hostctl 0.1.41 → 0.1.44

package/dist/bin/hostctl.js

@@ -2,11 +2,13 @@
 
 // src/cli.ts
 import process4 from "process";
+import path7 from "path";
 import * as cmdr from "commander";
+import "zod";
 
 // src/app.ts
 import process3 from "process";
-import * as fs7 from "fs";
+import * as fs8 from "fs";
 import { homedir as homedir3 } from "os";
 
 // src/handlebars.ts
@@ -1098,15 +1100,15 @@ var Equal = class extends Protocol {
 
 // src/flex/path.ts
 var Path = class _Path {
-  constructor(path5, isWindowsPath = isWindows()) {
-    this.path = path5;
+  constructor(path8, isWindowsPath = isWindows()) {
+    this.path = path8;
     this.isWindowsPath = isWindowsPath;
   }
-  static new(path5, isWindowsPath = isWindows()) {
-    if (path5 instanceof _Path) {
-      return path5;
+  static new(path8, isWindowsPath = isWindows()) {
+    if (path8 instanceof _Path) {
+      return path8;
     }
-    return new _Path(path5, isWindowsPath);
+    return new _Path(path8, isWindowsPath);
   }
   static cwd() {
     return _Path.new(process.cwd());
@@ -1146,8 +1148,8 @@ var Path = class _Path {
       return this.build(posix.basename(this.path, suffix));
     }
   }
-  build(path5) {
-    return new _Path(path5, this.isWindowsPath);
+  build(path8) {
+    return new _Path(path8, this.isWindowsPath);
   }
   // returns the path to the destination on success; null otherwise
   async copy(destPath, mode) {
@@ -1195,7 +1197,7 @@ var Path = class _Path {
   }
   glob(pattern) {
     const cwd = this.absolute().toString();
-    return globSync(pattern, { cwd }).map((path5) => this.build(path5));
+    return globSync(pattern, { cwd }).map((path8) => this.build(path8));
   }
   isAbsolute() {
     if (this.isWindowsPath) {
@@ -1234,11 +1236,11 @@ var Path = class _Path {
     }
   }
   parent(count = 1) {
-    let path5 = this.absolute();
+    let path8 = this.absolute();
     Range.new(1, count).each((i) => {
-      path5 = path5.resolve("..");
+      path8 = path8.resolve("..");
     });
-    return path5;
+    return path8;
   }
   // returns an object of the form: { root, dir, base, ext, name }
   //
@@ -1776,8 +1778,8 @@ import process2 from "process";
 import { readFile as readFile2 } from "fs/promises";
 import { existsSync as existsSync2, readFileSync as readFileSync2 } from "fs";
 import { win32 as win322, posix as posix2 } from "path";
-function exists(path5) {
-  return existsSync2(path5);
+function exists(path8) {
+  return existsSync2(path8);
 }
 var File = class {
   static absolutePath(...paths) {
@@ -1789,15 +1791,15 @@ var File = class {
   }
   // basename("c:\\foo\\bar\\baz.txt") => "baz.txt"
   // basename("/tmp/myfile.html") => "myfile.html"
-  static basename(path5, suffix) {
+  static basename(path8, suffix) {
     if (isWindows()) {
-      return win322.basename(path5, suffix);
+      return win322.basename(path8, suffix);
     } else {
-      return posix2.basename(path5, suffix);
+      return posix2.basename(path8, suffix);
     }
   }
-  static exists(path5) {
-    return exists(path5);
+  static exists(path8) {
+    return exists(path8);
   }
   static join(...paths) {
     if (isWindows()) {
@@ -1806,13 +1808,13 @@ var File = class {
       return posix2.join(...paths);
     }
   }
-  static readSync(path5) {
-    return readFileSync2(path5, {
+  static readSync(path8) {
+    return readFileSync2(path8, {
       encoding: "utf8"
     });
   }
-  static async readAsync(path5) {
-    return await readFile2(path5, {
+  static async readAsync(path8) {
+    return await readFile2(path8, {
       encoding: "utf8"
     });
   }
@@ -1822,8 +1824,8 @@ var File = class {
 var TmpFileRegistry = class _TmpFileRegistry {
   static _instance;
   static get instance() {
-    const path5 = File.join(osHomeDir(), ".hostctl", "tmpstatic");
-    this._instance ??= new _TmpFileRegistry(path5);
+    const path8 = File.join(osHomeDir(), ".hostctl", "tmpstatic");
+    this._instance ??= new _TmpFileRegistry(path8);
     return this._instance;
   }
   rootPath;
@@ -1842,33 +1844,33 @@ var TmpFileRegistry = class _TmpFileRegistry {
   }
   // this directory will be automatically cleaned up at program exit
   createNamedTmpDir(subDirName) {
-    const path5 = this.tmpPath(subDirName);
-    fs.mkdirSync(path5.toString(), { recursive: true });
-    this.registerTempFileOrDir(path5.toString());
-    return path5;
+    const path8 = this.tmpPath(subDirName);
+    fs.mkdirSync(path8.toString(), { recursive: true });
+    this.registerTempFileOrDir(path8.toString());
+    return path8;
   }
   // this file will be automatically cleaned up at program exit
   writeTmpFile(fileContent) {
-    const path5 = this.tmpPath();
-    fs.writeFileSync(path5.toString(), fileContent);
-    this.registerTempFileOrDir(path5.toString());
-    return path5;
+    const path8 = this.tmpPath();
+    fs.writeFileSync(path8.toString(), fileContent);
+    this.registerTempFileOrDir(path8.toString());
+    return path8;
   }
   exitCallback() {
     this.cleanupTempFiles();
   }
-  registerTempFileOrDir(path5) {
-    this.tempFilePaths.push(path5);
+  registerTempFileOrDir(path8) {
+    this.tempFilePaths.push(path8);
   }
   cleanupTempFiles() {
-    this.tempFilePaths.forEach((path5) => {
-      this.rmFile(path5);
+    this.tempFilePaths.forEach((path8) => {
+      this.rmFile(path8);
     });
     this.tempFilePaths = [];
   }
-  rmFile(path5) {
+  rmFile(path8) {
     try {
-      fs.rmSync(path5, { force: true, recursive: true });
+      fs.rmSync(path8, { force: true, recursive: true });
     } catch (e) {
     }
   }
@@ -2023,12 +2025,12 @@ import * as age from "age-encryption";
 import spawnAsync from "@expo/spawn-async";
 
 // src/age-encryption.ts
-function readIdentityStringFromFile(path5) {
-  const contents = fs2.readFileSync(path5, {
+function readIdentityStringFromFile(path8) {
+  const contents = fs2.readFileSync(path8, {
     encoding: "utf8"
   });
   const identityString = contents.split(/\r?\n|\r|\n/g).map((line) => line.trim()).find((line) => line.startsWith("AGE-SECRET-KEY-1"));
-  if (!identityString) throw new Error(`Unable to read identity from file: ${path5}`);
+  if (!identityString) throw new Error(`Unable to read identity from file: ${path8}`);
   return identityString;
 }
 var LibraryDriver = class {
@@ -2044,13 +2046,13 @@ var LibraryDriver = class {
     }
     const d = new age.Decrypter();
     let identitiesAdded = 0;
-    for (const path5 of privateKeyFilePaths) {
+    for (const path8 of privateKeyFilePaths) {
       try {
-        const identityString = readIdentityStringFromFile(path5);
+        const identityString = readIdentityStringFromFile(path8);
         d.addIdentity(identityString);
         identitiesAdded++;
       } catch (err) {
-        console.warn(`Failed to read or parse identity file ${path5}, skipping: ${err.message}`);
+        console.warn(`Failed to read or parse identity file ${path8}, skipping: ${err.message}`);
       }
     }
     if (identitiesAdded === 0) {
@@ -2069,13 +2071,13 @@ var Identity = class {
   identityFilePath;
   identity;
   // either the path to an identity file or an identity string must be supplied
-  constructor({ path: path5, identity: identity2 }) {
+  constructor({ path: path8, identity: identity2 }) {
     if (identity2) {
       this.identity = identity2;
       this.identityFilePath = this.writeTmpIdentityFile(identity2);
-    } else if (path5) {
-      this.identity = this.readIdentityFromFile(path5);
-      this.identityFilePath = path5;
+    } else if (path8) {
+      this.identity = this.readIdentityFromFile(path8);
+      this.identityFilePath = path8;
     } else {
       throw "Either an identity string or an identity file path must be supplied to create an Age Encryption identity";
     }
@@ -2087,12 +2089,12 @@ var Identity = class {
   writeTmpIdentityFile(identity2) {
     return writeTmpFile(identity2).toString();
   }
-  readIdentityFromFile(path5) {
-    const contents = fs2.readFileSync(path5, {
+  readIdentityFromFile(path8) {
+    const contents = fs2.readFileSync(path8, {
       encoding: "utf8"
     });
     const identityString = contents.split(/\r?\n|\r|\n/g).map((line) => line.trim()).find((line) => line.startsWith("AGE-SECRET-KEY-1"));
-    if (!identityString) throw new Error(`Unable to read identity file: ${path5}`);
+    if (!identityString) throw new Error(`Unable to read identity file: ${path8}`);
     return identityString;
   }
   get privateKey() {
@@ -2242,8 +2244,8 @@ var SecretRefYamlType = new yaml.Type("!secret", {
 });
 var HOSTCTL_CONFIG_SCHEMA = yaml.DEFAULT_SCHEMA.extend([SecretRefYamlType]);
 var ConfigFile2 = class {
-  constructor(path5) {
-    this.path = path5;
+  constructor(path8) {
+    this.path = path8;
     this._hosts = /* @__PURE__ */ new Map();
     this._ids = /* @__PURE__ */ new Map();
     this._secrets = /* @__PURE__ */ new Map();
@@ -2387,7 +2389,7 @@ var ConfigFile2 = class {
     }
     if (ageIds) {
       const paths = globSync2(ageIds);
-      const ids = paths.map((path5) => new Identity({ path: path5 }));
+      const ids = paths.map((path8) => new Identity({ path: path8 }));
       return ids;
     }
     return [];
@@ -2416,47 +2418,182 @@ var ConfigFile2 = class {
   }
 };
 
-// src/config-url.ts
-var ConfigUrl = class {
-  constructor(url) {
-    this.url = url;
-    this._hosts = /* @__PURE__ */ new Map();
-    this._secrets = /* @__PURE__ */ new Map();
-    this._ids = /* @__PURE__ */ new Map();
+// src/config-provider/provider-config.ts
+var ProviderRecipientGroup = class {
+  constructor(keys3) {
+    this.keys = keys3;
+  }
+  recipients() {
+    return this.keys;
+  }
+};
+var ProviderSecret = class {
+  constructor(nameValue, value, recipientKeys) {
+    this.nameValue = nameValue;
+    this.value = value;
+    this.recipientKeys = recipientKeys;
+  }
+  get name() {
+    return this.nameValue;
+  }
+  recipients() {
+    return this.recipientKeys;
+  }
+  async ciphertext() {
+    return this.value;
+  }
+  async plaintext() {
+    return this.value;
+  }
+};
+var ProviderConfig = class _ProviderConfig {
+  hostsCache;
+  secretsCache;
+  idsCache;
+  constructor(hosts, secrets, ids) {
+    this.hostsCache = hosts;
+    this.secretsCache = secrets;
+    this.idsCache = ids;
+  }
+  static async load(provider) {
+    const hostInputs = await provider.hosts();
+    const secretsInput = await provider.secrets();
+    const idsInput = await provider.ids();
+    const ids = new Map(
+      idsInput.map((i) => [i.name, new ProviderRecipientGroup([...i.recipients ?? [], ...i.groups ?? []])])
+    );
+    const secrets = new Map(
+      secretsInput.map((s) => [s.name, new ProviderSecret(s.name, s.value, s.ids)])
+    );
+    const config = new _ProviderConfig([], secrets, ids);
+    const hosts = hostInputs.map((h) => config.hostFromInput(h));
+    config.hostsCache = hosts;
+    return config;
+  }
+  hostFromInput(input) {
+    return new Host(this, {
+      hostname: input.hostname,
+      alias: input.name,
+      port: input.port,
+      user: input.user,
+      password: input.password,
+      sshKey: input.sshKey,
+      tags: input.tags
+    });
   }
-  _hosts;
-  _secrets;
-  _ids;
-  // Config interface
   hosts() {
-    return [];
+    return this.hostsCache;
+  }
+  secrets() {
+    return this.secretsCache;
+  }
+  ids() {
+    return this.idsCache;
   }
   getSecret(name) {
-    return void 0;
+    return this.secretsCache.get(name);
   }
   getRecipientGroups(idRefs) {
-    return [];
+    return idRefs.map((id) => this.idsCache.get(id)).filter((v) => Boolean(v));
   }
-  secrets() {
-    return this._secrets;
+};
+
+// src/config-provider/file-config-provider.ts
+var FileConfigProvider = class {
+  constructor(path8) {
+    this.path = path8;
+  }
+  configFile;
+  async getConfigFile() {
+    if (!this.configFile) {
+      const cfg = new ConfigFile2(this.path);
+      await cfg.load();
+      this.configFile = cfg;
+    }
+    return this.configFile;
+  }
+  async hosts() {
+    const cfg = await this.getConfigFile();
+    return cfg.hosts().map((h) => ({
+      name: h.alias || h.hostname,
+      hostname: h.hostname,
+      user: h.user,
+      port: h.port,
+      password: h.password,
+      sshKey: h.sshKey,
+      tags: h.tags
+    }));
+  }
+  async secrets() {
+    const cfg = await this.getConfigFile();
+    return Array.from(cfg.secrets().entries()).map(([name, secret]) => ({
+      name,
+      value: secret.value.toYAML(),
+      ids: secret.ids.toYAML().filter((v) => typeof v === "string")
+    }));
+  }
+  async ids() {
+    const cfg = await this.getConfigFile();
+    return Array.from(cfg.ids().entries()).map(([name, rg]) => ({
+      name,
+      recipients: rg.publicKeys,
+      groups: rg.idRefs
+    }));
   }
-  ids() {
-    return this._ids;
+  async getSecret(name) {
+    const cfg = await this.getConfigFile();
+    return cfg.getSecret(name);
+  }
+  async getRecipientGroups(idRefs) {
+    const cfg = await this.getConfigFile();
+    return cfg.getRecipientGroups(idRefs);
   }
 };
 
