nestor-sh 2.1.0 → 2.1.1

package/dist/nestor.mjs

@@ -558,7 +558,7 @@ var SCHEMA_VERSION, CREATE_TABLES_SQL, CREATE_FTS5_SQL;
 var init_schema = __esm({
   "../db/src/schema.ts"() {
     "use strict";
-    SCHEMA_VERSION = 6;
+    SCHEMA_VERSION = 7;
     CREATE_TABLES_SQL = `
 -- \u2500\u2500\u2500 Tenants \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500
 
@@ -1532,6 +1532,22 @@ CREATE TABLE IF NOT EXISTS conversations (
 CREATE INDEX IF NOT EXISTS idx_conversations_agent ON conversations(agent_id);
 CREATE INDEX IF NOT EXISTS idx_conversations_tenant ON conversations(tenant_id);
 
+-- \u2500\u2500\u2500 LLM Provider Keys (encrypted LLM provider credentials) \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500
+
+CREATE TABLE IF NOT EXISTS llm_provider_keys (
+  id          TEXT PRIMARY KEY NOT NULL,
+  tenant_id   TEXT NOT NULL DEFAULT 'default',
+  provider    TEXT NOT NULL CHECK(provider IN ('claude','openai','gemini','grok','mistral','ollama')),
+  key_encrypted TEXT NOT NULL,
+  label       TEXT DEFAULT '',
+  created_at  TEXT NOT NULL DEFAULT (datetime('now')),
+  updated_at  TEXT NOT NULL DEFAULT (datetime('now')),
+  UNIQUE(tenant_id, provider)
+);
+
+CREATE INDEX IF NOT EXISTS idx_llm_keys_tenant ON llm_provider_keys(tenant_id);
+CREATE INDEX IF NOT EXISTS idx_llm_keys_provider ON llm_provider_keys(provider);
+
 -- NOTE: sql.js (emscripten WASM build of SQLite) does not include the FTS5
 -- extension by default. The FTS5 virtual table and sync triggers below will
 -- only take effect when running against a SQLite build that ships FTS5
@@ -6133,6 +6149,80 @@ var init_store = __esm({
         if (affected > 0) this.save();
         return affected > 0;
       }
+      // ─── API Keys ──────────────────────────────────────────────────────────
+      /**
+       * Upsert an encrypted API key for a provider.
+       */
+      setApiKey(provider, encryptedKey, tenantId = "default", label = "") {
+        const id = crypto2.randomUUID();
+        runSql(
+          this.db,
+          `INSERT INTO llm_provider_keys (id, tenant_id, provider, key_encrypted, label, created_at, updated_at)
+       VALUES (?, ?, ?, ?, ?, datetime('now'), datetime('now'))
+       ON CONFLICT(tenant_id, provider) DO UPDATE SET
+         key_encrypted = excluded.key_encrypted,
+         label = excluded.label,
+         updated_at = datetime('now')`,
+          [id, tenantId, provider, encryptedKey, label]
+        );
+        this.save();
+      }
+      /**
+       * Get the encrypted key for a provider, or null if not set.
+       */
+      getApiKey(provider, tenantId = "default") {
+        const row = queryOne(
+          this.db,
+          "SELECT key_encrypted FROM llm_provider_keys WHERE provider = ? AND tenant_id = ?",
+          [provider, tenantId]
+        );
+        return row ? row.key_encrypted : null;
+      }
+      /**
+       * List all configured API key providers with masked keys (for API response).
+       * Does NOT return the actual encrypted key — only metadata.
+       */
+      listProviderKeys(tenantId = "default") {
+        const rows = queryAll(
+          this.db,
+          "SELECT provider, label, created_at, updated_at FROM llm_provider_keys WHERE tenant_id = ? ORDER BY provider",
+          [tenantId]
+        );
+        return rows.map((row) => ({
+          provider: row.provider,
+          label: row.label || "",
+          createdAt: row.created_at,
+          updatedAt: row.updated_at,
+          hasKey: true
+        }));
+      }
+      /**
+       * List all API keys with encrypted values (server-side only, for decryption).
+       */
+      listApiKeysRaw(tenantId = "default") {
+        const rows = queryAll(
+          this.db,
+          "SELECT provider, key_encrypted, label FROM llm_provider_keys WHERE tenant_id = ?",
+          [tenantId]
+        );
+        return rows.map((row) => ({
+          provider: row.provider,
+          keyEncrypted: row.key_encrypted,
+          label: row.label || ""
+        }));
+      }
+      /**
+       * Delete an API key for a provider.
