)}`);
+    }
+}
+function printLocalInstanceList(instances) {
+    if (instances.length === 0) {
+        console.log("No running local Akemon instances.");
+        return;
+    }
+    for (const instance of instances) {
+        console.log(formatLocalInstanceRecord(instance));
+    }
+}
 async function callLocalOwnerEndpoint(path, opts, init = {}) {
     const res = await fetchLocalOwnerEndpoint(path, opts, init);
     const text = await res.text();
@@ -131,10 +426,10 @@ async function callLocalOwnerEndpoint(path, opts, init = {}) {
     return data;
 }
 async function fetchLocalOwnerEndpoint(path, opts, init = {}) {
-    const credentials = await getOrCreateRelayCredentials();
-    const port = parsePortOption(opts.port);
+    const secretKey = await getOrCreateLocalOwnerSecret();
+    const port = await resolveLocalOwnerPort(opts);
     const headers = {
-        Authorization: `Bearer ${credentials.secretKey}`,
+        Authorization: `Bearer ${secretKey}`,
     };
     if (init.body !== undefined)
         headers["Content-Type"] = "application/json";
@@ -155,13 +450,51 @@ async function fetchLocalOwnerEndpoint(path, opts, init = {}) {
             process.exit(1);
         }
         if (error instanceof TypeError && error.message === "fetch failed") {
-            console.error(`Cannot connect to local akemon serve on port ${port}. Start it with: akemon serve --port ${port}`);
+            console.error(`Cannot connect to local Akemon on port ${port}. Start it with: akemon run --port ${port}`);
             process.exit(1);
         }
         throw error;
     }
     return res;
 }
+async function resolveLocalOwnerPort(opts) {
+    if (opts.port)
+        return parsePortOption(opts.port);
+    if (opts.name) {
+        try {
+            return (await resolveLocalInstanceByName(opts.name)).port;
+        }
+        catch (error) {
+            if (error instanceof LocalInstanceLookupError) {
+                console.error(error.message);
+                for (const candidate of error.candidates) {
+                    console.error(`  ${candidate.name}: port=${candidate.port} pid=${candidate.pid} workdir=${candidate.workdir}`);
+                }
+                process.exit(1);
+            }
+            throw error;
+        }
+    }
+    try {
+        return (await resolveDefaultLocalInstance()).port;
+    }
+    catch (error) {
+        if (error instanceof LocalInstanceLookupError) {
+            if (error.code === "ambiguous") {
+                console.error(error.message);
+                printLocalInstanceCandidates(error.candidates);
+                process.exit(1);
+            }
+            return parsePortOption(undefined);
+        }
+        throw error;
+    }
+    return parsePortOption(undefined);
+}
+async function resolveLocalOwnerEndpointOptions(opts) {
+    const port = await resolveLocalOwnerPort(opts);
+    return { ...opts, port: String(port) };
+}
 async function streamLocalOwnerEndpoint(path, opts, body) {
     const res = await fetchLocalOwnerEndpoint(path, opts, {
         method: "POST",
@@ -259,55 +592,370 @@ async function runSoftwareAgentCli(goalParts, opts, forcedSessionId) {
     if (failed)
         process.exit(1);
 }
-program
-    .name("akemon")
-    .description("Local AI companion runtime with memory, modules, relay sync, and software-agent control")
-    .version(pkg.version);
-program
-    .command("serve")
-    .description("Publish your agent to the akemon relay")
-    .option("-p, --port <port>", "Local port for MCP loopback", "3000")
-    .option("-w, --workdir <path>", "Working directory for the engine (default: cwd)")
-    .option("-n, --name <name>", "Agent name", "my-agent")
-    .option("-m, --model <model>", "Model to use (e.g. claude-sonnet-4-6, gpt-4o)")
-    .option("--engine <engine>", "Engine: claude, codex, opencode, gemini, raw, human, or any CLI", "claude")
-    .option("--desc <description>", "Agent description (for discovery)")
-    .option("--tags <tags>", "Comma-separated tags (e.g. vue,frontend,review)")
-    .option("--public", "Allow anyone to call this agent without a key")
-    .option("--max-tasks <n>", "Maximum tasks per day (PP)")
-    .option("--approve", "Review every task before execution")
-    .option("--mock", "Use mock responses (for demo/testing)")
-    .option("--allow-all", "Skip all permission prompts (for self-use)")
-    .option("--price <n>", "Price in credits per call (default: 1)", "1")
-    .option("--mcp-server <command>", "Wrap a community MCP server (stdio) and expose its tools via relay")
-    .option("--avatar <url>", "Custom avatar URL (default: auto-generated from name)")
-    .option("--notify <url>", "ntfy.sh topic URL for push notifications (e.g. https://ntfy.sh/my-agent)")
-    .option("--interval <minutes>", "Consciousness cycle interval in minutes (default: 1440 = 24h)")
-    .option("--with <modules>", "Enable specific modules (comma-separated: biostate,memory)")
-    .option("--without <modules>", "Disable specific modules (comma-separated: biostate,memory)")
-    .option("--script <name>", "Script to load for ScriptModule (default: daily-life)", "daily-life")
-    .option("--terminal", "Enable remote terminal access (PTY)")
-    .option("--software-agent-env <policy>", "Software-agent child environment policy: inherit or allowlist", process.env.AKEMON_SOFTWARE_AGENT_ENV_POLICY || "inherit")
-    .option("--software-agent-env-allow <vars>", "Comma-separated extra env vars for software-agent allowlist")
-    .option("--relay <url>", "Relay WebSocket URL", RELAY_WS)
-    .action(async (opts) => {
-    const port = parseInt(opts.port);
-    const engine = opts.engine || "claude";
-    // Connect to relay
-    const credentials = await getOrCreateRelayCredentials();
-    // Derive relay HTTP URL from WS URL
-    const relayWs = opts.relay;
-    const relayHttp = relayWs.replace(/^wss:/, "https:").replace(/^ws:/, "http:");
-    // Parse module selection
-    const ALL_MODULES = ["biostate", "memory", "task", "social", "longterm", "reflection", "script"];
-    let enabledModules;
+async function runWorkbenchStartCli(tool, args, opts) {
+    const body = { tool };
+    if (opts.command)
+        body.command = opts.command;
+    if (args.length > 0)
+        body.args = args;
+    if (opts.workdir)
+        body.workdir = opts.workdir;