-// src/config.ts
-async function load(configRef) {
-  if (configRef && fs4.existsSync(configRef)) {
-    const configFile = new ConfigFile2(configRef);
-    await configFile.load();
-    return configFile;
-  } else if (configRef) {
-    return new ConfigUrl(configRef);
-  } else {
-    throw new Error("No config specified.");
+// src/config-provider/http-config-provider.ts
+import axios from "axios";
+import yaml2 from "js-yaml";
+var HttpConfigProvider = class {
+  constructor(opts) {
+    this.opts = opts;
+  }
+  cache;
+  async fetchData() {
+    const now = Date.now();
+    if (this.cache && this.cache.expiresAt > now) {
+      return this.cache.data;
+    }
+    const headers = { ...this.opts.headers || {} };
+    if (this.opts.auth) {
+      const authHeaders = await this.opts.auth();
+      Object.assign(headers, authHeaders.headers);
+    }
+    const axiosOpts = { headers };
+    const resp = await axios.get(this.opts.url, axiosOpts);
+    const format = this.opts.format ?? "json";
+    const payload = format === "yaml" ? yaml2.load(resp.data) : typeof resp.data === "string" ? JSON.parse(resp.data) : resp.data;
+    const data = Array.isArray(payload) ? payload : payload?.hosts ?? [];
+    const hosts = Array.isArray(data) ? data : [];
+    const ttl = this.opts.cacheTtlMs ?? 0;
+    this.cache = { expiresAt: ttl > 0 ? now + ttl : 0, data: hosts };
+    return hosts;
   }
-}
+  async hosts() {
+    return await this.fetchData();
+  }
+  async secrets() {
+    return [];
+  }
+  async ids() {
+    return [];
+  }
+  async getSecret(_name) {
+    return void 0;
+  }
+  async getRecipientGroups(_idRefs) {
+    return [];
+  }
+};
 
 // src/interaction-handler.ts
 import { Readable } from "stream";
@@ -2762,19 +2899,29 @@ import chalk from "chalk";
 
 // src/task.model.ts
 var Task = class {
-  constructor(runFn, taskModuleAbsolutePath, description, name) {
+  constructor(runFn, taskModuleAbsolutePath, description, name, inputSchema, outputSchema) {
     this.runFn = runFn;
     this.taskModuleAbsolutePath = taskModuleAbsolutePath;
     this.description = description;
     this.name = name;
+    this.inputSchema = inputSchema;
+    this.outputSchema = outputSchema;
   }
 };
 
 // src/runtime-base.ts
 function task(runFn, options) {
   const moduleThatTaskIsDefinedIn = Path.new(callstack().items[2].file).absolute().toString();
-  const taskName = options?.name || "anonymous_task";
-  const taskInstance = new Task(runFn, moduleThatTaskIsDefinedIn, options?.description, taskName);
+  const inferredName = Path.new(moduleThatTaskIsDefinedIn).basename().toString().replace(/\.[^.]+$/, "");
+  const taskName = options?.name || inferredName || "anonymous_task";
+  const taskInstance = new Task(
+    runFn,
+    moduleThatTaskIsDefinedIn,
+    options?.description,
+    taskName,
+    options?.inputSchema,
+    options?.outputSchema
+  );
   const taskFnObject = function(params) {
     return function(parentInvocation) {
       return parentInvocation.invokeChildTask(taskFnObject, params ?? {});
@@ -2898,8 +3045,20 @@ var SSHSession = class {
   constructor() {
     this.ssh = new NodeSSH();
   }
-  connect(sshConnectOpts) {
-    return this.ssh.connect(sshConnectOpts);
+  async connect(sshConnectOpts) {
+    const session = await this.ssh.connect(sshConnectOpts);
+    const connection = this.ssh.connection;
+    if (connection && typeof connection.on === "function" && connection.listenerCount?.("error") === 0) {
+      connection.on("error", (err) => {
+        const code = String(err?.code ?? "").toUpperCase();
+        if (code === "ECONNRESET") {
+          console.warn(`SSH connection reset: ${err?.message ?? err}`);
+          return;
+        }
+        console.warn(`SSH connection error: ${err?.message ?? err}`);
+      });
+    }
+    return session;
   }
   async deleteFile(remotePath) {
     const self = this;
@@ -2938,7 +3097,10 @@ var SSHSession = class {
         pty: options.pty
       };
     }
-    const result = await this.ssh.execCommand(finalCommand, nodeSshCmdOptions);
+    const result = await this.ssh.execCommand(
+      finalCommand,
+      nodeSshCmdOptions
+    );
     const exitCode = result.code === null ? -1 : result.code;
     const signalString = result.signal;
     const signalObject = signalString ? signalsByName[signalString] : void 0;
@@ -3343,7 +3505,8 @@ var RemoteRuntime = class {
           `RemoteRuntime: Executing command on ${this.host.uri} via sshSession.execCommand (no PTY/default handler)`
         );
         const commandObj = await this.sshSession.execCommand(command, {
-          stdin: options?.stdin
+          stdin: options?.stdin,
+          pty: false
         });
         cmdOrErr = commandObj;
       }
@@ -3400,7 +3563,13 @@ var RusPtyCommand = class _RusPtyCommand extends Command {
    */
   static build(command, options = {}) {
     const commandObj = Command.build(command, options);
-    return new _RusPtyCommand({ cmd: commandObj.cmd, args: commandObj.args, cwd: commandObj.cwd, env: commandObj.env, sudo: commandObj.sudo });
+    return new _RusPtyCommand({
+      cmd: commandObj.cmd,
+      args: commandObj.args,
+      cwd: commandObj.cwd,
+      env: commandObj.env,
+      sudo: commandObj.sudo
+    });
   }
   process;
   // Definite assignment assertion
@@ -3461,8 +3630,8 @@ var LocalInvocation = class _LocalInvocation extends Invocation {
     )(params);
     this.config = this.runtime.app.config;
     this.file = {
-      read: async (path5) => fs5.promises.readFile(path5, "utf-8"),
-      write: async (path5, content, options) => {
+      read: async (path8) => fs5.promises.readFile(path8, "utf-8"),
+      write: async (path8, content, options) => {
         const mode = normalizeMode(options?.mode);
         const writeOptions = {
           flag: options?.flag ?? "w"
@@ -3470,20 +3639,20 @@ var LocalInvocation = class _LocalInvocation extends Invocation {
         if (mode !== void 0) {
           writeOptions.mode = mode;
         }
-        await fs5.promises.writeFile(path5, content, writeOptions);
+        await fs5.promises.writeFile(path8, content, writeOptions);
       },
-      exists: async (path5) => {
+      exists: async (path8) => {
         try {
-          await fs5.promises.access(path5);
+          await fs5.promises.access(path8);
           return true;
         } catch {
           return false;
         }
       },
-      mkdir: async (path5, options) => {
-        await fs5.promises.mkdir(path5, options);
+      mkdir: async (path8, options) => {
+        await fs5.promises.mkdir(path8, options);
       },
-      rm: async (path5, options) => fs5.promises.rm(path5, options)
+      rm: async (path8, options) => fs5.promises.rm(path8, options)
     };
   }
   config;
@@ -3495,13 +3664,19 @@ var LocalInvocation = class _LocalInvocation extends Invocation {
     options = options || {};
     const interactionHandler = this.runtime.interactionHandler.clone();
     const stdinForCommand = options.stdin;
+    let hostPassword;
     if (options.input && typeof options.input === "object") {
       O(options.input).each(([pattern, value]) => {
         interactionHandler.map(pattern, value);
       });
     }
     if (options.sudo) {
-      const hostPassword = await this.runtime.getPassword();
+      hostPassword = await this.runtime.getPassword();
+      if (!this.runtime.app.isInteractive() && !hostPassword) {
+        throw new Error(
+          "sudo requested but no password was provided in non-interactive mode. Pass a password to App.loadApiMode or avoid sudo for API calls."
+        );
+      }
       interactionHandler.mapInput(withSudo(hostPassword));
     }
     const cwd = options.cwd ?? process.cwd();
@@ -3549,11 +3724,7 @@ var LocalInvocation = class _LocalInvocation extends Invocation {
   async runRemoteTaskOnHost(host, remoteTaskFn) {
     this.debug(`Run function on: ${chalk3.yellow(V.inspect(host.toObject()))}`);
     const interactionHandler = new InteractionHandler(this.runtime.app.getSecretsForHost(host.hostname));
-    const remoteRuntime = new RemoteRuntime(
-      this.runtime.app,
-      host,
-      interactionHandler
-    );
+    const remoteRuntime = new RemoteRuntime(this.runtime.app, host, interactionHandler);
     try {
       const connected = await remoteRuntime.connect();
       if (!connected) {
@@ -3640,17 +3811,7 @@ var LocalRuntime = class {
     this.localBundlePath = localBundlePath;
     this.interactionHandler = interactionHandler;
     const appConfigInstance = this.app.config;
-    if (appConfigInstance instanceof ConfigFile2) {
-      this.host = new Host(appConfigInstance, { hostname: "localhost", alias: "localhost" });
-    } else {
-      const configType = appConfigInstance?.constructor?.name || typeof appConfigInstance;
-      this.app.error(
-        `CRITICAL ERROR: LocalRuntime could not initialize its 'localhost' Host object. The application's configuration (type: ${configType}) is not a file-based configuration (expected ConfigFile).`
-      );
-      throw new Error(
-        `LocalRuntime init failed: Expected app.config to be an instance of ConfigFile for 'localhost' Host, but got ${configType}.`
-      );
-    }
+    this.host = new Host(appConfigInstance, { hostname: "localhost", alias: "localhost" });
     this.config = {
       cwd: process.cwd(),
       configFile: appConfigInstance instanceof ConfigFile2 ? appConfigInstance : void 0
@@ -3667,7 +3828,7 @@ var LocalRuntime = class {
     if (this.memoizedPassword) {
       return this.memoizedPassword;
     }
-    this.memoizedPassword = await this.app.promptPassword("Enter local sudo password:");
+    this.memoizedPassword = await this.app.promptPasswordInteractively("Enter local sudo password:");
     return this.memoizedPassword;
   }
   async getSecret(name) {
@@ -3727,7 +3888,7 @@ var LocalRuntime = class {
 
 // src/node-runtime.ts
 import os3 from "os";
-import axios from "axios";
+import axios2 from "axios";
 import * as cheerio from "cheerio";
 import { match as match3 } from "ts-pattern";
 import which from "which";
@@ -3819,7 +3980,7 @@ async function decompressZip(inputPath, outputPath, dropRootDir = 1) {
 var NodeRuntime = class _NodeRuntime {
   constructor(tmpDir) {
     this.tmpDir = tmpDir;
-    this.client = axios.create({
+    this.client = axios2.create({
       baseURL: "https://nodejs.org/"
     });
     this.alreadyInstalled = false;
@@ -3904,9 +4065,9 @@ var NodeRuntime = class _NodeRuntime {
       throw new Error(`Unable to download node for ${os3}/${arch} OS/architecture`);
     }
     const filename = File.basename(url);
-    const path5 = this.tmpDir.join(filename);
-    if (path5.exists()) return path5.toString();
-    return await downloadFile(url, path5.toString());
+    const path8 = this.tmpDir.join(filename);
+    if (path8.exists()) return path8.toString();
+    return await downloadFile(url, path8.toString());
   }
   // returns the path to the unzipped package directory
   async unzipPackage(packagePath) {
@@ -4039,12 +4200,18 @@ var ParamMap = class _ParamMap {
     }
     return match4(str).when(matches(/,/), (s) => {
       return VP(s.split(",")).map((v) => v.trim()).compact([""]).map((v) => this.stringToJsonObj(v)).value;
-    }).when(isNumeric, (s) => parseFloat(s)).when((s) => s.trim() === "", () => "").otherwise(() => str);
+    }).when(isNumeric, (s) => parseFloat(s)).when(
+      (s) => s.trim() === "",
+      () => ""
+    ).otherwise(() => str);
   }
 };
 
+// src/runtime.ts
+import * as z from "zod";
+
 // src/version.ts
-var version = "0.1.41";
+var version = "0.1.44";
 
 // src/app.ts
 import { retryUntilDefined } from "ts-retry";
@@ -4052,6 +4219,13 @@ import { Mutex as Mutex3 } from "async-mutex";
 import { match as match5 } from "ts-pattern";
 