+       */
+      deleteProviderKey(provider, tenantId = "default") {
+        const affected = runSql(
+          this.db,
+          "DELETE FROM llm_provider_keys WHERE provider = ? AND tenant_id = ?",
+          [provider, tenantId]
+        );
+        if (affected > 0) this.save();
+        return affected > 0;
+      }
     };
   }
 });
@@ -10593,7 +10683,7 @@ var SERVER_VERSION, startTime;
 var init_health = __esm({
   "../server/src/routes/health.ts"() {
     "use strict";
-    SERVER_VERSION = "2.1.0";
+    SERVER_VERSION = "2.1.1";
     startTime = Date.now();
   }
 });
@@ -19383,7 +19473,7 @@ function isNativeAvailable() {
   return nativeModule !== null;
 }
 function getNativeVersion() {
-  return nativeModule ? "2.1.0" : null;
+  return nativeModule ? "2.1.1" : null;
 }
 function validateSsrf(url, allowPrivate = false) {
   if (nativeModule) {
@@ -70149,7 +70239,7 @@ var require_util2 = __commonJS({
       return path30;
     }
     exports2.normalize = normalize4;
-    function join25(aRoot, aPath) {
+    function join26(aRoot, aPath) {
       if (aRoot === "") {
         aRoot = ".";
       }
@@ -70181,7 +70271,7 @@ var require_util2 = __commonJS({
       }
       return joined;
     }
-    exports2.join = join25;
+    exports2.join = join26;
     exports2.isAbsolute = function(aPath) {
       return aPath.charAt(0) === "/" || urlRegexp.test(aPath);
     };
@@ -70354,7 +70444,7 @@ var require_util2 = __commonJS({
             parsed.path = parsed.path.substring(0, index + 1);
           }
         }
-        sourceURL = join25(urlGenerate(parsed), sourceURL);
+        sourceURL = join26(urlGenerate(parsed), sourceURL);
       }
       return normalize4(sourceURL);
     }
@@ -72156,7 +72246,7 @@ var require_escodegen = __commonJS({
       function noEmptySpace() {
         return space ? space : " ";
       }
-      function join25(left2, right2) {
+      function join26(left2, right2) {
         var leftSource, rightSource, leftCharCode, rightCharCode;
         leftSource = toSourceNodeWhenNeeded(left2).toString();
         if (leftSource.length === 0) {
@@ -72487,8 +72577,8 @@ var require_escodegen = __commonJS({
           } else {
             result.push(that.generateExpression(stmt.left, Precedence.Call, E_TTT));
           }
-          result = join25(result, operator);
-          result = [join25(
+          result = join26(result, operator);
+          result = [join26(
             result,
             that.generateExpression(stmt.right, Precedence.Assignment, E_TTT)
           ), ")"];
@@ -72631,11 +72721,11 @@ var require_escodegen = __commonJS({
           var result, fragment;
           result = ["class"];
           if (stmt.id) {
-            result = join25(result, this.generateExpression(stmt.id, Precedence.Sequence, E_TTT));
+            result = join26(result, this.generateExpression(stmt.id, Precedence.Sequence, E_TTT));
           }
           if (stmt.superClass) {
-            fragment = join25("extends", this.generateExpression(stmt.superClass, Precedence.Unary, E_TTT));
-            result = join25(result, fragment);
+            fragment = join26("extends", this.generateExpression(stmt.superClass, Precedence.Unary, E_TTT));
+            result = join26(result, fragment);
           }
           result.push(space);
           result.push(this.generateStatement(stmt.body, S_TFFT));
@@ -72648,9 +72738,9 @@ var require_escodegen = __commonJS({
           return escapeDirective(stmt.directive) + this.semicolon(flags);
         },
         DoWhileStatement: function(stmt, flags) {
-          var result = join25("do", this.maybeBlock(stmt.body, S_TFFF));
+          var result = join26("do", this.maybeBlock(stmt.body, S_TFFF));
           result = this.maybeBlockSuffix(stmt.body, result);
-          return join25(result, [
+          return join26(result, [
             "while" + space + "(",
             this.generateExpression(stmt.test, Precedence.Sequence, E_TTT),
             ")" + this.semicolon(flags)
@@ -72686,11 +72776,11 @@ var require_escodegen = __commonJS({
         ExportDefaultDeclaration: function(stmt, flags) {
           var result = ["export"], bodyFlags;
           bodyFlags = flags & F_SEMICOLON_OPT ? S_TFFT : S_TFFF;
-          result = join25(result, "default");
+          result = join26(result, "default");
           if (isStatement(stmt.declaration)) {
-            result = join25(result, this.generateStatement(stmt.declaration, bodyFlags));