+    if (opts.allowOutsideWorkdir)
+        body.allowOutsideWorkdir = true;
+    if (opts.label)
+        body.label = opts.label;
+    if (opts.input)
+        body.initialInput = opts.input;
+    const cols = parsePositiveIntCliOption(opts.cols, "--cols");
+    const rows = parsePositiveIntCliOption(opts.rows, "--rows");
+    if (cols !== undefined)
+        body.cols = cols;
+    if (rows !== undefined)
+        body.rows = rows;
+    const data = await callLocalOwnerEndpoint("/self/workbench/sessions", opts, {
+        method: "POST",
+        body: JSON.stringify(body),
+    });
+    if (opts.json) {
+        console.log(JSON.stringify(data.session, null, 2));
+        return;
+    }
+    printWorkbenchSession(data.session);
+    console.error(`[workbench] next: akemon workbench-tail ${data.session.sessionId} | akemon workbench-input ${data.session.sessionId} "..." | akemon workbench-stop ${data.session.sessionId}`);
+}
+function printWorkbenchSession(session) {
+    const status = session.status || "unknown";
+    const command = session.commandLineDisplay || "";
+    const started = session.startedAt || "-";
+    const workdir = session.workdir || "-";
+    console.log(`${session.sessionId}  ${status}  ${session.tool || "custom"}  ${started}`);
+    if (command)
+        console.log(`  command: ${command}`);
+    console.log(`  workdir: ${workdir}`);
+    if (session.logPath)
+        console.log(`  log: ${session.logPath}`);
+    if (typeof session.ownerDirectInputCount === "number") {
+        console.log(`  owner-direct inputs: ${session.ownerDirectInputCount}`);
+    }
+}
+async function listWorkbenchSessionsCli(opts) {
+    const data = await callLocalOwnerEndpoint("/self/workbench/sessions", opts, { method: "GET" });
+    const sessions = Array.isArray(data.sessions) ? data.sessions : [];
+    if (opts.json) {
+        console.log(JSON.stringify(sessions, null, 2));
+        return;
+    }
+    if (!sessions.length) {
+        console.log("No Workbench sessions found.");
+        return;
+    }
+    for (const session of sessions)
+        printWorkbenchSession(session);
+}
+async function showWorkbenchTailCli(sessionId, opts) {
+    const data = await callLocalOwnerEndpoint(`/self/workbench/sessions/${encodeURIComponent(sessionId)}/tail`, opts, { method: "GET" });
+    if (opts.json) {
+        console.log(JSON.stringify(data, null, 2));
+        return;
+    }
+    process.stdout.write(String(data.tail || ""));
+}
+async function sendWorkbenchInputCli(sessionId, inputParts, opts) {
+    const inputText = inputParts.join(" ");
+    if (!inputText) {
+        console.error("Missing input text");
+        process.exit(1);
+    }
+    const input = opts.enter === false || inputText.endsWith("\n") ? inputText : `${inputText}\n`;
+    const data = await callLocalOwnerEndpoint(`/self/workbench/sessions/${encodeURIComponent(sessionId)}/input`, opts, {
+        method: "POST",
+        body: JSON.stringify({ input }),
+    });
+    if (opts.json) {
+        console.log(JSON.stringify(data.session, null, 2));
+        return;
+    }
+    printWorkbenchSession(data.session);
+}
+async function stopWorkbenchSessionCli(sessionId, opts) {
+    const data = await callLocalOwnerEndpoint(`/self/workbench/sessions/${encodeURIComponent(sessionId)}/stop`, opts, {
+        method: "POST",
+    });
+    if (opts.json) {
+        console.log(JSON.stringify(data.session, null, 2));
+        return;
+    }
+    printWorkbenchSession(data.session);
+}
+async function resizeWorkbenchSessionCli(sessionId, opts) {
+    const cols = parsePositiveIntCliOption(opts.cols, "--cols");
+    const rows = parsePositiveIntCliOption(opts.rows, "--rows");
+    if (cols === undefined || rows === undefined) {
+        console.error("--cols and --rows are required");
+        process.exit(1);
+    }
+    const data = await callLocalOwnerEndpoint(`/self/workbench/sessions/${encodeURIComponent(sessionId)}/resize`, opts, {
+        method: "POST",
+        body: JSON.stringify({ cols, rows }),
+    });
+    if (opts.json) {
+        console.log(JSON.stringify(data.session, null, 2));
+        return;
+    }
+    printWorkbenchSession(data.session);
+}
+async function openWorkbenchUiCli(opts) {
+    const secretKey = await getOrCreateLocalOwnerSecret();
+    const port = await resolveLocalOwnerPort(opts);
+    const url = `http://127.0.0.1:${port}/workbench#token=${encodeURIComponent(secretKey)}`;
+    console.log(`Workbench: ${url}`);
+    if (opts.open === false || opts.printUrl)
+        return;
+    try {
+        await openUrl(url);
+    }
+    catch (error) {
+        console.error(error instanceof Error ? error.message : String(error));
+        process.exit(1);
+    }
+}
+function createSecretariatClient(opts) {
+    return new SecretariatClient({
+        requestJson: (path, init) => callLocalOwnerEndpoint(path, opts, init),
+    });
+}
+async function resolveSecretariatAgentName(opts) {
+    if (opts.name && !opts.port)
+        return String(opts.name);
+    const data = await callLocalOwnerEndpoint("/self/state", opts, { method: "GET" });
+    const agent = typeof data.agent === "string" ? data.agent.trim() : "";
+    if (!agent) {
+        console.error("Could not resolve the target Akemon name. Pass --name when using --port.");
+        process.exit(1);
+    }
+    return agent;
+}
+function defaultChatConversationId(opts) {
+    const value = typeof opts.conversation === "string" ? opts.conversation.trim() : "";
+    return value || "akemon_cli";
+}
+function printSecretariatMessageResponse(data, opts) {
+    if (opts.json) {
+        console.log(JSON.stringify(data, null, 2));
+        return;
+    }
+    const output = data.output || data.response?.payload?.text || "";
+    if (output)
+        console.log(output);
+    if (data.task?.taskId) {
+        console.error(`[akemon-chat] task: ${data.task.taskId}`);
+    }
+}
+function printSecretariatTaskStatus(task) {
+    const view = task.view;
+    const stage = view?.stage?.label || task.stage;
+    const status = [task.status, task.stage].filter(Boolean).join("/");
+    console.log(`${task.taskId}  ${status}  ${stage}`);
+    if (task.title)
+        console.log(`  ${truncateOneLine(task.title, 120)}`);
+    if (task.summary)
+        console.log(`  ${truncateOneLine(task.summary, 160)}`);