 // src/core/remote/runAllRemote.ts
+var RunParamsSchema = z.object({
+  taskFn: z.custom((value) => typeof value === "function", {
+    message: "taskFn must be a function"
+  }),
+  params: z.any()
+});
+var RunResultSchema = z.record(z.string(), z.any());
 function serializeError(value) {
   if (value instanceof Error) {
     const err = value;
@@ -4097,7 +4271,9 @@ async function run(context) {
   return Object.fromEntries(normalizedEntries);
 }
 var runAllRemote_default = task(run, {
-  description: "run a task on all selected hosts"
+  description: "run a task on all selected hosts",
+  inputSchema: RunParamsSchema,
+  outputSchema: RunResultSchema
 });
 
 // src/commands/pkg/package-manager.ts
@@ -4127,6 +4303,19 @@ var PackageManager = class {
   async saveManifest() {
     await fs6.writeFile(this.manifestPath.toString(), JSON.stringify(this.manifest, null, 2));
   }
+  isLocalPath(source) {
+    if (source.startsWith("file:")) {
+      return true;
+    }
+    if (source.startsWith("./") || source.startsWith("../") || source.startsWith("~")) {
+      return true;
+    }
+    if (/[a-zA-Z]:\\/.test(source) || source.includes("\\")) {
+      return true;
+    }
+    const path8 = Path.new(source);
+    return path8.isAbsolute() || path8.exists();
+  }
   // Normalize git URLs to npm-compatible format
   normalizeSource(source) {
     if ((source.includes("github.com") || source.includes("gitlab.com") || source.includes("bitbucket.org")) && source.startsWith("http://") && !source.startsWith("git@") && !source.startsWith("git+ssh://") && !source.startsWith("git+https://")) {
@@ -4206,15 +4395,20 @@ var PackageManager = class {
     if (packageInfo) {
       const packagePath = Path.new(packageInfo.path);
       if (taskName) {
-        const taskPath = await this.findTaskInPackage(packagePath, taskName);
-        if (taskPath) {
-          return { packagePath: packagePath.toString(), taskPath };
+        const resolved = await this.findTaskInPackage(packagePath, taskName);
+        if (resolved) {
+          return { packagePath: packagePath.toString(), taskPath: resolved.taskPath };
         }
       } else {
         const defaultTaskPath = await this.findDefaultTask(packagePath);
         if (defaultTaskPath) {
           return { packagePath: packagePath.toString(), taskPath: defaultTaskPath };
         }
+        const discovered = await this.discoverTasks(packagePath);
+        if (discovered.length === 1) {
+          const onlyTask = discovered[0];
+          return { packagePath: packagePath.toString(), taskPath: onlyTask.path };
+        }
       }
     }
     return null;
@@ -4325,18 +4519,15 @@ var PackageManager = class {
    * Find a specific task in a package
    */
   async findTaskInPackage(packagePath, taskName) {
-    const packageInfo = this.manifest.packages.find((pkg) => pkg.path === packagePath.toString());
-    if (packageInfo?.tasks) {
-      const task2 = packageInfo.tasks.find((t) => t.name === taskName);
-      if (task2) {
-        return task2.path;
-      }
+    const taskFiles = [`${taskName}.ts`, `${taskName}.js`];
+    if (taskName.includes(".")) {
+      const dottedPath = taskName.replace(/\./g, "/");
+      taskFiles.push(`${dottedPath}.ts`, `${dottedPath}.js`);
     }
-    const taskFiles = ["index.ts", "index.js", `${taskName}.ts`, `${taskName}.js`];
     for (const file of taskFiles) {
       const taskPath = packagePath.join(file);
       if (await taskPath.exists()) {
-        return taskPath.toString();
+        return { taskPath: taskPath.toString() };
       }
     }
     return null;
@@ -4344,6 +4535,11 @@ var PackageManager = class {
   async installPackage(source) {
     try {
       await this.loadManifest();
+      if (this.isLocalPath(source)) {
+        throw new Error(
+          `Local directories and files are not installable. Run them directly with 'hostctl run ${source} ...' or publish to npm/git and install that package.`
+        );
+      }
       const normalizedSource = this.normalizeSource(source);
       const packagesDir = this.app.packagesDir();
       await fs6.mkdir(packagesDir.toString(), { recursive: true });
@@ -4363,12 +4559,11 @@ var PackageManager = class {
         return installResult;
       }
       const packagePath = Path.new(installResult.installPath);
-      const { packageInfo, tasks } = await this.getPackageInfoAndTasks(packagePath, installResult.packageInfo.name);
+      const packageInfo = await this.getPackageInfo(packagePath, installResult.packageInfo.name);
       const finalPackageInfo = {
         ...installResult.packageInfo,
         ...packageInfo || {},
-        source: normalizedSource,
-        tasks
+        source: normalizedSource
       };
       await this.handleDuplicateNames(finalPackageInfo);
       this.manifest.packages.push(finalPackageInfo);
@@ -4405,7 +4600,10 @@ var PackageManager = class {
         installPath: packagesDir.join(_packageName).toString()
       };
     }
-    const { path: actualPackagePath, name: realPackageName } = await this.findRealInstalledNpmPackagePath(packagesDir, source);
+    const { path: actualPackagePath, name: realPackageName } = await this.findRealInstalledNpmPackagePath(
+      packagesDir,
+      source
+    );
     if (!actualPackagePath || !realPackageName) {
       return {
         success: false,
@@ -4482,11 +4680,6 @@ var PackageManager = class {
     }
     return { path: null, name: null };
   }
-  async getPackageInfoAndTasks(packagePath, fallbackName) {
-    const packageInfo = await this.getPackageInfo(packagePath, fallbackName);
-    const tasks = await this.discoverTasks(packagePath);
-    return { packageInfo, tasks };
-  }
   async handleDuplicateNames(finalPackageInfo) {
     const actualPackageName = finalPackageInfo.name;
     if (this.hasPackageWithName(actualPackageName)) {
@@ -4531,6 +4724,89 @@ var PackageManager = class {
   }
 };
 
+// src/task-registry-loader.ts
+import { promises as fs7 } from "fs";
+import path4 from "path";
+import { pathToFileURL } from "url";
+function resolveExportsEntry(exportsField) {
+  if (!exportsField) return void 0;
+  if (typeof exportsField === "string") return exportsField;
+  if (typeof exportsField !== "object") return void 0;
+  const root = exportsField["."] ?? exportsField;
+  if (typeof root === "string") return root;
+  if (typeof root !== "object" || !root) return void 0;
+  const rootRecord = root;
+  if (typeof rootRecord.import === "string") return rootRecord.import;
+  if (typeof rootRecord.default === "string") return rootRecord.default;
+  return void 0;
+}
+async function readPackageJson(packagePath) {
+  const packageJsonPath = path4.join(packagePath, "package.json");
+  try {
+    const raw = await fs7.readFile(packageJsonPath, "utf8");
+    return JSON.parse(raw);
+  } catch {
+    return null;
+  }
+}
+async function fileExists(filePath) {
+  try {
+    const stat = await fs7.stat(filePath);
+    return stat.isFile();
+  } catch {
+    return false;
+  }
+}
+async function resolvePackageEntries(packagePath) {
+  const pkg = await readPackageJson(packagePath);
+  if (!pkg) return [];
+  const candidates = [
+    resolveExportsEntry(pkg.exports),
+    pkg.module,
+    pkg.main,
+    "src/index.ts",
+    "src/index.js",
+    "src/index.mjs",
+    "src/index.cjs",
+    "index.ts",
+    "index.js",
+    "index.mjs",
+    "index.cjs"
+  ].filter((candidate) => typeof candidate === "string" && candidate.length > 0);
+  const entries = [];
+  const seen = /* @__PURE__ */ new Set();
+  for (const candidate of candidates) {
+    const resolved = path4.isAbsolute(candidate) ? candidate : path4.resolve(packagePath, candidate);
+    if (seen.has(resolved)) continue;
+    seen.add(resolved);
+    if (await fileExists(resolved)) {
+      entries.push(resolved);
+    }
+  }
+  return entries;
+}
+function isRegistryLike(candidate) {
+  return !!candidate && typeof candidate === "object" && typeof candidate.get === "function" && typeof candidate.tasks === "function" && typeof candidate.register === "function";
+}
+async function loadRegistryFromPackage(packagePath) {
+  const entries = await resolvePackageEntries(packagePath);
+  if (entries.length === 0) {
+    return null;
+  }
+  for (const entry of entries) {
+    try {
+      const mod = await import(pathToFileURL(entry).href);
+      const registry = mod.registry;
+      if (isRegistryLike(registry)) {
+        return registry;
+      }
+    } catch {
+      continue;
+    }
+  }
+  return null;
+}
+
 // src/cli/resolve-task-and-args.ts
 async function resolveTaskPathAndArgs(app, pkgTaskArgs) {
   app.debug("resolveTaskPathAndArgs", pkgTaskArgs);
@@ -4562,6 +4838,13 @@ async function resolveTaskPathAndArgs(app, pkgTaskArgs) {
   if (localTaskResult) {
     return localTaskResult;
   }
+  if (looksLikeLocalPath(packageRef)) {
+    const missingPath = Path.new(packageRef);
+    const localReason = missingPath.exists() ? `local path is not a supported task entry: ${missingPath.toString()}` : `local path not found: ${missingPath.toString()}`;
+    throw new Error(
+      `Could not resolve task: ${localReason}. Local directories are run directly (no install); double-check the path or publish the package to npm/git.`
+    );
+  }
   const packageManager = new PackageManager(app);
   const remoteTaskResult = await resolveRemoteTask(app, packageManager, packageRef, scriptRef, scriptArgs);
   if (remoteTaskResult) {
@@ -4570,33 +4853,44 @@ async function resolveTaskPathAndArgs(app, pkgTaskArgs) {
   throw new Error(`Could not resolve task: ${packageRef}${scriptRef ? `:${scriptRef}` : ""}`);
 }
 async function resolveCoreTask(packageRef, scriptRef, scriptArgs) {
-  if (packageRef.startsWith("core.")) {
-    const taskPath = packageRef.replace(/^core\./, "").replace(/\./g, "/");
-    const scriptPath = `src/core/${taskPath}.ts`;
+  const prefixMap = [
+    { prefix: "core.", buildPath: (tail) => `src/core/${tail}.ts` },
+    { prefix: "host.", buildPath: (tail) => `src/core/host/${tail}.ts` }
+  ];
+  for (const entry of prefixMap) {
+    if (!packageRef.startsWith(entry.prefix)) {
+      continue;
+    }
+    const tail = packageRef.slice(entry.prefix.length).replace(/\./g, "/");
+    const scriptPath = entry.buildPath(tail);
     const taskFile = Path.new(scriptPath);
     if (!taskFile.exists()) {
-      throw new Error("Core task script not found");
+      throw new Error(`Could not resolve task: Core task script not found (${packageRef}).`);
     }
-    return { scriptRef: scriptPath, scriptArgs };
+    return { kind: "script", scriptRef: scriptPath, scriptArgs };
   }
   return null;
 }
-async function resolveLocalTask(app, path5, scriptRef, scriptArgs) {
-  if (isGitUrl(path5) || isNpmPackageName(path5)) {
+async function resolveLocalTask(app, path8, scriptRef, scriptArgs) {
+  if (isGitUrl(path8) || isNpmPackageName(path8)) {
     return null;
   }
-  const pathObj = Path.new(path5);
+  const pathObj = Path.new(path8);
   if (!pathObj.exists()) {
     return null;
   }
   if (pathObj.isDirectory()) {
+    const registryTask = await resolveRegistryTask(pathObj.absolute().toString(), scriptRef);
+    if (registryTask) {
+      return { kind: "registry", task: registryTask, scriptArgs };
+    }
     return await handleDirectory(pathObj, scriptRef, scriptArgs);
   }
   if (pathObj.isFile() && (pathObj.ext() === ".ts" || pathObj.ext() === ".js")) {
     if (scriptRef) {
       A2(scriptArgs).prepend(scriptRef);
     }
-    return { scriptRef: pathObj.toString(), scriptArgs };
+    return { kind: "script", scriptRef: pathObj.toString(), scriptArgs };
   }
   return null;
 }
@@ -4618,19 +4912,47 @@ function isNpmPackageName(str) {
   }
   return true;
 }
+function looksLikeLocalPath(ref) {
+  if (ref.startsWith("file:")) {
+    return true;
+  }
+  if (ref === "." || ref === "..") {
+    return true;
+  }
+  if (ref.startsWith("./") || ref.startsWith("../") || ref.startsWith("~") || ref.startsWith("/")) {
+    return true;
+  }
+  if (/[a-zA-Z]:\\/.test(ref) || ref.includes("\\")) {
+    return true;
+  }
+  return false;
+}
 async function resolveRemoteTask(app, packageManager, packageRef, scriptRef, scriptArgs) {
   const isInstalled = await packageManager.isPackageInstalled(packageRef);
   if (!isInstalled) {
     const installResult = await packageManager.installPackage(packageRef);
     if (!installResult.success) {
-      return null;
+      const installError = installResult.error ? ` (${installResult.error})` : "";
+      throw new Error(
+        `Could not resolve task: failed to install npm/git package '${packageRef}'. Local directories are run directly; otherwise provide a valid npm package name or git URL${installError}.`
+      );
     }
   }
+  const installed = await packageManager.getPackageByIdentifier(packageRef);
+  if (!installed) {
+    throw new Error(`Could not resolve task: installed package '${packageRef}' not found in manifest.`);
+  }
+  const registryTask = await resolveRegistryTask(installed.path, scriptRef);
+  if (registryTask) {
+    return { kind: "registry", task: registryTask, scriptArgs };
+  }
   const result = await packageManager.resolveTaskPath(packageRef, scriptRef);
   if (result) {
-    return { scriptRef: result.taskPath, scriptArgs };
+    return { kind: "script", scriptRef: result.taskPath, scriptArgs };
   }
-  return null;
+  throw new Error(
+    `Could not resolve task: installed package '${packageRef}' but could not find ${scriptRef ? `task '${scriptRef}'` : "a default task"}.`
+  );
 }
 async function handleDirectory(dirPath, scriptRef, scriptArgs) {
   if (scriptRef) {
@@ -4640,23 +4962,62 @@ async function handleDirectory(dirPath, scriptRef, scriptArgs) {
     const tsPath = taskDir ? dirPath.join(taskDir, `${taskFileName}.ts`) : dirPath.join(`${taskFileName}.ts`);
     const jsPath = taskDir ? dirPath.join(taskDir, `${taskFileName}.js`) : dirPath.join(`${taskFileName}.js`);
     if (tsPath.exists()) {
-      return { scriptRef: tsPath.toString(), scriptArgs };
+      return { kind: "script", scriptRef: tsPath.toString(), scriptArgs };
     }
     if (jsPath.exists()) {
-      return { scriptRef: jsPath.toString(), scriptArgs };
+      return { kind: "script", scriptRef: jsPath.toString(), scriptArgs };
     }
     const resolvedPath = dirPath.resolve(scriptRef);
-    return { scriptRef: resolvedPath.toString(), scriptArgs };
+    return { kind: "script", scriptRef: resolvedPath.toString(), scriptArgs };
   }
   const defaultFiles = ["index.ts", "index.js", "main.ts", "main.js"];
   for (const file of defaultFiles) {
     const filePath = dirPath.join(file);
     if (filePath.exists()) {
-      return { scriptRef: filePath.toString(), scriptArgs };
+      return { kind: "script", scriptRef: filePath.toString(), scriptArgs };
     }
   }
   throw new Error(`No default entry point found in directory: ${dirPath}`);
 }
+async function resolveRegistryTask(packagePath, taskName) {
+  const registry = await loadRegistryFromPackage(packagePath);
+  if (!registry) return null;
+  if (taskName) {
+    const task2 = registry.get(taskName);
+    if (!task2) {
+      const names2 = registryNames(registry);
+      const hint2 = names2.length ? ` Available tasks: ${names2.join(", ")}` : "";
+      throw new Error(`Task '${taskName}' not found in registry.${hint2}`);
+    }
+    if (task2.task) {
+      task2.task.name = taskName;
+    }
+    return task2;
+  }
+  const tasks = registry.tasks();
+  if (tasks.length === 1) {
+    const [name, task2] = tasks[0];
+    if (task2.task) {
+      task2.task.name = name;
+    }
+    return task2;
+  }
+  const names = registryNames(registry);
+  const hint = names.length ? `: ${names.join(", ")}` : "";
+  throw new Error(`Package exports ${registrySize(registry)} tasks; specify one${hint}.`);
+}
+function registryNames(registry) {
+  if (typeof registry.names === "function") {
+    return registry.names();
+  }
+  return registry.tasks().map(([name]) => name);
+}
+function registrySize(registry) {
+  if (typeof registry.size === "function") {
+    return registry.size();
+  }
+  return registry.tasks().length;
+}
 