+            result = join26(result, this.generateStatement(stmt.declaration, bodyFlags));
           } else {
-            result = join25(result, this.generateExpression(stmt.declaration, Precedence.Assignment, E_TTT) + this.semicolon(flags));
+            result = join26(result, this.generateExpression(stmt.declaration, Precedence.Assignment, E_TTT) + this.semicolon(flags));
           }
           return result;
         },
@@ -72698,15 +72788,15 @@ var require_escodegen = __commonJS({
           var result = ["export"], bodyFlags, that = this;
           bodyFlags = flags & F_SEMICOLON_OPT ? S_TFFT : S_TFFF;
           if (stmt.declaration) {
-            return join25(result, this.generateStatement(stmt.declaration, bodyFlags));
+            return join26(result, this.generateStatement(stmt.declaration, bodyFlags));
           }
           if (stmt.specifiers) {
             if (stmt.specifiers.length === 0) {
-              result = join25(result, "{" + space + "}");
+              result = join26(result, "{" + space + "}");
             } else if (stmt.specifiers[0].type === Syntax.ExportBatchSpecifier) {
-              result = join25(result, this.generateExpression(stmt.specifiers[0], Precedence.Sequence, E_TTT));
+              result = join26(result, this.generateExpression(stmt.specifiers[0], Precedence.Sequence, E_TTT));
             } else {
-              result = join25(result, "{");
+              result = join26(result, "{");
               withIndent(function(indent2) {
                 var i, iz;
                 result.push(newline);
@@ -72724,7 +72814,7 @@ var require_escodegen = __commonJS({
               result.push(base + "}");
             }
             if (stmt.source) {
-              result = join25(result, [
+              result = join26(result, [
                 "from" + space,
                 // ModuleSpecifier
                 this.generateExpression(stmt.source, Precedence.Sequence, E_TTT),
@@ -72812,7 +72902,7 @@ var require_escodegen = __commonJS({
           ];
           cursor = 0;
           if (stmt.specifiers[cursor].type === Syntax.ImportDefaultSpecifier) {
-            result = join25(result, [
+            result = join26(result, [
               this.generateExpression(stmt.specifiers[cursor], Precedence.Sequence, E_TTT)
             ]);
             ++cursor;
@@ -72822,7 +72912,7 @@ var require_escodegen = __commonJS({
               result.push(",");
             }
             if (stmt.specifiers[cursor].type === Syntax.ImportNamespaceSpecifier) {
-              result = join25(result, [
+              result = join26(result, [
                 space,
                 this.generateExpression(stmt.specifiers[cursor], Precedence.Sequence, E_TTT)
               ]);
@@ -72851,7 +72941,7 @@ var require_escodegen = __commonJS({
               }
             }
           }
-          result = join25(result, [
+          result = join26(result, [
             "from" + space,
             // ModuleSpecifier
             this.generateExpression(stmt.source, Precedence.Sequence, E_TTT),
@@ -72905,7 +72995,7 @@ var require_escodegen = __commonJS({
           return result;
         },
         ThrowStatement: function(stmt, flags) {
-          return [join25(
+          return [join26(
             "throw",
             this.generateExpression(stmt.argument, Precedence.Sequence, E_TTT)
           ), this.semicolon(flags)];
@@ -72916,7 +73006,7 @@ var require_escodegen = __commonJS({
           result = this.maybeBlockSuffix(stmt.block, result);
           if (stmt.handlers) {
             for (i = 0, iz = stmt.handlers.length; i < iz; ++i) {
-              result = join25(result, this.generateStatement(stmt.handlers[i], S_TFFF));
+              result = join26(result, this.generateStatement(stmt.handlers[i], S_TFFF));
               if (stmt.finalizer || i + 1 !== iz) {
                 result = this.maybeBlockSuffix(stmt.handlers[i].body, result);
               }
@@ -72924,7 +73014,7 @@ var require_escodegen = __commonJS({
           } else {
             guardedHandlers = stmt.guardedHandlers || [];
             for (i = 0, iz = guardedHandlers.length; i < iz; ++i) {
-              result = join25(result, this.generateStatement(guardedHandlers[i], S_TFFF));
+              result = join26(result, this.generateStatement(guardedHandlers[i], S_TFFF));
               if (stmt.finalizer || i + 1 !== iz) {