+    if (task.conversationId)
+        console.log(`  conversation: ${task.conversationId}`);
+    if (task.updatedAt)
+        console.log(`  updated: ${task.updatedAt}`);
+}
+function taskReportText(response) {
+    const task = response.task;
+    const view = response.taskView || task.view;
+    const latestReview = Array.isArray(view?.reviews) && view.reviews.length
+        ? view.reviews[view.reviews.length - 1]
+        : null;
+    return view?.report?.text
+        || latestReview?.reportText
+        || (typeof task.data?.reportText === "string" ? task.data.reportText : "")
+        || task.summary
+        || task.nextAction
+        || "";
+}
+function printSecretariatTaskReport(response, opts) {
+    if (opts.json) {
+        console.log(JSON.stringify(response, null, 2));
+        return;
+    }
+    const text = taskReportText(response);
+    if (text) {
+        console.log(text);
+        return;
+    }
+    printSecretariatTaskStatus(response.task);
+}
+async function runChatSendCli(textParts, opts) {
+    const text = textParts.join(" ").trim();
+    if (!text) {
+        console.error("Message text is required");
+        process.exit(1);
+    }
+    const targetOpts = await resolveLocalOwnerEndpointOptions(opts);
+    const targetAgent = await resolveSecretariatAgentName(targetOpts);
+    const conversationId = defaultChatConversationId(opts);
+    const createdAt = opts.createdAt || new Date().toISOString();
+    const message = createOwnerChatMessage({
+        targetAgent,
+        text,
+        conversationId,
+        memoryScope: parseAkemonMemoryScope(opts.memoryScope),
+        id: opts.messageId,
+        createdAt,
+    });
+    const taskId = taskIdFromOwnerChatMessage(message);
+    const client = createSecretariatClient(targetOpts);
+    if (opts.wait === false) {
+        const data = await client.submitOwnerIntent({ message, wait: false });
+        const acceptedTaskId = data.task?.taskId || taskId;
+        if (opts.json) {
+            console.log(JSON.stringify({
+                ...data,
+                submitted: true,
+                wait: false,
+                taskId: acceptedTaskId,
+                messageId: message.id,
+                conversationId,
+            }, null, 2));
+            return;
+        }
+        console.log(`Submitted: ${acceptedTaskId}`);
+        console.log(`Status: akemon task status ${acceptedTaskId} --port ${targetOpts.port}`);
+        console.log(`Report: akemon task report ${acceptedTaskId} --port ${targetOpts.port}`);
+        return;
+    }
+    const data = await client.submitOwnerIntent({ message });
+    printSecretariatMessageResponse(data, opts);
+}
+async function runChatFollowCli(taskId, textParts, opts) {
+    const text = textParts.join(" ").trim();
+    if (!taskId || !text) {
+        console.error("Usage: akemon chat follow <taskId> <message...>");
+        process.exit(1);
+    }
+    const targetOpts = await resolveLocalOwnerEndpointOptions(opts);
+    const client = createSecretariatClient(targetOpts);
+    const [targetAgent, taskResponse] = await Promise.all([
+        resolveSecretariatAgentName(targetOpts),
+        client.getTaskStatus(taskId).catch(() => null),
+    ]);
+    const conversationId = opts.conversation || taskResponse?.task.conversationId || defaultChatConversationId(opts);
+    const message = createOwnerChatMessage({
+        targetAgent,
+        text,
+        conversationId,
+        memoryScope: parseAkemonMemoryScope(opts.memoryScope),
+    });
+    const data = await client.queueOwnerFollowUp({ taskId, message });
+    printSecretariatMessageResponse(data, opts);
+}
+async function runTaskStatusCli(taskId, opts) {
+    const targetOpts = await resolveLocalOwnerEndpointOptions(opts);
+    const data = await createSecretariatClient(targetOpts).getTaskStatus(taskId);
+    if (opts.json) {
+        console.log(JSON.stringify(data, null, 2));
+        return;
+    }
+    printSecretariatTaskStatus(data.task);
+}
+async function runTaskReportCli(taskId, opts) {
+    const targetOpts = await resolveLocalOwnerEndpointOptions(opts);
+    const data = await createSecretariatClient(targetOpts).getTaskReport(taskId);
+    printSecretariatTaskReport(data, opts);
+}
+async function runTaskWatchCli(taskId, opts) {
+    const targetOpts = await resolveLocalOwnerEndpointOptions(opts);
+    const client = createSecretariatClient(targetOpts);
+    const intervalMs = parsePositiveIntCliOption(opts.intervalMs, "--interval-ms") || 1000;
+    let lastKey = "";
+    for (;;) {
+        const data = await client.getTaskStatus(taskId);
+        const task = data.task;
+        const key = [task.status, task.stage, task.updatedAt, task.summary || ""].join("|");
+        if (key !== lastKey) {
+            lastKey = key;
+            if (opts.jsonl) {
+                console.log(JSON.stringify({
+                    taskId: task.taskId,
+                    status: task.status,
+                    stage: task.stage,
+                    updatedAt: task.updatedAt,
+                    summary: task.summary,
+                    report: taskReportText(data) || undefined,
+                }));
+            }
+            else {
+                printSecretariatTaskStatus(task);
+                if (taskIsTerminal(task)) {
+                    const report = taskReportText(data);
+                    if (report)
+                        console.log(`  report: ${truncateOneLine(report, 180)}`);
+                }
+            }
+        }
+        if (taskIsTerminal(task) || opts.once)
+            break;
+        await new Promise((resolve) => setTimeout(resolve, intervalMs));
+    }
+}
+function addLocalRuntimeOptions(command) {
+    return command
+        .option("-p, --port <port>", "Local port for MCP loopback", "3000")
+        .option("-w, --workdir <path>", "Working directory for the engine (default: cwd)")
+        .option("-n, --name <name>", "Agent name", "my-agent")
+        .option("-m, --model <model>", "Model to use (e.g. claude-sonnet-4-6, gpt-4o)")
+        .option("--engine <engine>", "Engine: claude, codex, opencode, gemini, raw, human, or any CLI", "claude")
+        .option("--approve", "Review every task before execution")
+        .option("--mock", "Use mock responses (for demo/testing)")
+        .option("--allow-all", "Skip all permission prompts (for self-use)")