 // src/app.ts
 var TaskTree = class {
@@ -4729,29 +5090,42 @@ var TaskTree = class {
 };
 var App3 = class _App {
   static async loadApiMode(options) {
-    return _App.load({ ...options, outputStyle: "api" });
+    return _App.load({ ...options, outputStyle: "api", interactive: options.interactive ?? false });
   }
   static async load(options) {
     const app = new _App();
-    await app.loadConfig(options.config);
+    app.setInteractive(options.interactive ?? true);
+    if (options.password !== void 0) {
+      const provider2 = typeof options.password === "function" ? options.password : async () => options.password;
+      app.setPasswordProvider(provider2);
+    }
+    const provider = options.configProvider ?? await app.resolveConfigProvider(options.config, {
+      token: options.configToken,
+      headers: options.configHeaders
+    });
+    await app.loadConfigFromProvider(provider);
     app.setVerbosity(options.verbosity ?? Verbosity.WARN);
     app.setOutputStyle(options.outputStyle ?? "plain");
     return app;
   }
   configRef;
+  configProvider;
   _config;
-  selectedTags;
+  hostSelector;
   outputStyle;
   _tmpDir;
   tmpFileRegistry;
   taskTree;
   verbosity = Verbosity.ERROR;
+  passwordProvider;
+  providedPassword;
+  interactive = true;
   constructor() {
     this.taskTree = new TaskTree();
-    this.selectedTags = /* @__PURE__ */ new Set([]);
     this.outputStyle = "plain";
     this.tmpFileRegistry = new TmpFileRegistry(this.hostctlTmpDir());
     this.configRef = void 0;
+    this.hostSelector = void 0;
     process3.on("exit", (code) => this.appExitCallback());
   }
   appExitCallback() {
@@ -4764,16 +5138,25 @@ var App3 = class _App {
   }
   get tmpDir() {
     if (!this._tmpDir) {
-      if (!fs7.existsSync(this.hostctlDir().toString())) {
-        fs7.mkdirSync(this.hostctlDir().toString(), { recursive: true });
+      if (!fs8.existsSync(this.hostctlDir().toString())) {
+        fs8.mkdirSync(this.hostctlDir().toString(), { recursive: true });
       }
       this._tmpDir = this.createNamedTmpDir(version);
     }
     return this._tmpDir;
   }
-  async loadConfig(configRef) {
-    this.configRef = this.deriveConfigRef(configRef);
-    this._config = await load(this.configRef);
+  async loadConfig(configRef, auth) {
+    const provider = await this.resolveConfigProvider(configRef, auth);
+    await this.loadConfigFromProvider(provider);
+  }
+  async loadConfigFromProvider(provider) {
+    this.configProvider = provider;
+    if (provider instanceof FileConfigProvider) {
+      this.configRef = provider.path;
+    } else {
+      this.configRef = "provider";
+    }
+    this._config = await ProviderConfig.load(provider);
   }
   isValidUrl(url) {
     try {
@@ -4795,7 +5178,7 @@ var App3 = class _App {
     if (homeConfigPath.isFile()) {
       return homeConfigPath.toString();
     }
-    if (configRef && this.isValidUrl(configRef)) {
+    if (configRef) {
       return configRef;
     }
     throw new Error(
@@ -4807,6 +5190,40 @@ var App3 = class _App {
       console.log(...args);
     }
   }
+  async resolveConfigProvider(configRef, auth) {
+    if (configRef && Path.new(configRef).isFile()) {
+      return new FileConfigProvider(Path.new(configRef).toString());
+    }
+    const derived = this.deriveConfigRef(configRef);
+    if (Path.new(derived).isFile()) {
+      return new FileConfigProvider(Path.new(derived).toString());
+    }
+    if (this.isValidUrl(derived)) {
+      const headers = this.buildHttpConfigHeaders(auth);
+      return new HttpConfigProvider({
+        url: derived,
+        format: derived.endsWith(".yaml") ? "yaml" : "json",
+        headers
+      });
+    }
+    throw new Error(`Could not resolve a configuration provider for reference: ${configRef ?? "(none)"}`);
+  }
+  buildHttpConfigHeaders(auth) {
+    if (!auth?.headers && !auth?.token) return void 0;
+    const headers = {};
+    const token = auth?.token;
+    const rawHeaders = auth?.headers ?? {};
+    for (const [key, value] of Object.entries(rawHeaders)) {
+      if (token && key.toLowerCase() === "authorization") {
+        continue;
+      }
+      headers[key] = value;
+    }
+    if (token) {
+      headers.Authorization = `Bearer ${token}`;
+    }
+    return headers;
+  }
   debug(...args) {
     this.log(Verbosity.DEBUG, ...args);
   }
@@ -4852,7 +5269,7 @@ var App3 = class _App {
   }
   shouldRunRemote() {
     const selectedHosts = this.selectedInventory();
-    if (selectedHosts.length === 0 && this.selectedTags.size === 0) return false;
+    if (selectedHosts.length === 0 && !this.hostSelector) return false;
     return selectedHosts.some((h) => !h.isLocal());
   }
   logHostCommandResult(host, command, cmdOrErr, isErrorResult = false) {
@@ -4951,21 +5368,23 @@ ${cmdRes.stderr.trim()}`));
     }
   }
   /**
-  * Builds the hosts record from host result quads
-  */
+   * Builds the hosts record from host result quads
+   */
   buildHostsRecord(hostResultQuads) {
     const hosts = {};
-    A2(hostResultQuads).each(([host, success, stdout, stderr, exitCode, signal]) => {
-      const key = host.alias || `${host.hostname}:${host.port}`;
-      hosts[key] = {
-        alias: host.alias || "",
-        success,
-        stdout,
-        stderr,
-        exitCode,
-        signal
-      };
-    });
+    A2(hostResultQuads).each(
+      ([host, success, stdout, stderr, exitCode, signal]) => {
+        const key = host.alias || `${host.hostname}:${host.port}`;
+        hosts[key] = {
+          alias: host.alias || "",
+          success,
+          stdout,
+          stderr,
+          exitCode,
+          signal
+        };
+      }
+    );
     return hosts;
   }
   /**
@@ -5063,8 +5482,31 @@ ${cmdRes.stderr.trim()}`));
       file: invocation.file
     };
   }
+  get selectedTags() {
+    return new Set(this.hostSelector?.tags ?? []);
+  }
   setSelectedTags(selectedTags) {
-    this.selectedTags = new Set(selectedTags);
+    this.setHostSelector({ tags: selectedTags });
+  }
+  setHostSelector(selector) {
+    if (!selector) {
+      this.hostSelector = void 0;
+      return;
+    }
+    const normalized = {
+      names: selector.names ? [...selector.names] : void 0,
+      tags: selector.tags ? [...selector.tags] : void 0
+    };
+    this.hostSelector = normalized;
+  }
+  getHostSelector() {
+    if (!this.hostSelector) {
+      return void 0;
+    }
+    return {
+      names: this.hostSelector.names ? [...this.hostSelector.names] : void 0,
+      tags: this.hostSelector.tags ? [...this.hostSelector.tags] : void 0
+    };
   }
   setOutputStyle(outputStyle) {
     this.outputStyle = outputStyle;
@@ -5073,6 +5515,17 @@ ${cmdRes.stderr.trim()}`));
     this.verbosity = level;
     return this.verbosity;
   }
+  setPasswordProvider(provider) {
+    this.passwordProvider = provider;
+    this.providedPassword = void 0;
+  }
+  setInteractive(interactive) {
+    this.interactive = interactive;
+    return this.interactive;
+  }
+  isInteractive() {
+    return this.interactive;
+  }
   outputApiMode() {
     return this.outputStyle == "api";
   }
@@ -5085,8 +5538,17 @@ ${cmdRes.stderr.trim()}`));
   querySelectedInventory(tags = /* @__PURE__ */ new Set()) {
     return this.selectInventory(this.selectedInventory(), tags);
   }
-  selectedInventory() {
-    return this.queryInventory(this.selectedTags);
+  selectedInventory(selector) {
+    if (Array.isArray(selector)) {
+      return this.queryInventory(new Set(selector));
+    }
+    if (selector && typeof selector === "object") {
+      return this.queryInventoryWithSelector(selector);
+    }
+    if (this.hostSelector) {
+      return this.queryInventoryWithSelector(this.hostSelector);
+    }
+    return this.queryInventory(/* @__PURE__ */ new Set());
   }
   // returns hosts that have *all* of the given tags
   // each tag is a string of the form:
@@ -5104,6 +5566,25 @@ ${cmdRes.stderr.trim()}`));
     }
     return this.selectInventory(allHosts, new Set(tags));
   }
+  queryInventoryWithSelector(selector) {
+    const tags = new Set(selector.tags ?? []);
+    const names = new Set((selector.names ?? []).map((n) => n.toLowerCase()));
+    const allHosts = this._config?.hosts() ?? [];
+    if (names.size === 0 && tags.size === 0) {
+      return allHosts;
+    }
+    return allHosts.filter((host) => {
+      const matchesName = names.size > 0 && (names.has(host.hostname.toLowerCase()) || names.has(host.alias.toLowerCase()));
+      const matchesTags = tags.size === 0 ? false : host.hasAnyTag(tags);
+      if (names.size > 0 && tags.size > 0) {
+        return matchesName || matchesTags;
+      }
+      if (names.size > 0) {
+        return matchesName;
+      }
+      return matchesTags;
+    });
+  }
   selectInventory(hosts, tags = /* @__PURE__ */ new Set()) {
     if (S(tags).isEmpty()) {
       return hosts;
@@ -5140,7 +5621,7 @@ ${cmdRes.stderr.trim()}`));
         allSecrets.forEach((secret, name) => {
           output += `  - ${name}:
 `;
-          output += `    encrypted: ${secret.value.isEncrypted()}
+          output += `    encrypted: ${Boolean(secret.ciphertext)}
 `;
         });
       } else {
@@ -5151,7 +5632,7 @@ ${cmdRes.stderr.trim()}`));
         allIds.forEach((idGroup, name) => {
           output += `  - ${name}:
 `;
-          output += `    publicKeys: ${idGroup.publicKeys.join(", ")}
+          output += `    publicKeys: ${idGroup.recipients().join(", ")}
 `;
         });
       } else {
@@ -5167,16 +5648,15 @@ ${cmdRes.stderr.trim()}`));
       allSecrets.forEach((secret, name) => {
         jsonData.secrets[name] = {
           name: secret.name,
-          encrypted: secret.value.isEncrypted()
+          encrypted: false
           // Consider if ids/recipients should be exposed here
         };
       });
       allIds.forEach((idGroup, name) => {
         jsonData.identities[name] = {
-          name: idGroup.name || name,
-          // Assuming NamedRecipientGroup has a name property
-          publicKeys: idGroup.publicKeys,
-          idRefs: idGroup.idRefs
+          name,
+          publicKeys: idGroup.recipients(),
+          idRefs: []
         };
       });
       console.log(JSON.stringify(jsonData, null, 2));
@@ -5184,24 +5664,20 @@ ${cmdRes.stderr.trim()}`));
   }
   // entrypoint for the cli: AGE_IDS=~/.secrets/age/test-david.priv tsx bin/hostctl.ts inventory encrypt
   async encryptInventoryFile() {
-    if (!this.configRef) {
-      throw new Error("Cannot encrypt inventory: Configuration file reference is not set.");
+    if (!(this.configProvider instanceof FileConfigProvider)) {
+      throw new Error("Encrypt is only supported for file-based configuration.");
     }
-    const currentConfigRef = this.configRef;
-    this.warn(`Encrypting inventory file: ${currentConfigRef}`);
-    const configFile = new ConfigFile2(currentConfigRef);
-    await configFile.load();
-    await configFile.encryptAll();
-    await configFile.save(currentConfigRef);
+    const cfg = await this.configProvider.getConfigFile();
+    this.warn(`Encrypting inventory file: ${this.configProvider.path}`);
+    await cfg.encryptAll();
+    await cfg.save(this.configProvider.path);
   }
   // entrypoint for the cli: AGE_IDS=~/.secrets/age/david.priv tsx bin/hostctl.ts inventory decrypt
   async decryptInventoryFile() {
-    if (!this.configRef) {
-      throw new Error("Cannot decrypt inventory: Configuration file reference is not set.");
+    if (!(this.configProvider instanceof FileConfigProvider)) {
+      throw new Error("Decrypt is only supported for file-based configuration.");
     }
-    const currentConfigRef = this.configRef;
-    const configFile = new ConfigFile2(currentConfigRef);
-    await configFile.load();
+    const configFile = await this.configProvider.getConfigFile();
     let hasEncryptedSecrets = false;
     for (const secret of configFile._secrets.values()) {
       if (secret.value.isEncrypted()) {
@@ -5213,12 +5689,12 @@ ${cmdRes.stderr.trim()}`));
       this.info("No encrypted secrets found to decrypt. Inventory is already decrypted.");
       return;
     }
-    this.warn(`Decrypting inventory file: ${currentConfigRef}`);
+    this.warn(`Decrypting inventory file: ${this.configProvider.path}`);
     try {
       await configFile.decryptAllIfPossible();
       const successfullyUsedIdentityPaths = configFile.loadPrivateKeys().filter((identity2) => {
         try {
-          return fs7.existsSync(identity2.identityFilePath);
+          return fs8.existsSync(identity2.identityFilePath);
         } catch (e) {
           return false;
         }
@@ -5229,7 +5705,8 @@ ${successfullyUsedIdentityPaths}`);
       } else if (this.verbosity >= Verbosity.INFO && hasEncryptedSecrets && successfullyUsedIdentityPaths.length === 0) {
         this.warn("Encrypted secrets found, but no specified AGE identities were successfully used or found.");
       }
-      await configFile.save(currentConfigRef);
+      const targetPath = this.configProvider instanceof FileConfigProvider ? this.configProvider.path : this.configRef || "hostctl.yaml";
+      await configFile.save(targetPath);
     } catch (error) {
       if (error.message?.includes("Unable to read identity file")) {
         throw new Error("Decryption failed: no identity matched or failed to decrypt due to key issue.");
@@ -5257,7 +5734,7 @@ ${successfullyUsedIdentityPaths}`);
       );
       return;
     }
-    const taskFn = mod.default;
+    const taskFn = this.resolveTaskFnFromModule(mod, absoluteScriptRef.toString());
     const interactionHandler = new InteractionHandler();
     const localRuntime = new LocalRuntime(this, absoluteScriptRef, interactionHandler);
     if (this.outputPlain()) {
@@ -5305,7 +5782,7 @@ ${successfullyUsedIdentityPaths}`);
       );
       return;
     }
-    const taskFn = mod.default;
+    const taskFn = this.resolveTaskFnFromModule(mod, absoluteScriptRef.toString());
     const interactionHandler = new InteractionHandler();
     const localRuntime = new LocalRuntime(this, absoluteScriptRef, interactionHandler);
     this.info(`run: ${chalk4.yellow(absoluteScriptRef.toString())} ${chalk4.cyan(util2.inspect(params))}`);
@@ -5339,6 +5816,58 @@ ${successfullyUsedIdentityPaths}`);
     }
     return scriptResult;
   }
+  async runTaskDefinition(taskFn, params, options) {
+    const selectedHosts = this.selectedInventory();
+    this.info(`Selected hosts: ${selectedHosts.length}`);
+    const modulePath = taskFn.task.taskModuleAbsolutePath || taskFn.task.name || process3.cwd();
+    const absoluteScriptRef = Path.new(modulePath).absolute();
+    const packageFileDir = this.pathOfPackageJsonFile(absoluteScriptRef.toString());
+    if (!packageFileDir) {
+      console.error(
+        chalk4.red(`Bundle failure. "${absoluteScriptRef}" nor any ancestor directory contains a package.json file.`)
+      );
+      return void 0;
+    }
+    const interactionHandler = new InteractionHandler();
+    const localRuntime = new LocalRuntime(this, absoluteScriptRef, interactionHandler);
+    const description = options?.remote ? `Running ${taskFn.task.name || absoluteScriptRef.toString()} on selected hosts` : `Running ${taskFn.task.name || absoluteScriptRef.toString()}`;
+    let invocation;
+    let scriptResult;
+    try {
+      if (options?.remote) {
+        const remoteParams = {
+          taskFn,
+          params
+        };
+        invocation = await localRuntime.invokeRootTask(
+          runAllRemote_default,
+          remoteParams,
+          description
+        );
+      } else {
+        invocation = await localRuntime.invokeRootTask(taskFn, params, description);
+      }
+      if (!invocation) {
+        this.error(`Failed to invoke task: ${taskFn.task.name || absoluteScriptRef.toString()}`);
+        scriptResult = new Error(`Failed to invoke task: ${taskFn.task.name || absoluteScriptRef.toString()}`);
+      } else {
+        scriptResult = await invocation.result;
+        this.reportScriptResult(invocation, scriptResult);
+      }
+    } catch (e) {
+      scriptResult = e;
+      if (this.outputPlain()) {
+        this.error(`Error running task ${taskFn.task.name || absoluteScriptRef.toString()}: ${scriptResult.message}`);
+        if (this.verbosity >= Verbosity.DEBUG && scriptResult.stack) {
+          this.error(scriptResult.stack);
+        }
+      }
+      if (invocation) {
+        this.reportScriptResult(invocation, scriptResult);
+      }
+    }
+    return scriptResult;
+  }
   async walkInvocationTreePreorder(invocation, visitFn, visited = /* @__PURE__ */ new Set(), depth = 0) {
     if (visited.has(invocation)) return;
     visited.add(invocation);
@@ -5421,13 +5950,60 @@ ${successfullyUsedIdentityPaths}`);
     const mod = await import(scriptRef);
     return mod;
   }
+  isTaskInstanceLike(candidate) {
+    return !!candidate && typeof candidate === "object" && "runFn" in candidate && typeof candidate.runFn === "function";
+  }
+  wrapTaskInstance(taskInstance) {
+    const taskFnObject = function(params) {
+      return function(parentInvocation) {
+        return parentInvocation.invokeChildTask(taskFnObject, params ?? {});
+      };
+    };
+    Object.assign(taskFnObject, { task: taskInstance });
+    return taskFnObject;
+  }
+  isTaskFnLike(candidate) {
+    if (typeof candidate !== "function") {
+      return false;
+    }
+    const task2 = candidate.task;
+    return typeof task2 === "object" && task2 !== null;
+  }
+  isTaskExport(candidate) {
+    return this.isTaskFnLike(candidate) || candidate instanceof Task || this.isTaskInstanceLike(candidate);
+  }
+  resolveTaskExport(candidate) {
+    if (this.isTaskFnLike(candidate)) {
+      return candidate;
+    }
+    if (candidate instanceof Task || this.isTaskInstanceLike(candidate)) {
+      return this.wrapTaskInstance(candidate);
+    }
+    return void 0;
+  }
+  resolveTaskFnFromModule(mod, modulePath) {
+    const exports = Object.entries(mod ?? {});
+    const taskExports = exports.filter(([, exported]) => this.isTaskExport(exported));
+    const defaultTask = this.resolveTaskExport(mod.default);
+    if (!defaultTask) {
+      const namedTasks = taskExports.filter(([key]) => key !== "default").map(([key]) => key);
+      const hint = namedTasks.length ? ` Found named task exports: ${namedTasks.join(", ")}.` : "";
+      throw new Error(`Task module ${modulePath} must export a default task.${hint}`);
+    }
+    const namedTaskExports = taskExports.filter(([key]) => key !== "default");
+    if (namedTaskExports.length > 0) {
+      const names = namedTaskExports.map(([key]) => key).join(", ");
+      this.warn(`Task module ${modulePath} exports multiple tasks (${names}). Only the default export is used.`);
+    }
+    return defaultTask;
+  }
   parseParams(scriptArgs) {
     return ParamMap.parse(scriptArgs).toObject();
   }
   // walks the directory tree that contains the given path from leaf to root searching for the deepest directory
   // containing a package.json file and returns the absolute path of that directory
-  pathOfPackageJsonFile(path5) {
-    let p = Path.new(path5);
+  pathOfPackageJsonFile(path8) {
+    let p = Path.new(path8);
     while (true) {
       if (p.dirContains("package.json")) {
         return p.absolute();
@@ -5447,8 +6023,23 @@ ${successfullyUsedIdentityPaths}`);
     };
     this.info(reportObj);
   }
-  async promptPassword(message = "Enter your password") {
-    return await promptPassword({ message });
+  async promptPasswordInteractively(message = "Enter your password") {
+    if (this.providedPassword !== void 0) {
+      return this.providedPassword;
+    }
+    if (this.passwordProvider) {
+      this.providedPassword = await this.passwordProvider();
+      if (this.providedPassword !== void 0) {
+        return this.providedPassword;
+      }
+    }
+    if (!this.interactive) {
+      throw new Error(
+        "Password requested but App is in non-interactive mode. Provide LoadAppOptions.password or allow prompts by setting interactive:true."
+      );
+    }
+    this.providedPassword = await promptPassword({ message });
+    return this.providedPassword;
   }
   async installRuntime() {
     this.info(`creating node runtime with ${this.tmpDir.toString()}`);
@@ -5482,197 +6073,374 @@ ${successfullyUsedIdentityPaths}`);
     if (options.task) {
       pkgTaskArgs.push(options.task);
     }
-    const { scriptRef } = await resolveTaskPathAndArgs(this, pkgTaskArgs);
+    const resolved = await resolveTaskPathAndArgs(this, pkgTaskArgs);
     if (options.hostTags) {
       this.setSelectedTags(options.hostTags);
     }
+    if (resolved.kind === "registry") {
+      return await this.runTaskDefinition(resolved.task, options.params, { remote: options.remote });
+    }
     if (options.remote) {
-      return await this.runScriptRemote(scriptRef, options.params);
-    } else {
-      return await this.runScript(scriptRef, options.params);
+      return await this.runScriptRemote(resolved.scriptRef, options.params);
     }
+    return await this.runScript(resolved.scriptRef, options.params);
   }
 };
 