                 result = this.maybeBlockSuffix(guardedHandlers[i].body, result);
               }
@@ -72932,13 +73022,13 @@ var require_escodegen = __commonJS({
             if (stmt.handler) {
               if (Array.isArray(stmt.handler)) {
                 for (i = 0, iz = stmt.handler.length; i < iz; ++i) {
-                  result = join25(result, this.generateStatement(stmt.handler[i], S_TFFF));
+                  result = join26(result, this.generateStatement(stmt.handler[i], S_TFFF));
                   if (stmt.finalizer || i + 1 !== iz) {
                     result = this.maybeBlockSuffix(stmt.handler[i].body, result);
                   }
                 }
               } else {
-                result = join25(result, this.generateStatement(stmt.handler, S_TFFF));
+                result = join26(result, this.generateStatement(stmt.handler, S_TFFF));
                 if (stmt.finalizer) {
                   result = this.maybeBlockSuffix(stmt.handler.body, result);
                 }
@@ -72946,7 +73036,7 @@ var require_escodegen = __commonJS({
             }
           }
           if (stmt.finalizer) {
-            result = join25(result, ["finally", this.maybeBlock(stmt.finalizer, S_TFFF)]);
+            result = join26(result, ["finally", this.maybeBlock(stmt.finalizer, S_TFFF)]);
           }
           return result;
         },
@@ -72980,7 +73070,7 @@ var require_escodegen = __commonJS({
           withIndent(function() {
             if (stmt.test) {
               result = [
-                join25("case", that.generateExpression(stmt.test, Precedence.Sequence, E_TTT)),
+                join26("case", that.generateExpression(stmt.test, Precedence.Sequence, E_TTT)),
                 ":"
               ];
             } else {
@@ -73028,9 +73118,9 @@ var require_escodegen = __commonJS({
             result.push(this.maybeBlock(stmt.consequent, S_TFFF));
             result = this.maybeBlockSuffix(stmt.consequent, result);
             if (stmt.alternate.type === Syntax.IfStatement) {
-              result = join25(result, ["else ", this.generateStatement(stmt.alternate, bodyFlags)]);
+              result = join26(result, ["else ", this.generateStatement(stmt.alternate, bodyFlags)]);
             } else {
-              result = join25(result, join25("else", this.maybeBlock(stmt.alternate, bodyFlags)));
+              result = join26(result, join26("else", this.maybeBlock(stmt.alternate, bodyFlags)));
             }
           } else {
             result.push(this.maybeBlock(stmt.consequent, bodyFlags));
@@ -73131,7 +73221,7 @@ var require_escodegen = __commonJS({
         },
         ReturnStatement: function(stmt, flags) {
           if (stmt.argument) {
-            return [join25(
+            return [join26(
               "return",
               this.generateExpression(stmt.argument, Precedence.Sequence, E_TTT)
             ), this.semicolon(flags)];
@@ -73220,14 +73310,14 @@ var require_escodegen = __commonJS({
           if (leftSource.charCodeAt(leftSource.length - 1) === 47 && esutils.code.isIdentifierPartES5(expr.operator.charCodeAt(0))) {
             result = [fragment, noEmptySpace(), expr.operator];
           } else {
-            result = join25(fragment, expr.operator);
+            result = join26(fragment, expr.operator);
           }
           fragment = this.generateExpression(expr.right, rightPrecedence, flags);
           if (expr.operator === "/" && fragment.toString().charAt(0) === "/" || expr.operator.slice(-1) === "<" && fragment.toString().slice(0, 3) === "!--") {
             result.push(noEmptySpace());
             result.push(fragment);
           } else {
-            result = join25(result, fragment);
+            result = join26(result, fragment);
           }
           if (expr.operator === "in" && !(flags & F_ALLOW_IN)) {
             return ["(", result, ")"];
@@ -73267,7 +73357,7 @@ var require_escodegen = __commonJS({
           var result, length, i, iz, itemFlags;
           length = expr["arguments"].length;
           itemFlags = flags & F_ALLOW_UNPARATH_NEW && !parentheses && length === 0 ? E_TFT : E_TFF;
-          result = join25(
+          result = join26(
             "new",
             this.generateExpression(expr.callee, Precedence.New, itemFlags)
           );
@@ -73317,11 +73407,11 @@ var require_escodegen = __commonJS({
           var result, fragment, rightCharCode, leftSource, leftCharCode;