+        .option("--mcp-server <command>", "Wrap a community MCP server (stdio) and expose its tools")
+        .option("--notify <url>", "ntfy.sh topic URL for push notifications (e.g. https://ntfy.sh/my-agent)")
+        .option("--interval <minutes>", "Consciousness cycle interval in minutes (default: 1440 = 24h)")
+        .option("--with <modules>", "Enable specific modules (comma-separated: biostate,memory)")
+        .option("--without <modules>", "Disable specific modules (comma-separated: biostate,memory)")
+        .option("--script <name>", "Script to load for ScriptModule (default: daily-life)", "daily-life")
+        .option("--software-agent-env <policy>", "Software-agent child environment policy: inherit or allowlist", process.env.AKEMON_SOFTWARE_AGENT_ENV_POLICY || "inherit")
+        .option("--software-agent-env-allow <vars>", "Comma-separated extra env vars for software-agent allowlist");
+}
+function addLocalAkemonSelectionOptions(command) {
+    return command
+        .option("-n, --name <name>", "Running local Akemon name")
+        .option("-p, --port <port>", "Local Akemon port (overrides --name)");
+}
+function parseEnabledModules(opts) {
     if (opts.with) {
-        enabledModules = opts.with.split(",").map((m) => m.trim());
+        return opts.with.split(",").map((m) => m.trim()).filter(Boolean);
+    }
+    if (opts.without) {
+        const disabled = opts.without.split(",").map((m) => m.trim()).filter(Boolean);
+        return ALL_MODULES.filter((m) => !disabled.includes(m));
     }
-    else if (opts.without) {
-        const disabled = opts.without.split(",").map((m) => m.trim());
-        enabledModules = ALL_MODULES.filter(m => !disabled.includes(m));
+    return undefined;
+}
+async function startServeCli(opts, config = {}) {
+    const port = parsePortOption(opts.port);
+    const engine = opts.engine || "claude";
+    let relayMode;
+    try {
+        relayMode = resolveServeRelayMode({
+            localOnly: config.forceLocalOnly || opts.localOnly,
+            public: opts.public,
+            relay: opts.relay,
+        });
     }
+    catch (error) {
+        console.error(error instanceof Error ? error.message : String(error));
+        process.exit(1);
+    }
+    let relayCredentials = null;
+    const secretKey = relayMode.enabled
+        ? (relayCredentials = await getOrCreateRelayCredentials()).secretKey
+        : await getOrCreateLocalOwnerSecret();
     serve({
         port,
         workdir: opts.workdir,
@@ -317,37 +965,65 @@ program
         approve: opts.approve,
         allowAll: opts.allowAll,
         engine,
-        relayHttp,
-        secretKey: credentials.secretKey,
+        relayHttp: relayMode.relayHttp,
+        secretKey,
         mcpServer: opts.mcpServer,
         cycleInterval: opts.interval ? parseInt(opts.interval) : undefined,
         notifyUrl: opts.notify,
-        enabledModules,
+        enabledModules: parseEnabledModules(opts),
         scriptName: opts.script,
         softwareAgentEnvPolicy: parseSoftwareAgentEnvPolicy(opts.softwareAgentEnv),
         softwareAgentEnvAllowlist: parseCommaSeparatedCliOption(opts.softwareAgentEnvAllow),
     });
     console.log(`\nakemon v${pkg.version}`);
-    if (!opts.public) {
-        console.log(`Access key:  ${credentials.accessKey} (share with publishers)`);
-    }
-    console.log(`Relay:       ${relayWs}\n`);
-    // Default avatar: DiceBear bottts-neutral (deterministic from name)
-    const avatar = opts.avatar || `https://api.dicebear.com/9.x/bottts-neutral/svg?seed=${encodeURIComponent(opts.name)}`;
-    connectRelay({
-        relayUrl: relayWs,
-        agentName: opts.name,
-        credentials,
-        localPort: port,
-        description: opts.desc,
-        isPublic: opts.public,
-        engine,
-        tags: opts.tags ? opts.tags.split(",").map((t) => t.trim()) : undefined,
-        price: parseInt(opts.price) || 1,
-        avatar,
-        onOrderNotify,
-        enableTerminal: opts.terminal,
-    });
+    console.log(`Mode:        ${relayMode.enabled ? "relay" : "local-only"}`);
+    if (relayMode.enabled && relayCredentials && !opts.public) {
+        console.log(`Access key:  ${relayCredentials.accessKey} (share with publishers)`);
+    }
+    console.log(`Relay:       ${relayMode.relayWs || "disabled"}\n`);
+    if (relayMode.enabled && relayMode.relayWs && relayCredentials) {
+        // Default avatar: DiceBear bottts-neutral (deterministic from name)
+        const avatar = opts.avatar || `https://api.dicebear.com/9.x/bottts-neutral/svg?seed=${encodeURIComponent(opts.name)}`;
+        connectRelay({
+            relayUrl: relayMode.relayWs,
+            agentName: opts.name,
+            credentials: relayCredentials,
+            localPort: port,
+            description: opts.desc,
+            isPublic: opts.public,
+            engine,
+            tags: opts.tags ? opts.tags.split(",").map((t) => t.trim()) : undefined,
+            price: parseInt(opts.price) || 1,
+            avatar,
+            onOrderNotify,
+            enableTerminal: opts.terminal,
+        });
+    }
+}
+program
+    .name("akemon")
+    .description("Local AI companion runtime with memory, modules, relay sync, and software-agent control")
+    .version(pkg.version);
+addLocalRuntimeOptions(program
+    .command("run")
+    .description("Run a named local Akemon without relay"))
+    .action(async (opts) => {
+    await startServeCli(opts, { forceLocalOnly: true });
+});
+addLocalRuntimeOptions(program
+    .command("serve")
+    .description("Run local Akemon; optionally connect or publish to relay"))
+    .option("--desc <description>", "Agent description (for discovery)")
+    .option("--tags <tags>", "Comma-separated tags (e.g. vue,frontend,review)")
+    .option("--public", "Allow anyone to call this agent without a key")
+    .option("--max-tasks <n>", "Maximum tasks per day (PP)")
+    .option("--price <n>", "Price in credits per call (default: 1)", "1")
+    .option("--avatar <url>", "Custom avatar URL (default: auto-generated from name)")
+    .option("--terminal", "Enable remote terminal access (PTY)")
+    .option("--local-only", "Force local-only mode and disable relay")
+    .option("--relay <url>", "Relay WebSocket URL (enables relay; --public uses the default relay)")