 // src/commands/pkg/create.ts
-import { promises as fs8 } from "fs";
-import path4 from "path";
+import { promises as fs9 } from "fs";
+import os4 from "os";
+import path5 from "path";
+function expandTildePath(input) {
+  if (!input.startsWith("~")) return input;
+  if (input === "~") return os4.homedir();
+  if (input.startsWith("~/") || input.startsWith("~\\")) {
+    return path5.join(os4.homedir(), input.slice(2));
+  }
+  return input;
+}
 var packageJsonTsTemplate = (packageName) => `{
   "name": "${packageName}",
-  "version": "1.0.0",
-  "description": "A hostctl task",
+  "version": "0.1.0",
+  "description": "hostctl task package",
   "type": "module",
-  "main": "dist/index.js",
+  "main": "./dist/index.js",
+  "module": "./dist/index.js",
+  "types": "./dist/index.d.ts",
+  "exports": {
+    ".": {
+      "import": "./dist/index.js",
+      "types": "./dist/index.d.ts",
+      "default": "./dist/index.js"
+    }
+  },
+  "files": ["dist", "src", "README.md", "LICENSE"],
   "scripts": {
-    "build": "tsc"
+    "build": "tsc -p tsconfig.json"
   },
   "keywords": ["hostctl"],
   "author": "",
   "license": "MIT",
   "dependencies": {
-    "hostctl": "latest"
+    "hostctl": "^0.1.42",
+    "zod": "^4.1.13"
   },
   "devDependencies": {
-    "typescript": "^5.0.0",
-    "@types/node": "latest"
+    "typescript": "^5.8.3",
+    "@types/node": "^24.0.0"
+  },
+  "engines": {
+    "node": ">=24"
+  },
+  "publishConfig": {
+    "access": "public"
   }
 }
 `;
 var packageJsonJsTemplate = (packageName) => `{
   "name": "${packageName}",
-  "version": "1.0.0",
-  "description": "A hostctl task",
+  "version": "0.1.0",
+  "description": "hostctl task package",
   "type": "module",
-  "main": "index.js",
+  "main": "./src/index.js",
+  "module": "./src/index.js",
+  "exports": {
+    ".": {
+      "import": "./src/index.js",
+      "default": "./src/index.js"
+    }
+  },
+  "files": ["src", "README.md", "LICENSE"],
   "scripts": {},
   "keywords": ["hostctl"],
   "author": "",
   "license": "MIT",
   "dependencies": {
-    "hostctl": "latest"
+    "hostctl": "^0.1.42",
+    "zod": "^4.1.13"
+  },
+  "engines": {
+    "node": ">=24"
+  },
+  "publishConfig": {
+    "access": "public"
   }
 }
 `;
 var tsconfigTemplate = `{
   "compilerOptions": {
-    "target": "ES2020",
-    "module": "ESNext",
-    "moduleResolution": "node",
+    "target": "ES2022",
+    "module": "NodeNext",
+    "moduleResolution": "NodeNext",
+    "rootDir": "src",
+    "outDir": "dist",
+    "declaration": true,
+    "declarationMap": true,
+    "sourceMap": true,
     "strict": true,
     "esModuleInterop": true,
     "skipLibCheck": true,
-    "forceConsistentCasingInFileNames": true,
-    "outDir": "./dist"
+    "forceConsistentCasingInFileNames": true
   },
-  "include": ["*.ts"],
+  "include": ["src/**/*.ts"],
   "exclude": ["node_modules", "dist"]
 }
 `;
-var indexTsTemplate = (packageName) => {
-  const sanitizedName = packageName.replace(/[^a-zA-Z0-9]/g, "").replace(/^[0-9]/, "_$&");
-  const interfaceName = sanitizedName.charAt(0).toUpperCase() + sanitizedName.slice(1);
-  return `import { task, type TaskContext, Verbosity, type LogLevel } from 'hostctl';
-
-export interface ${interfaceName}Params {
-  // Define your parameters here
-  message?: string;
+function registryPrefixFromPackageName(packageName) {
+  const withoutScope = packageName.replace(/^@[^/]+\//, "");
+  const withoutPrefix = withoutScope.replace(/^hostctl[-_]?/, "");
+  const normalized = withoutPrefix.replace(/[^a-zA-Z0-9]+/g, ".").replace(/^\.|\.$/g, "");
+  return normalized || "example";
 }
+var indexTsTemplate = (registryPrefix) => `import { createRegistry } from './registry.js';
+import hello from './tasks/hello.js';
 
-export interface ${interfaceName}Result {
-  success: boolean;
-  message: string;
-}
-
-async function run(context: TaskContext<${interfaceName}Params>): Promise<${interfaceName}Result> {
-  const { params, info } = context;
+export { hello };
 
-  const message = params.message || 'Hello from your new hostctl task!';
-  info(message);
+export const registry = createRegistry().register('${registryPrefix}.hello', hello);
+`;
+var indexJsTemplate = (registryPrefix) => `import { createRegistry } from './registry.js';
+import hello from './tasks/hello.js';
 
-  return {
-    success: true,
-    message: message
-  };
-}
+export { hello };
 
-export default task(run, { name: '${packageName}', description: 'A sample hostctl task' });
+export const registry = createRegistry().register('${registryPrefix}.hello', hello);
 `;
+var registryTsTemplate = `import type { TaskFn } from 'hostctl';
+
+export type TaskRegistry = {
+  register: (name: string, task: TaskFn) => TaskRegistry;
+  get: (name: string) => TaskFn | undefined;
+  tasks: () => Array<[string, TaskFn]>;
+  has: (name: string) => boolean;
+  names: () => string[];
+  size: () => number;
 };
-var indexJsTemplate = `import { task, Verbosity } from 'hostctl';
 
-async function run(context) {
-  const { params, info } = context;
+function isTaskFnLike(candidate: unknown): candidate is TaskFn {
+  return (
+    typeof candidate === 'function' &&
+    !!candidate &&
+    'task' in (candidate as Record<string, unknown>) &&
+    typeof (candidate as { task?: unknown }).task === 'object'
+  );
+}
 
-  const message = params.message || 'Hello from your new hostctl task!';
-  info(message);
+export function createRegistry(): TaskRegistry {
+  const entries = new Map<string, TaskFn>();
 
-  return {
-    success: true,
-    message: message
+  const registry: TaskRegistry = {
+    register(name: string, task: TaskFn) {
+      if (!name || typeof name !== 'string') {
+        throw new Error('Registry task name must be a non-empty string.');
+      }
+      if (!isTaskFnLike(task)) {
+        throw new Error(\`Registry task '\${name}' must be a TaskFn.\`);
+      }
+      if (entries.has(name)) {
+        throw new Error(\`Registry already has a task named '\${name}'.\`);
+      }
+      if (task.task) {
+        task.task.name = name;
+      }
+      entries.set(name, task);
+      return registry;
+    },
+    get(name: string) {
+      return entries.get(name);
+    },
+    tasks() {
+      return Array.from(entries.entries()).sort(([a], [b]) => a.localeCompare(b));
+    },
+    has(name: string) {
+      return entries.has(name);
+    },
+    names() {
+      return Array.from(entries.keys()).sort((a, b) => a.localeCompare(b));
+    },
+    size() {
+      return entries.size;
+    },
   };
+
+  return registry;
 }
+`;
+var registryJsTemplate = `export function createRegistry() {
+  const entries = new Map();
 
-export default task(run, { name: 'sample-task', description: 'A sample hostctl task' });
+  const registry = {
+    register(name, task) {
+      if (!name || typeof name !== 'string') {
+        throw new Error('Registry task name must be a non-empty string.');
+      }
+      if (!task || typeof task !== 'function' || !task.task) {
+        throw new Error(\`Registry task '\${name}' must be a TaskFn.\`);
+      }
+      if (entries.has(name)) {
+        throw new Error(\`Registry already has a task named '\${name}'.\`);
+      }
+      if (task.task) {
+        task.task.name = name;
+      }
+      entries.set(name, task);
+      return registry;
+    },
+    get(name) {
+      return entries.get(name);
+    },
+    tasks() {
+      return Array.from(entries.entries()).sort(([a], [b]) => a.localeCompare(b));
+    },
+    has(name) {
+      return entries.has(name);
+    },
+    names() {
+      return Array.from(entries.keys()).sort((a, b) => a.localeCompare(b));
+    },
+    size() {
+      return entries.size;
+    },
+  };
+
+  return registry;
+}
 `;
-var sampleTaskTsTemplate = (packageName) => {
-  const sanitizedName = packageName.replace(/[^a-zA-Z0-9]/g, "").replace(/^[0-9]/, "_$&");
-  const taskName = sanitizedName.charAt(0).toUpperCase() + sanitizedName.slice(1);
-  return `import { task, type TaskContext, Verbosity, type LogLevel } from 'hostctl';
+var taskWrapperTsTemplate = `import { task as baseTask, type RunFn, type RunFnReturnValue, type TaskFn, type TaskOptions, type TaskParams } from 'hostctl';
+import type { ZodTypeAny } from 'zod';
 
-export interface ${taskName}SampleParams {
-  name: string;
-  greeting?: string;
+export type TaskOptionsWithSchema = TaskOptions & {
+  inputSchema?: ZodTypeAny;
+  outputSchema?: ZodTypeAny;
+};
+
+export function task<TParams extends TaskParams, TReturn extends RunFnReturnValue>(
+  runFn: RunFn<TParams, TReturn>,
+  options?: TaskOptionsWithSchema,
+): TaskFn<TParams, TReturn> {
+  const taskFn = baseTask(runFn, options as TaskOptions);
+  if (options?.inputSchema) {
+    (taskFn.task as any).inputSchema = options.inputSchema;
+  }
+  if (options?.outputSchema) {
+    (taskFn.task as any).outputSchema = options.outputSchema;
+  }
+  return taskFn;
 }
+`;
+var taskWrapperJsTemplate = `import { task as baseTask } from 'hostctl';
 
-export interface ${taskName}SampleResult {
-  success: boolean;
-  greeting: string;
+export function task(runFn, options) {
+  const taskFn = baseTask(runFn, options);
+  if (options?.inputSchema) {
+    taskFn.task.inputSchema = options.inputSchema;
+  }
+  if (options?.outputSchema) {
+    taskFn.task.outputSchema = options.outputSchema;
+  }
+  return taskFn;
 }
+`;
+var sampleTaskTsTemplate = `import { task, type TaskContext } from '../task.js';
+import { z } from 'zod';
 
-async function run(context: TaskContext<${taskName}SampleParams>): Promise<${taskName}SampleResult> {
-  const { params, info } = context;
+const HelloInputSchema = z.object({
+  name: z.string().optional(),
+  excited: z.boolean().optional(),
+});
 
-  const greeting = params.greeting || 'Hello';
-  const message = \`\${greeting}, \${params.name}!\`;
+type HelloParams = z.infer<typeof HelloInputSchema>;
 
-  info(message);
+const HelloOutputSchema = z.object({
+  success: z.boolean(),
+  message: z.string(),
+});
 
-  return {
-    success: true,
-    greeting: message
-  };
+type HelloResult = z.infer<typeof HelloOutputSchema>;
+
+async function run(context: TaskContext<HelloParams>): Promise<HelloResult> {
+  const { params, info } = context;
+  const name = params.name ?? 'world';
+  const suffix = params.excited ? '!' : '.';
+  const message = \`Hello, \${name}\${suffix}\`;
+
+  info(message);
+  return { success: true, message };
 }
 
-export default task(run, { name: 'sample-task', description: 'Greets {{name}} with {{greeting}}' });
+export default task(run, {
+  name: 'hello',
+  description: 'Prints a greeting.',
+  inputSchema: HelloInputSchema,
+  outputSchema: HelloOutputSchema,
+});
 `;
-};
-var sampleTaskJsTemplate = `import { task, Verbosity } from 'hostctl';
+var sampleTaskJsTemplate = `import { task } from '../task.js';
+import { z } from 'zod';
+
+const HelloInputSchema = z.object({
+  name: z.string().optional(),
+  excited: z.boolean().optional(),
+});
+
+const HelloOutputSchema = z.object({
+  success: z.boolean(),
+  message: z.string(),
+});
 
 async function run(context) {
   const { params, info } = context;
-
-  const greeting = params.greeting || 'Hello';
-  const message = \`\${greeting}, \${params.name}!\`;
+  const name = params.name ?? 'world';
+  const suffix = params.excited ? '!' : '.';
+  const message = \`Hello, \${name}\${suffix}\`;
 
   info(message);
-
-  return {
-    success: true,
-    greeting: message
-  };
+  return { success: true, message };
 }
 
-export default task(run, { name: 'sample-task', description: 'Greets {{name}} with {{greeting}}' });
+export default task(run, {
+  name: 'hello',
+  description: 'Prints a greeting.',
+  inputSchema: HelloInputSchema,
+  outputSchema: HelloOutputSchema,
+});
 `;
-var readmeTemplate = (packageName) => `# ${packageName}
+var readmeTemplate = (packageName, registryPrefix, usesBuild) => `# ${packageName}
 
 This is a hostctl task package.
 
-## Usage
+## Quick start
 
-### Run without installing
-
-\`\`\`
-\u276F npx hostctl run https://github.com/yourusername/${packageName} message:Hello
+\`\`\`bash
+npm install
+${usesBuild ? "npm run build\n" : ""}hostctl tasks .
+hostctl run . ${registryPrefix}.hello name:Hostctl excited:true
 \`\`\`
 
-### Publish to npm and run
+## Conventions
 
-\`\`\`
-\u276F npm publish
-\u276F npx hostctl run ${packageName} message:Hello
-\`\`\`
+- Tasks live under \`src/\` and export a default \`task(...)\`.
+- \`src/index.(ts|js)\` re-exports tasks and publishes a registry for discovery.
+- Task names are unqualified; the registry assigns qualified names.
+- Schema helpers come from \`zod\` and are attached to tasks for discovery.
 