+    .action(async (opts) => {
+    await startServeCli(opts);
 });
 program
     .command("add")
@@ -362,7 +1038,7 @@ program
         await addAgent(name, endpoint, opts.key, platform);
     }
     else {
-        const relayEndpoint = `${RELAY_HTTP}/v1/agent/${name}/mcp`;
+        const relayEndpoint = `${DEFAULT_RELAY_HTTP}/v1/agent/${name}/mcp`;
         await addAgent(name, relayEndpoint, opts.key, platform);
     }
 });
@@ -371,21 +1047,196 @@ program
     .description("List available agents on the relay")
     .option("--search <query>", "Filter by name or description")
     .action(async (opts) => {
-    await listAgents(RELAY_HTTP, opts.search);
+    await listAgents(DEFAULT_RELAY_HTTP, opts.search);
+});
+program
+    .command("discover")
+    .description("Discover public Akemon profiles by public relay interests")
+    .argument("<query...>", "Interest or profile query")
+    .option("--relay <url>", "Relay HTTP URL", DEFAULT_RELAY_HTTP)
+    .option("-l, --limit <n>", "Maximum candidates to print", "5")
+    .option("--exclude <name>", "Exclude one Akemon name from results")
+    .option("--json", "Print raw JSON")
+    .action(async (queryParts, opts) => {
+    const query = queryParts.join(" ").trim();
+    if (!query) {
+        console.error("Discovery query is required");
+        process.exit(1);
+    }
+    try {
+        const rawProfiles = await fetchPublicRelayAgentsForDiscovery(opts.relay);
+        const results = discoverPublicAkemonProfiles(rawProfiles, query, {
+            assumePublic: true,
+            source: "relay",
+            limit: clampPositiveInt(opts.limit, 5, 50),
+            exclude: opts.exclude,
+        });
+        if (opts.json) {
+            console.log(JSON.stringify({ query, results }, null, 2));
+            return;
+        }
+        printProfileDiscoveryResults(results, query);
+    }
+    catch (error) {
+        console.error(error instanceof Error ? error.message : String(error));
+        process.exit(1);
+    }
 });
 program
     .command("connect")
     .description("Connect to the akemon network as a client (stdio MCP server for OpenClaw, Claude, etc.)")
-    .option("--relay <url>", "Relay HTTP URL", RELAY_HTTP)
+    .option("--relay <url>", "Relay HTTP URL", DEFAULT_RELAY_HTTP)
     .option("--key <key>", "Access key for calling private agents")
     .action(async (opts) => {
     await connect({ relay: opts.relay, key: opts.key });
 });
+program
+    .command("manager")
+    .description("Show or set the default local manager Akemon")
+    .argument("[name]", "Local Akemon name to use as manager")
+    .action(async (name) => {
+    try {
+        if (name) {
+            const manager = await setLocalManagerName(name);
+            console.log(`Local manager: ${manager}`);
+            return;
+        }
+        const manager = await getLocalManagerName();
+        console.log(manager ? `Local manager: ${manager}` : "No local manager set.");
+    }
+    catch (error) {
+        console.error(error instanceof Error ? error.message : String(error));
+        process.exit(1);
+    }
+});
+program
+    .command("instances")
+    .description("List running local Akemon instances")
+    .option("--json", "Print raw JSON")
+    .action(async (opts) => {
+    try {
+        const instances = await listRunningLocalInstances();
+        if (opts.json) {
+            console.log(JSON.stringify({ instances }, null, 2));
+            return;
+        }
+        printLocalInstanceList(instances);
+    }
+    catch (error) {
+        console.error(error instanceof Error ? error.message : String(error));
+        process.exit(1);
+    }
+});
+program
+    .command("message")
+    .description("Send a structured local Akemon message to another running Akemon")
+    .argument("<text...>", "Message text")
+    .requiredOption("--to <name>", "Target running local Akemon name")
+    .option("--from <name>", "Source Akemon name (defaults to configured local manager)")
+    .option("-p, --port <port>", "Target local Akemon port (overrides --to lookup)")
+    .option("--conversation <id>", "Conversation id for this local interconnect message")
+    .option("--memory-scope <scope>", "Memory scope: none|public|task|owner", "task")
+    .option("--require-owner-approval", "Ask the target Akemon owner to approve/respond before engine execution")
+    .option("--json", "Print raw JSON")
+    .action(async (textParts, opts) => {
+    const text = textParts.join(" ").trim();
+    if (!text) {
+        console.error("Message text is required");
+        process.exit(1);
+    }
+    const from = opts.from || await getLocalManagerName();
+    if (!from) {
+        console.error("Missing --from. Set a default manager with: akemon manager <name>");
+        process.exit(1);
+    }
+    const message = createLocalAkemonMessage({
+        sourceAgent: from,
+        targetAgent: opts.to,
+        text,
+        conversationId: opts.conversation,
+        memoryScope: parseAkemonMemoryScope(opts.memoryScope),
+        requiresOwnerApproval: opts.requireOwnerApproval === true,
+    });
+    const data = await callLocalOwnerEndpoint("/self/message", { name: opts.to, port: opts.port }, {
+        method: "POST",
+        body: JSON.stringify({ message }),
+    });
+    await appendLocalPeerContact({
+        schemaVersion: 1,
+        ts: new Date().toISOString(),
+        ownerAgent: from,
+        peerAgent: opts.to,
+        direction: "sent",
+        messageId: message.id,
+        conversationId: message.conversationId,
+    });
+    if (opts.json) {
+        console.log(JSON.stringify(data, null, 2));
+        return;
+    }
+    console.log(data.output || data.response?.payload?.text || "");
+    if (data.response?.id)
+        console.error(`[akemon-message] response: ${data.response.id}`);
+});
+const chatCommand = addLocalAkemonSelectionOptions(program
+    .command("chat")
+    .description("Send an owner chat intent through the local Secretariat Runtime")
+    .argument("[text...]", "Message text"))
+    .option("--conversation <id>", "Conversation id for this chat", "akemon_cli")
+    .option("--memory-scope <scope>", "Memory scope: none|public|task|owner", "owner")
+    .option("--no-wait", "Submit and return after the local task is accepted")
+    .option("--json", "Print raw JSON")