-### Install locally and run
+## Publish
 
+\`\`\`bash
+npm login
+${usesBuild ? "npm run build\n" : ""}npm publish --access public
 \`\`\`
-\u276F npx hostctl install https://github.com/yourusername/${packageName}
-\u276F npx hostctl run ${packageName} message:Hello
+
+Then run from the registry:
+
+\`\`\`bash
+npx hostctl run ${packageName} ${registryPrefix}.hello name:Hostctl
 \`\`\`
 
 ## About
 
-This is a hostctl task package that demonstrates the basic structure for creating reusable tasks.
+This package was scaffolded by \`hostctl pkg create\`. See
+\`docs/task-package-authoring.md\` in the hostctl repository for full guidance.
 `;
 var gitignoreTemplate = `node_modules/
 dist/
@@ -5681,33 +6449,50 @@ dist/
 .env
 `;
 async function createPackage(packageName, options) {
-  const packageDir = path4.join(process.cwd(), packageName);
-  await fs8.mkdir(packageDir, { recursive: true });
+  const resolvedName = expandTildePath(packageName);
+  const packageDir = path5.isAbsolute(resolvedName) ? resolvedName : path5.join(process.cwd(), resolvedName);
+  const packageSlug = path5.basename(resolvedName);
+  const packageJsonName = packageName.startsWith("@") ? packageName : packageSlug;
+  const registryPrefix = registryPrefixFromPackageName(packageSlug);
+  await fs9.mkdir(packageDir, { recursive: true });
   if (options.lang === "typescript") {
-    await fs8.writeFile(path4.join(packageDir, "package.json"), packageJsonTsTemplate(packageName));
-    await fs8.writeFile(path4.join(packageDir, "tsconfig.json"), tsconfigTemplate);
-    await fs8.writeFile(path4.join(packageDir, "index.ts"), indexTsTemplate(packageName));
-    await fs8.writeFile(path4.join(packageDir, "sample-task.ts"), sampleTaskTsTemplate(packageName));
-    await fs8.writeFile(path4.join(packageDir, "README.md"), readmeTemplate(packageName));
-    await fs8.writeFile(path4.join(packageDir, ".gitignore"), gitignoreTemplate);
+    await fs9.writeFile(path5.join(packageDir, "package.json"), packageJsonTsTemplate(packageJsonName));
+    await fs9.writeFile(path5.join(packageDir, "tsconfig.json"), tsconfigTemplate);
+    await fs9.mkdir(path5.join(packageDir, "src", "tasks"), { recursive: true });
+    await fs9.writeFile(path5.join(packageDir, "src", "index.ts"), indexTsTemplate(registryPrefix));
+    await fs9.writeFile(path5.join(packageDir, "src", "registry.ts"), registryTsTemplate);
+    await fs9.writeFile(path5.join(packageDir, "src", "task.ts"), taskWrapperTsTemplate);
+    await fs9.writeFile(path5.join(packageDir, "src", "tasks", "hello.ts"), sampleTaskTsTemplate);
+    await fs9.writeFile(path5.join(packageDir, "README.md"), readmeTemplate(packageJsonName, registryPrefix, true));
+    await fs9.writeFile(path5.join(packageDir, ".gitignore"), gitignoreTemplate);
   } else {
-    await fs8.writeFile(path4.join(packageDir, "package.json"), packageJsonJsTemplate(packageName));
-    await fs8.writeFile(path4.join(packageDir, "index.js"), indexJsTemplate);
-    await fs8.writeFile(path4.join(packageDir, "sample-task.js"), sampleTaskJsTemplate);
-    await fs8.writeFile(path4.join(packageDir, "README.md"), readmeTemplate(packageName));
-    await fs8.writeFile(path4.join(packageDir, ".gitignore"), gitignoreTemplate);
-  }
-  console.log(`Created new hostctl package '${packageName}' at ${packageDir}`);
+    await fs9.writeFile(path5.join(packageDir, "package.json"), packageJsonJsTemplate(packageJsonName));
+    await fs9.mkdir(path5.join(packageDir, "src", "tasks"), { recursive: true });
+    await fs9.writeFile(path5.join(packageDir, "src", "index.js"), indexJsTemplate(registryPrefix));
+    await fs9.writeFile(path5.join(packageDir, "src", "registry.js"), registryJsTemplate);
+    await fs9.writeFile(path5.join(packageDir, "src", "task.js"), taskWrapperJsTemplate);
+    await fs9.writeFile(path5.join(packageDir, "src", "tasks", "hello.js"), sampleTaskJsTemplate);
+    await fs9.writeFile(path5.join(packageDir, "README.md"), readmeTemplate(packageJsonName, registryPrefix, false));
+    await fs9.writeFile(path5.join(packageDir, ".gitignore"), gitignoreTemplate);
+  }
+  console.log(`Created new hostctl package '${resolvedName}' at ${packageDir}`);
   console.log(`
 Next steps:`);
-  console.log(`1. cd ${packageName}`);
+  console.log(`1. cd ${packageDir}`);
   console.log(`2. npm install`);
+  let step = 3;
   if (options.lang === "typescript") {
-    console.log(`3. Edit index.ts and sample-task.ts to implement your tasks`);
+    console.log(`${step}. Edit src/index.ts and src/tasks/hello.ts to implement your tasks`);
+    step += 1;
+    console.log(`${step}. npm run build`);
+    step += 1;
   } else {
-    console.log(`3. Edit index.js and sample-task.js to implement your tasks`);
+    console.log(`${step}. Edit src/index.js and src/tasks/hello.js to implement your tasks`);
+    step += 1;
   }
-  console.log(`4. Test your package with: npx hostctl run .`);
+  console.log(`${step}. Test your package with: hostctl tasks .`);
+  step += 1;
+  console.log(`${step}. Run it with: hostctl run . ${registryPrefix}.hello`);
   console.log(`
 Note: The package includes 'hostctl' as a dependency for local development.`);
   console.log(`For production, you may want to add it as a peer dependency instead.`);
@@ -5771,13 +6556,7 @@ async function listPackages(app) {
         }
       }
       console.log(output);
-      if (pkg.tasks && pkg.tasks.length > 0) {
-        pkg.tasks.forEach((task2) => {
-          console.log(`  \u2514\u2500 ${task2.name}`);
-        });
-      } else {
-        console.log(`  \u2514\u2500 (no tasks discovered)`);
-      }
+      console.log(`  \u2514\u2500 (run "hostctl tasks ${pkg.name}" to list tasks)`);
       console.log("");
     });
     const duplicateNames = Array.from(packagesByName.entries()).filter(([_, pkgs]) => pkgs.length > 1).map(([name, _]) => name);
@@ -5809,6 +6588,192 @@ async function removePackage(packageIdentifier, app) {
 