+    .addOption(new Option("--message-id <id>", "Internal: fixed message id for detached submission").hideHelp())
+    .addOption(new Option("--created-at <iso>", "Internal: fixed createdAt for detached submission").hideHelp())
+    .action(async (textParts, opts) => {
+    await runChatSendCli(textParts || [], opts);
+});
+addLocalAkemonSelectionOptions(chatCommand
+    .command("follow")
+    .description("Queue a follow-up for a running Akemon task")
+    .argument("<taskId>", "Task id")
+    .argument("<text...>", "Follow-up text"))
+    .option("--conversation <id>", "Conversation id for this follow-up; defaults to the task conversation")
+    .option("--memory-scope <scope>", "Memory scope: none|public|task|owner", "owner")
+    .option("--json", "Print raw JSON")
+    .action(async (taskId, textParts, opts) => {
+    await runChatFollowCli(taskId, textParts || [], opts);
+});
+const taskCommand = addLocalAkemonSelectionOptions(program
+    .command("task")
+    .description("Inspect Secretariat task lifecycle records"));
+addLocalAkemonSelectionOptions(taskCommand
+    .command("status")
+    .description("Show a Secretariat task status")
+    .argument("<taskId>", "Task id"))
+    .option("--json", "Print raw JSON")
+    .action(async (taskId, opts) => {
+    await runTaskStatusCli(taskId, opts);
+});
+addLocalAkemonSelectionOptions(taskCommand
+    .command("report")
+    .description("Show a Secretariat task report")
+    .argument("<taskId>", "Task id"))
+    .option("--json", "Print raw JSON")
+    .action(async (taskId, opts) => {
+    await runTaskReportCli(taskId, opts);
+});
+addLocalAkemonSelectionOptions(taskCommand
+    .command("watch")
+    .description("Poll a Secretariat task until it completes")
+    .argument("<taskId>", "Task id"))
+    .option("--interval-ms <ms>", "Polling interval in milliseconds", "1000")
+    .option("--jsonl", "Print status updates as JSON Lines")
+    .option("--once", "Print one status update and exit")
+    .action(async (taskId, opts) => {
+    await runTaskWatchCli(taskId, opts);
+});
 program
     .command("software-agent")
-    .description("Run an owner-only local software-agent task via a running akemon serve")
+    .description("Run an owner-only software-agent task via a running local Akemon")
     .argument("<goal...>", "Task goal to send to the software agent")
-    .option("-p, --port <port>", "Local akemon serve port", "3000")
+    .option("-n, --name <name>", "Running local Akemon name")
+    .option("-p, --port <port>", "Local Akemon port (overrides --name)")
     .option("-w, --workdir <path>", "Workdir for the software agent (default: serve workdir)")
     .option("--allow-outside-workdir", "Allow the software agent workdir to be outside the serve workdir")
     .option("--role-scope <scope>", "Role scope: owner|public|order|agent|system", "owner")
@@ -403,10 +1254,11 @@ program
 });
 program
     .command("software-agent-continue")
-    .description("Continue an Akemon-side software-agent context session")
+    .description("Continue an Akemon-side software-agent context session via a running local Akemon")
     .argument("<sessionId>", "Akemon-side context session id to continue")
     .argument("<goal...>", "Task goal to send to the software agent")
-    .option("-p, --port <port>", "Local akemon serve port", "3000")
+    .option("-n, --name <name>", "Running local Akemon name")
+    .option("-p, --port <port>", "Local Akemon port (overrides --name)")
     .option("-w, --workdir <path>", "Workdir for the software agent (default: serve workdir)")
     .option("--allow-outside-workdir", "Allow the software agent workdir to be outside the serve workdir")
     .option("--role-scope <scope>", "Role scope: owner|public|order|agent|system", "owner")
@@ -421,21 +1273,19 @@ program
     .action(async (sessionId, goalParts, opts) => {
     await runSoftwareAgentCli(goalParts, opts, sessionId);
 });
-program
+addLocalAkemonSelectionOptions(program
     .command("software-agent-status")
-    .description("Show the owner-only local software-agent peripheral state")
-    .option("-p, --port <port>", "Local akemon serve port", "3000")
+    .description("Show the owner-only local software-agent peripheral state"))
     .action(async (opts) => {
     const data = await callLocalOwnerEndpoint("/self/software-agent/status", opts, {
         method: "GET",
     });
     console.log(JSON.stringify(data, null, 2));
 });
-program
+addLocalAkemonSelectionOptions(program
     .command("software-agent-tasks")
     .description("List recent owner-only software-agent task ledger records")
-    .argument("[taskId]", "Task id to inspect")
-    .option("-p, --port <port>", "Local akemon serve port", "3000")
+    .argument("[taskId]", "Task id to inspect"))
     .option("-l, --limit <n>", "Maximum recent tasks to list", "20")
     .option("--session <id>", "Filter listed tasks by Akemon-side context session id")
     .option("--context", "Print the task's Akemon TASK_CONTEXT.md content when inspecting one task")
@@ -472,11 +1322,10 @@ program
     }
     printSoftwareAgentTaskList(Array.isArray(data.tasks) ? data.tasks : []);
 });
-program
+addLocalAkemonSelectionOptions(program
     .command("software-agent-sessions")
     .description("List or inspect owner-only Akemon-side software-agent context sessions")
-    .argument("[sessionId]", "Context session id to inspect")
-    .option("-p, --port <port>", "Local akemon serve port", "3000")
+    .argument("[sessionId]", "Context session id to inspect"))
     .option("-l, --limit <n>", "Maximum recent sessions to list", "20")
     .option("--context", "Print the session TASK_CONTEXT.md content")
     .option("--json", "Print raw JSON")
@@ -509,16 +1358,247 @@ program
     }
     printSoftwareAgentSessionList(Array.isArray(data.sessions) ? data.sessions : []);
 });
-program
+addLocalAkemonSelectionOptions(program
     .command("software-agent-reset")
-    .description("Reset the owner-only local software-agent peripheral session")
-    .option("-p, --port <port>", "Local akemon serve port", "3000")
+    .description("Reset the owner-only local software-agent peripheral session"))
     .action(async (opts) => {
     const data = await callLocalOwnerEndpoint("/self/software-agent/reset", opts, {
         method: "POST",
     });
     console.log(JSON.stringify(data, null, 2));