 // src/cli.ts
 import JSON5 from "json5";
+
+// src/task-discovery.ts
+import { promises as fs10 } from "fs";
+import path6 from "path";
+import { pathToFileURL as pathToFileURL2 } from "url";
+import { glob as glob3 } from "glob";
+var metaCache = /* @__PURE__ */ new Map();
+async function readPackageJson2(pkgPath) {
+  try {
+    const pkgJson = await fs10.readFile(path6.join(pkgPath, "package.json"), "utf8");
+    const parsed = JSON.parse(pkgJson);
+    return { name: parsed.name, version: parsed.version };
+  } catch {
+    return {};
+  }
+}
+function cacheKey(packagePath, includeSchemas) {
+  return `${packagePath}::schemas=${includeSchemas ? "1" : "0"}`;
+}
+function deriveNameFromPath(filePath, pkgPath) {
+  const relative = path6.relative(pkgPath, filePath);
+  const withoutExt = relative.replace(/\.[^.]+$/, "");
+  return withoutExt.replace(new RegExp(`\\${path6.sep}`, "g"), ".");
+}
+function isTaskInstanceLike(candidate) {
+  return !!candidate && typeof candidate === "object" && "runFn" in candidate && typeof candidate.runFn === "function";
+}
+function resolveTaskInstance(candidate) {
+  if (!candidate) return void 0;
+  if (candidate instanceof Task) {
+    return candidate;
+  }
+  if (isTaskInstanceLike(candidate)) {
+    return candidate;
+  }
+  if (typeof candidate === "function") {
+    const taskInstance = candidate.task;
+    if (taskInstance instanceof Task || isTaskInstanceLike(taskInstance)) {
+      return taskInstance;
+    }
+  }
+  return void 0;
+}
+function isTaskFnLike(candidate) {
+  if (typeof candidate !== "function") {
+    return false;
+  }
+  const task2 = candidate.task;
+  return typeof task2 === "object" && task2 !== null;
+}
+function buildMetaFromTaskFn(taskName, taskFn, packagePath, pkgInfo) {
+  const taskInstance = taskFn.task;
+  return {
+    name: taskName,
+    description: taskInstance.description,
+    modulePath: void 0,
+    package: { ...pkgInfo, path: packagePath },
+    inputSchema: taskInstance.inputSchema,
+    outputSchema: taskInstance.outputSchema,
+    schemaSource: taskInstance.inputSchema || taskInstance.outputSchema ? "present" : "absent"
+  };
+}
+function buildMetaFromTaskInstance(taskName, taskInstance, packagePath, pkgInfo) {
+  return {
+    name: taskName,
+    description: taskInstance.description,
+    modulePath: taskInstance.taskModuleAbsolutePath ?? packagePath,
+    package: { ...pkgInfo, path: packagePath },
+    inputSchema: taskInstance.inputSchema,
+    outputSchema: taskInstance.outputSchema,
+    schemaSource: taskInstance.inputSchema || taskInstance.outputSchema ? "present" : "absent"
+  };
+}
+async function collectTaskMeta(packagePath, opts = {}) {
+  const absPackagePath = path6.resolve(packagePath);
+  const includeSchemas = opts.includeSchemas ?? false;
+  const cacheId = cacheKey(absPackagePath, includeSchemas);
+  if (opts.cache !== false && metaCache.has(cacheId)) {
+    return metaCache.get(cacheId);
+  }
+  const pkgInfo = await readPackageJson2(absPackagePath);
+  const registry = await loadRegistryFromPackage(absPackagePath);
+  if (registry) {
+    const metas2 = [];
+    for (const [name, taskFn] of registry.tasks()) {
+      if (!isTaskFnLike(taskFn)) {
+        continue;
+      }
+      metas2.push(buildMetaFromTaskFn(name, taskFn, absPackagePath, pkgInfo));
+    }
+    metas2.sort((a, b) => a.name.localeCompare(b.name));
+    if (opts.cache !== false) {
+      metaCache.set(cacheId, metas2);
+    }
+    return metas2;
+  }
+  const ignore = opts.ignore ?? [];
+  const candidates = await glob3("**/*.{ts,js,mjs,cjs}", {
+    cwd: absPackagePath,
+    absolute: true,
+    nodir: true,
+    ignore: ["**/node_modules/**", "**/dist/**", "**/.git/**", "**/coverage/**", "**/.turbo/**", ...ignore]
+  });
+  const metas = [];
+  const seenTasks = /* @__PURE__ */ new Set();
+  const seenKeys = /* @__PURE__ */ new Set();
+  for (const file of candidates) {
+    try {
+      const mod = await import(pathToFileURL2(file).href);
+      const exports = Object.entries(mod ?? {});
+      const taskExports = exports.map(([key, exported]) => ({ key, task: resolveTaskInstance(exported) })).filter((entry) => entry.task);
+      const defaultTask = resolveTaskInstance(mod.default);
+      if (!defaultTask) {
+        if (taskExports.length > 0) {
+          const namedTasks = taskExports.filter((entry) => entry.key !== "default").map((entry) => entry.key);
+          const hint = namedTasks.length ? ` Named exports: ${namedTasks.join(", ")}.` : "";
+          console.warn(`Task module ${file} has task exports but no default task.${hint}`);
+        }
+        continue;
+      }
+      const namedTaskExports = taskExports.filter((entry) => entry.key !== "default");
+      if (namedTaskExports.length > 0) {
+        const names = namedTaskExports.map((entry) => entry.key).join(", ");
+        console.warn(`Task module ${file} exports multiple tasks (${names}). Only the default export is used.`);
+      }
+      if (seenTasks.has(defaultTask)) {
+        continue;
+      }
+      const taskFile = defaultTask.taskModuleAbsolutePath ?? file;
+      if (seenKeys.has(taskFile)) {
+        continue;
+      }
+      seenTasks.add(defaultTask);
+      seenKeys.add(taskFile);
+      metas.push(
+        buildMetaFromTaskInstance(deriveNameFromPath(taskFile, absPackagePath), defaultTask, absPackagePath, pkgInfo)
+      );
+    } catch (err) {
+      continue;
+    }
+  }
+  metas.sort((a, b) => a.name.localeCompare(b.name));
+  if (opts.cache !== false) {
+    metaCache.set(cacheId, metas);
+  }
+  return metas;
+}
+
+// src/config-provider/memory-config-provider.ts
+var MemoryConfigProvider = class {
+  hostsData;
+  secretsData;
+  idsData;
+  resolver;
+  constructor(opts = {}) {
+    this.hostsData = opts.hosts ?? [];
+    this.secretsData = opts.secrets ?? [];
+    this.idsData = opts.ids ?? [];
+    this.resolver = opts.secretResolver;
+  }
+  async hosts() {
+    return this.hostsData;
+  }
+  async secrets() {
+    return this.secretsData;
+  }
+  async ids() {
+    return this.idsData;
+  }
+  async getSecret(name) {
+    const direct = this.secretsData.find((s) => s.name === name);
+    if (direct) {
+      return direct.value;
+    }
+    if (this.resolver) {
+      return this.resolver(name);
+    }
+    return void 0;
+  }
+  async getRecipientGroups(idRefs) {
+    const groups = this.idsData.filter((g) => idRefs.includes(g.name));
+    return groups.map((g) => ({ name: g.name, recipients: g.recipients ?? [], groups: g.groups ?? [] }));
+  }
+};
+
+// src/cli.ts
 var isError2 = (value) => !!value && typeof value === "object" && "message" in value && typeof value.message === "string" && "stack" in value && typeof value.stack === "string";
 var logError = (message, error) => {
   console.error(`Error: ${message}`);
@@ -5833,6 +6798,60 @@ function isValidUrl(url) {
     return false;
   }
 }
+function shouldSkipConfig(envValue) {
+  if (!envValue) return false;
+  const normalized = envValue.trim().toLowerCase();
+  return normalized === "1" || normalized === "true";
+}
+function collectConfigHeader(value, previous) {
+  return previous.concat(value);
+}
+function parseHeaderEntry(entry) {
+  const index = entry.indexOf(":");
+  if (index === -1) {
+    throw new Error(`Invalid config header "${entry}". Expected "Header-Name: value".`);
+  }
+  const name = entry.slice(0, index).trim();
+  const value = entry.slice(index + 1).trim();
+  if (!name) {
+    throw new Error(`Invalid config header "${entry}". Header name is required.`);
+  }
+  return [name, value];
+}
+function parseHeaderMap(raw) {
+  if (!raw) return {};
+  const parsed = JSON5.parse(raw);
+  if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) {
+    throw new Error("HOSTCTL_CONFIG_HEADERS must be a JSON object map of header names to values.");
+  }
+  return Object.entries(parsed).reduce((acc, [key, value]) => {
+    if (typeof value === "string") {
+      acc[key] = value;
+      return acc;
+    }
+    acc[key] = String(value);
+    return acc;
+  }, {});
+}
+function buildConfigAuthOptions(options) {
+  const token = options.configToken ?? process4.env.HOSTCTL_CONFIG_TOKEN;
+  const envHeaders = parseHeaderMap(process4.env.HOSTCTL_CONFIG_HEADERS);
+  const headerEntries = options.configHeader ?? [];
+  const headerList = Array.isArray(headerEntries) ? headerEntries : [headerEntries];
+  const optionHeaders = headerList.reduce((acc, entry) => {
+    if (typeof entry !== "string") {
+      return acc;
+    }
+    const [name, value] = parseHeaderEntry(entry);
+    acc[name] = value;
+    return acc;
+  }, {});
+  const headers = { ...envHeaders, ...optionHeaders };
+  return {
+    token,
+    headers: Object.keys(headers).length ? headers : void 0
+  };
+}
 function increaseVerbosity(dummyValue, previous) {
   return previous + 1;
 }
@@ -5850,7 +6869,12 @@ var Cli = class {
       "verbose; may be specified multiple times for increased verbosity",
       increaseVerbosity,
       Verbosity.WARN
-    ).option("-c, --config <file path>", "config file path or http endpoint").option("--json", "output should be json formatted").option("-p, --password", "should prompt for sudo password?", false).option("-t, --tag <tags...>", "specify a tag (repeat for multiple tags)");
+    ).option("-c, --config <file path>", "config file path or http endpoint").option("--config-token <token>", "bearer token for HTTP config requests").option(
+      "--config-header <header>",
+      'additional HTTP config header (repeatable, format: "Header-Name: value")',
+      collectConfigHeader,
+      []
+    ).option("--json", "output should be json formatted").option("-p, --password", "should prompt for sudo password?", false).option("-t, --tag <tags...>", "specify a tag (repeat for multiple tags)");
     this.program.command("exec").alias("e").argument(
       "<command...>",
       `the command string to run, with optional arguments (e.g. hostctl exec sudo sh -c 'echo "$(whoami)"')`
@@ -5859,9 +6883,9 @@ var Cli = class {
     inventoryCmd.command("report", { isDefault: true }).description("print out an inventory report (default)").action(this.handleInventory.bind(this));
     inventoryCmd.command("encrypt").alias("e").description("encrypt the inventory file").action(this.handleInventoryEncrypt.bind(this));
     inventoryCmd.command("decrypt").alias("d").description("decrypt the inventory file").action(this.handleInventoryDecrypt.bind(this));
-    inventoryCmd.command("list").alias("ls").description("list the hosts in the inventory file").action(this.handleInventoryList.bind(this));
+    inventoryCmd.command("list").alias("ls").alias("l").description("list the hosts in the inventory file").action(this.handleInventoryList.bind(this));
     const pkgCmd = this.program.command("pkg").description("manage hostctl packages");
-    pkgCmd.command("create <package-name>").description("create a new hostctl package").option("--lang <language>", "the language for the package (typescript or javascript)", "typescript").hook("preAction", (thisCommand, actionCommand) => {
+    pkgCmd.command("create <package-path>").description("create a new hostctl package (path is relative to cwd unless absolute)").option("--lang <language>", "the language for the package (typescript or javascript)", "typescript").hook("preAction", (thisCommand, actionCommand) => {
       const options = actionCommand.opts();
       const supportedLanguages = ["typescript", "javascript"];
       if (!supportedLanguages.includes(options.lang)) {
@@ -5891,6 +6915,7 @@ var Cli = class {
     ).option("-r, --remote", "run the script on remote hosts specified by tags via SSH orchestration").action(this.handleRun.bind(this));
     const runtimeCmd = this.program.command("runtime").alias("rt").description("print out a report of the runtime environment").action(this.handleRuntime.bind(this));
     runtimeCmd.command("install").alias("i").description("install a temporary runtime environment on the local host if needed").action(this.handleRuntimeInstall.bind(this));
+    this.program.command("tasks").description("list tasks available in a package or path").argument("[package-or-path...]", "npm package spec, installed package name, or local path").option("--task <name>", "filter to a specific task name").option("--json", "output should be json formatted").action(this.handleTasksList.bind(this));
   }
   async handleInventory(options, cmd) {
     const opts = cmd.optsWithGlobals();
@@ -5963,9 +6988,10 @@ var Cli = class {
         process4.exitCode = 1;
         return;
       }
-      throw error;
+      console.error(error instanceof Error ? error.message : String(error));
+      process4.exitCode = 1;
+      return;
     }
-    const scriptRef = resolved.scriptRef;
     const scriptArgs = resolved.scriptArgs;
     let params = {};
     try {
@@ -5984,16 +7010,23 @@ var Cli = class {
       );
       throw new Error(`Failed to parse params as JSON5: ${err.message}`);
     }
-    if (!scriptRef) {
+    if (resolved.kind === "script" && !resolved.scriptRef) {
       this.program.help();
     }
-    this.app.debug(`Resolved script: ${scriptRef}`);
+    if (resolved.kind === "registry") {
+      const taskName = resolved.task.task?.name ?? "unknown";
+      this.app.debug(`Resolved registry task: ${taskName}`);
+    } else {
+      this.app.debug(`Resolved script: ${resolved.scriptRef}`);
+    }
     this.app.debug(`Script params: ${JSON.stringify(params)}`);
     let result;
-    if (opts.remote) {
-      result = await this.app.runScriptRemote(scriptRef, params);
+    if (resolved.kind === "registry") {
+      result = await this.app.runTaskDefinition(resolved.task, params, { remote: opts.remote });
+    } else if (opts.remote) {
+      result = await this.app.runScriptRemote(resolved.scriptRef, params);
     } else {
-      result = await this.app.runScript(scriptRef, params);
+      result = await this.app.runScript(resolved.scriptRef, params);
     }
     if (result instanceof Error) {
       process4.exitCode = 1;
@@ -6031,7 +7064,14 @@ var Cli = class {
     );
   }
   async loadApp(opts) {
-    await this.app.loadConfig(opts.config);
+    const configAuth = buildConfigAuthOptions(opts);
+    if (opts.config) {
+      await this.app.loadConfig(opts.config, configAuth);
+    } else if (shouldSkipConfig(process4.env.HOSTCTL_E2E_SKIP_CONFIG)) {
+      await this.app.loadConfigFromProvider(new MemoryConfigProvider());
+    } else {
+      await this.app.loadConfig(void 0, configAuth);
+    }
     const verbosity = opts.quiet + opts.verbose;
     this.app.setVerbosity(verbosity);
     if (opts.json) {
@@ -6086,7 +7126,166 @@ var Cli = class {
     await this.loadApp(this.program.opts());
     await removePackage(packageIdentifier, this.app);
   }
+  async handleTasksList(specParts, options, cmd) {
+    const opts = cmd.optsWithGlobals();
+    await this.loadApp(opts);
+    const packageManager = new PackageManager(this.app);
+    let spec;
+    let taskFilter = options.task;
+    if (Array.isArray(specParts)) {
+      if (specParts.length === 0) {
+        spec = ".";
+      } else if (specParts[0] === "list" && specParts.length >= 2) {
+        spec = specParts[1];
+      } else {
+        spec = specParts[0];
+      }
+    } else {
+      spec = specParts || ".";
+    }
+    if (!taskFilter && spec && spec.includes(".") && !Path.new(spec).exists()) {
+      taskFilter = spec;
+      spec = ".";
+    }
+    const specPath = Path.new(spec);
+    let packagePath = null;
+    if (specPath.exists()) {
+      packagePath = specPath.isFile() ? specPath.parent().absolute().toString() : specPath.absolute().toString();
+    } else {
+      const installed = await packageManager.getPackageByIdentifier(spec);
+      if (installed) {
+        packagePath = Path.new(installed.path).absolute().toString();
+      } else {
+        const installResult = await packageManager.installPackage(spec);
+        if (!installResult.success) {
+          console.error(`Failed to resolve package '${spec}': ${installResult.error}`);
+          process4.exitCode = 1;
+          return;
+        }
+        packagePath = Path.new(installResult.packageInfo.path).absolute().toString();
+      }
+    }
+    if (!packagePath) {
+      console.error(`Could not resolve package or path: ${spec}`);
+      process4.exitCode = 1;
+      return;
+    }
+    const metas = await collectTaskMeta(packagePath);
+    const rows = metas.filter((m) => taskFilter ? m.name === taskFilter : true).map((m) => {
+      const moduleRel = m.modulePath ? path7.relative(packagePath, m.modulePath) || path7.basename(m.modulePath) : void 0;
+      return {
+        name: m.name,
+        description: m.description ?? "",
+        module: moduleRel,
+        inputSchema: m.inputSchema,
+        outputSchema: m.outputSchema,
+        schemaSource: m.schemaSource
+      };
+    });
+    if (opts.json) {
+      const sanitized = rows.map((r) => ({
+        name: r.name,
+        description: r.description,
+        module: r.module,
+        inputSchema: Boolean(r.inputSchema),
+        outputSchema: Boolean(r.outputSchema),
+        schemaSource: r.schemaSource
+      }));
+      console.log(JSON.stringify(sanitized, null, 2));
+      return;
+    }
+    if (rows.length === 0) {
+      const target = taskFilter ? `${taskFilter} in ${packagePath}` : packagePath;
+      console.log(`No tasks found in ${target}`);
+      return;
+    }
+    console.log(`Tasks in ${packagePath}${taskFilter ? ` (filtered to ${taskFilter})` : ""}:`);
+    rows.forEach((row) => {
+      console.log(`- ${row.name}${row.module ? ` (${row.module})` : ""}`);
+      console.log(`  description: ${row.description || "no description"}`);
+      if (row.inputSchema) {
+        const lines = formatSchemaLines(row.inputSchema);
+        if (lines.length) {
+          console.log("  input:");
+          lines.forEach((line) => console.log(`    ${line}`));
+        }
+      }
+      if (row.outputSchema) {
+        const lines = formatSchemaLines(row.outputSchema);
+        if (lines.length) {
+          console.log("  output:");
+          lines.forEach((line) => console.log(`    ${line}`));
+        }
+      }
+    });
+  }
 };
+function summarizeType(val) {
+  const def = val?._def ?? val?.def;
+  const tn = def?.typeName || def?.type;
+  if (!tn) return {};
+  const desc = def?.description;
+  switch (tn) {
+    case "ZodOptional":
+    case "optional":
+    case "ZodNullable":
+    case "nullable":
+      return summarizeType(def.innerType || def.type);
+    case "ZodEffects":
+      return summarizeType(def.schema);
+    case "ZodString":
+    case "string":
+      return { type: "string", desc };
+    case "ZodNumber":
+    case "number":
+      return { type: "number", desc };
+    case "ZodBoolean":
+    case "boolean":
+      return { type: "boolean", desc };
+    case "ZodArray":
+    case "array": {
+      const innerSource = def.element ?? def.type;
+      const inner = summarizeType(innerSource);
+      return inner.type ? { type: `array<${inner.type}>`, desc: desc || inner.desc } : {};
+    }
+    case "ZodUnion":
+    case "union": {
+      const options = def.options || [];
+      const types = options.map((o) => summarizeType(o).type).filter(Boolean);
+      return types.length ? { type: types.join(" | "), desc } : {};
+    }
+    case "ZodLiteral":
+    case "literal":
+      return { type: JSON.stringify(def.value), desc };
+    case "ZodObject":
+    case "object":
+      return { type: "object", desc };
+    default:
+      return { type: String(tn).replace(/^Zod/, "").toLowerCase(), desc };
+  }
+}
+function formatSchemaLines(schema) {
+  if (!schema) return ["none"];
+  const def = schema._def ?? schema.def;
+  const shapeSource = def?.shape || def?.shape_;
+  const shape = shapeSource ? typeof shapeSource === "function" ? shapeSource.call(def) : shapeSource : void 0;
+  if (shape && typeof shape === "object") {
+    const lines = Object.entries(shape).map(([key, val]) => {
+      const summary2 = summarizeType(val);
+      const anyVal = val;
+      const tn = anyVal?._def?.typeName || anyVal?.def?.type;
+      const typeString = summary2.type || (tn ? String(tn).replace(/^Zod/, "").toLowerCase() : void 0);
+      const desc = summary2.desc;
+      const optional = tn === "ZodOptional" || tn === "ZodNullable";
+      const typePart = typeString ? `: ${typeString}` : "";
+      const descPart = desc ? ` - ${desc}` : "";
+      return `- ${key}${optional ? "?" : ""}${typePart}${descPart}`;
+    }).filter(Boolean);
+    return lines;
+  }
+  const summary = summarizeType(schema);
+  return summary.type ? [`- ${summary.type}${summary.desc ? ` - ${summary.desc}` : ""}`] : [];
+}
 
 // src/bin/hostctl.ts
 var cli = new Cli();