 });
+addLocalAkemonSelectionOptions(program
+    .command("workbench")
+    .description("Open the local owner-only Workbench UI"))
+    .option("--no-open", "Print the Workbench URL without opening a browser")
+    .option("--print-url", "Print the Workbench URL without opening a browser")
+    .action(async (opts) => {
+    await openWorkbenchUiCli(opts);
+});
+addLocalAkemonSelectionOptions(program
+    .command("workbench-start")
+    .description("Start an owner-only interactive Workbench PTY session")
+    .argument("<tool>", "codex|claude|cursor|shell|custom")
+    .argument("[args...]", "Arguments passed to the Workbench command")
+    .allowUnknownOption(true))
+    .option("--command <cmd>", "Override the command to spawn")
+    .option("-w, --workdir <path>", "Workbench session workdir (default: serve workdir)")
+    .option("--allow-outside-workdir", "Allow the Workbench workdir to be outside the serve workdir")
+    .option("--cols <n>", "Terminal columns")
+    .option("--rows <n>", "Terminal rows")
+    .option("--input <text>", "Initial owner-direct input to write after startup")
+    .option("--label <text>", "Human-readable session label")
+    .option("--json", "Print raw JSON")
+    .action(async (tool, args, opts) => {
+    await runWorkbenchStartCli(tool, args || [], opts);
+});
+addLocalAkemonSelectionOptions(program
+    .command("workbench-sessions")
+    .description("List owner-only Workbench PTY sessions"))
+    .option("--json", "Print raw JSON")
+    .action(async (opts) => {
+    await listWorkbenchSessionsCli(opts);
+});
+addLocalAkemonSelectionOptions(program
+    .command("workbench-tail")
+    .description("Print the rolling output buffer for a Workbench session")
+    .argument("<sessionId>", "Workbench session id"))
+    .option("--json", "Print raw JSON")
+    .action(async (sessionId, opts) => {
+    await showWorkbenchTailCli(sessionId, opts);
+});
+addLocalAkemonSelectionOptions(program
+    .command("workbench-input")
+    .description("Send owner-direct input to a running Workbench session")
+    .argument("<sessionId>", "Workbench session id")
+    .argument("<input...>", "Text to send"))
+    .option("--no-enter", "Do not append a newline to the input")
+    .option("--json", "Print raw JSON")
+    .action(async (sessionId, inputParts, opts) => {
+    await sendWorkbenchInputCli(sessionId, inputParts || [], opts);
+});
+addLocalAkemonSelectionOptions(program
+    .command("workbench-stop")
+    .description("Stop a Workbench PTY session")
+    .argument("<sessionId>", "Workbench session id"))
+    .option("--json", "Print raw JSON")
+    .action(async (sessionId, opts) => {
+    await stopWorkbenchSessionCli(sessionId, opts);
+});
+addLocalAkemonSelectionOptions(program
+    .command("workbench-resize")
+    .description("Resize a running Workbench PTY session")
+    .argument("<sessionId>", "Workbench session id"))
+    .option("--cols <n>", "Terminal columns")
+    .option("--rows <n>", "Terminal rows")
+    .option("--json", "Print raw JSON")
+    .action(async (sessionId, opts) => {
+    await resizeWorkbenchSessionCli(sessionId, opts);
+});
+const memoryRecordersCommand = program
+    .command("memory-recorders")
+    .description("List and inspect Akemon memory-writing situations")
+    .action(() => {
+    printMemoryRecorderList(listMemoryRecorders({ enabled: true }));
+});
+memoryRecordersCommand
+    .command("list")
+    .description("List registered built-in memory recorders")
+    .option("--scope <scope>", "Filter by destination scope")
+    .option("--source <source>", "Filter by source: builtin, module, or skill")
+    .option("--json", "Print raw JSON")
+    .action((opts) => {
+    const recorders = listMemoryRecorders({
+        scope: parseMemoryRecorderScope(opts.scope),
+        source: parseMemoryRecorderSource(opts.source),
+        enabled: true,
+    });
+    if (opts.json) {
+        console.log(JSON.stringify(recorders, null, 2));
+        return;
+    }
+    printMemoryRecorderList(recorders);
+});
+memoryRecordersCommand
+    .command("show")
+    .description("Show one memory recorder's trigger, destinations, and privacy boundary")
+    .argument("<id>", "Memory recorder id")
+    .option("--json", "Print raw JSON")
+    .action((id, opts) => {
+    const recorder = getMemoryRecorder(id);
+    if (!recorder) {
+        console.error(`Unknown memory recorder: ${id}`);
+        process.exit(1);
+    }
+    if (opts.json) {
+        console.log(JSON.stringify(recorder, null, 2));
+        return;
+    }
+    printMemoryRecorderDetail(recorder);
+});
+const peripheralsCommand = program
+    .command("peripherals")
+    .description("List, register, and explore Akemon peripheral records")
+    .action(() => {
+    peripheralsCommand.help();
+});
+peripheralsCommand
+    .command("list")
+    .description("List configured peripheral records")
+    .option("-n, --name <name>", "Akemon name (defaults to the configured local manager)")
+    .option("--json", "Print raw JSON")
+    .action(async (opts) => {
+    try {
+        const agentName = await resolvePeripheralRegistryAgentName(opts.name);
+        const records = await loadPeripheralRecords(agentName);
+        if (opts.json) {
+            console.log(JSON.stringify(records, null, 2));
+            return;
+        }
+        printPeripheralRecords(records);
+    }
+    catch (error) {
+        console.error(error instanceof Error ? error.message : String(error));
+        process.exit(1);
+    }
+});
+peripheralsCommand
+    .command("register")
+    .description("Register or update a configured peripheral record")
+    .requiredOption("--id <id>", "Stable peripheral id")
+    .requiredOption("--label <name>", "Human-readable peripheral name")
+    .option("-n, --name <name>", "Akemon name (defaults to the configured local manager)")
+    .option("--type <type>", "Peripheral type: engine|relay|software-agent|mcp|service|hardware|custom", "custom")
+    .option("--capabilities <items>", "Comma-separated capabilities")
+    .option("--tags <items>", "Comma-separated tags")
+    .option("--risk <level>", "Risk level: low|medium|high", "medium")
+    .option("--allowed-actions <items>", "Comma-separated allowed action labels")
+    .option("--command <command>", "Optional start command, recorded but not executed")
+    .option("--url <url>", "Optional URL for this peripheral")
+    .option("--explore <mode>", "Explore mode: none|plain-text", "none")
+    .option("--explore-description <text>", "Plain-text explore behavior description")
+    .option("--json", "Print raw JSON")
+    .action(async (opts) => {
+    try {
+        const agentName = await resolvePeripheralRegistryAgentName(opts.name);
+        const record = await upsertPeripheralRecord(agentName, {
+            id: opts.id,
+            name: opts.label,
+            type: parsePeripheralRecordType(opts.type),
+            capabilities: parseCommaSeparatedCliOption(opts.capabilities) || [],
+            tags: parseCommaSeparatedCliOption(opts.tags) || [],
+            riskLevel: parsePeripheralRiskLevel(opts.risk),
+            allowedActions: parseCommaSeparatedCliOption(opts.allowedActions) || [],
+            startCommand: opts.command,
+            url: opts.url,
+            explore: {
+                mode: parsePeripheralExploreMode(opts.explore),
+                description: opts.exploreDescription,
+            },
+            source: "owner",
+            status: "configured",
+            updatedAt: new Date().toISOString(),
+        });
+        if (opts.json) {
+            console.log(JSON.stringify(record, null, 2));
+            return;
+        }
+        console.log(`Registered peripheral ${record.id} for ${agentName}.`);
+    }
+    catch (error) {
+        console.error(error instanceof Error ? error.message : String(error));
+        process.exit(1);
+    }
+});
+peripheralsCommand
+    .command("explore")
+    .description("Print a plain-text peripheral environment briefing")
+    .argument("[id]", "Optional peripheral id")
+    .option("-n, --name <name>", "Akemon name (defaults to the configured local manager)")
+    .option("-p, --port <port>", "Running local Akemon port for --live")
+    .option("--live", "Ask the running local Akemon for live peripheral exploration")
+    .option("--json", "Print raw JSON")
+    .action(async (id, opts) => {
+    try {
+        let briefing;
+        if (opts.live) {
+            const query = id ? `?id=${encodeURIComponent(id)}` : "";
+            briefing = await callLocalOwnerEndpoint(`/self/peripherals/explore${query}`, opts, { method: "GET" });
+        }
+        else {
+            const agentName = await resolvePeripheralRegistryAgentName(opts.name);
+            const records = await loadPeripheralRecords(agentName);
+            briefing = await buildPeripheralExploreBriefing({ records, id });
+        }
+        if (opts.json) {
+            console.log(JSON.stringify(briefing, null, 2));
+            return;
+        }
+        process.stdout.write(briefing.text);
+        if (!briefing.text.endsWith("\n"))
+            process.stdout.write("\n");
+    }
+    catch (error) {
+        console.error(error instanceof Error ? error.message : String(error));
+        process.exit(1);
+    }
+});
+program
+    .command("audit")
+    .argument("[command]", "Optional subcommand: list")
+    .description("List Akemon permission and action audit records")
+    .option("-n, --name <name>", "Agent name (defaults to the configured local manager)")
+    .option("-l, --limit <n>", "Maximum records to list", "20")
+    .option("--kind <kind>", "Filter by kind: software-agent-task|akemon-message|relay-publication|memory-write")
+    .option("--decision <decision>", "Filter by decision: allowed|denied")
+    .option("--json", "Print raw JSON")
+    .action(async (command, opts) => {
+    if (command !== undefined && command !== "list") {
+        console.error("Unknown audit command. Use: akemon audit [list]");
+        process.exit(1);
+    }
+    await runPermissionAuditListCli(opts);
+});
 program
     .command("privacy-filter")
     .description("Sanitize text with built-in redaction and optional OpenAI Privacy Filter")
@@ -564,6 +1644,7 @@ program
     .description("Print a work-memory context packet for external software agents")
     .option("-w, --workdir <path>", "Akemon workdir (default: cwd)")
     .option("-n, --name <name>", "Agent name", "my-agent")
+    .option("--global", "Use global Akemon work memory under the agent home")
     .option("--purpose <text>", "Purpose of this context packet", "external software-agent work context")
     .option("--budget <chars>", "Maximum packet size in characters", "12000")
     .option("--json", "Print raw JSON")
@@ -574,6 +1655,7 @@ program
             agentName: opts.name,
             purpose: opts.purpose,
             budget: parsePositiveIntCliOption(opts.budget, "--budget"),
+            global: opts.global === true,
         });
         if (opts.json) {
             console.log(JSON.stringify(packet, null, 2));
@@ -594,6 +1676,7 @@ program
     .argument("<text...>", "Durable work-memory note")
     .option("-w, --workdir <path>", "Akemon workdir (default: cwd)")
     .option("-n, --name <name>", "Agent name", "my-agent")
+    .option("--global", "Use global Akemon work memory under the agent home")
     .option("--source <source>", "Note source, e.g. user, codex, or claude-code", "user")
     .option("--session <id>", "External or Akemon-side session id")
     .option("--kind <kind>", "Work-memory kind, e.g. note, decision, command, project", "note")
@@ -609,6 +1692,7 @@ program
             sessionId: opts.session,
             kind: opts.kind,
             target: opts.target,
+            global: opts.global === true,
         });
         if (opts.json) {
             console.log(JSON.stringify(result, null, 2));
@@ -627,10 +1711,14 @@ program
     .description("Open your agent dashboard in the browser")
     .action(async () => {
     const credentials = await getOrCreateRelayCredentials();
-    const url = `${RELAY_HTTP}/owner?account=${credentials.accountId}`;
+    const url = `${DEFAULT_RELAY_HTTP}/owner?account=${credentials.accountId}`;
     console.log(`Opening dashboard: ${url}`);
-    const { exec } = await import("child_process");
-    const cmd = process.platform === "darwin" ? "open" : process.platform === "win32" ? "start" : "xdg-open";
-    exec(`${cmd} "${url}"`);
+    try {
+        await openUrl(url);
+    }
+    catch (error) {
+        console.error(error instanceof Error ? error.message : String(error));
+        process.exit(1);
+    }
 });
 program.parse();