           fragment = this.generateExpression(expr.argument, Precedence.Unary, E_TTT);
           if (space === "") {
-            result = join25(expr.operator, fragment);
+            result = join26(expr.operator, fragment);
           } else {
             result = [expr.operator];
             if (expr.operator.length > 2) {
-              result = join25(result, fragment);
+              result = join26(result, fragment);
             } else {
               leftSource = toSourceNodeWhenNeeded(result).toString();
               leftCharCode = leftSource.charCodeAt(leftSource.length - 1);
@@ -73344,7 +73434,7 @@ var require_escodegen = __commonJS({
             result = "yield";
           }
           if (expr.argument) {
-            result = join25(
+            result = join26(
               result,
               this.generateExpression(expr.argument, Precedence.Yield, E_TTT)
             );
@@ -73352,7 +73442,7 @@ var require_escodegen = __commonJS({
           return parenthesize(result, Precedence.Yield, precedence);
         },
         AwaitExpression: function(expr, precedence, flags) {
-          var result = join25(
+          var result = join26(
             expr.all ? "await*" : "await",
             this.generateExpression(expr.argument, Precedence.Await, E_TTT)
           );
@@ -73435,11 +73525,11 @@ var require_escodegen = __commonJS({
           var result, fragment;
           result = ["class"];
           if (expr.id) {
-            result = join25(result, this.generateExpression(expr.id, Precedence.Sequence, E_TTT));
+            result = join26(result, this.generateExpression(expr.id, Precedence.Sequence, E_TTT));
           }
           if (expr.superClass) {
-            fragment = join25("extends", this.generateExpression(expr.superClass, Precedence.Unary, E_TTT));
-            result = join25(result, fragment);
+            fragment = join26("extends", this.generateExpression(expr.superClass, Precedence.Unary, E_TTT));
+            result = join26(result, fragment);
           }
           result.push(space);
           result.push(this.generateStatement(expr.body, S_TFFT));
@@ -73454,7 +73544,7 @@ var require_escodegen = __commonJS({
           }
           if (expr.kind === "get" || expr.kind === "set") {
             fragment = [
-              join25(expr.kind, this.generatePropertyKey(expr.key, expr.computed)),
+              join26(expr.kind, this.generatePropertyKey(expr.key, expr.computed)),
               this.generateFunctionBody(expr.value)
             ];
           } else {
@@ -73464,7 +73554,7 @@ var require_escodegen = __commonJS({
               this.generateFunctionBody(expr.value)
             ];
           }
-          return join25(result, fragment);
+          return join26(result, fragment);
         },
         Property: function(expr, precedence, flags) {
           if (expr.kind === "get" || expr.kind === "set") {
@@ -73659,7 +73749,7 @@ var require_escodegen = __commonJS({
               for (i = 0, iz = expr.blocks.length; i < iz; ++i) {
                 fragment = that.generateExpression(expr.blocks[i], Precedence.Sequence, E_TTT);
                 if (i > 0 || extra.moz.comprehensionExpressionStartsWithAssignment) {
-                  result = join25(result, fragment);
+                  result = join26(result, fragment);
                 } else {
                   result.push(fragment);
                 }
@@ -73667,13 +73757,13 @@ var require_escodegen = __commonJS({
             });
           }
           if (expr.filter) {
-            result = join25(result, "if" + space);
+            result = join26(result, "if" + space);
             fragment = this.generateExpression(expr.filter, Precedence.Sequence, E_TTT);
-            result = join25(result, ["(", fragment, ")"]);
+            result = join26(result, ["(", fragment, ")"]);
           }
           if (!extra.moz.comprehensionExpressionStartsWithAssignment) {
             fragment = this.generateExpression(expr.body, Precedence.Assignment, E_TTT);
-            result = join25(result, fragment);
+            result = join26(result, fragment);
           }
           result.push(expr.type === Syntax.GeneratorExpression ? ")" : "]");
           return result;
@@ -73689,8 +73779,8 @@ var require_escodegen = __commonJS({
           } else {
             fragment = this.generateExpression(expr.left, Precedence.Call, E_TTT);
           }
-          fragment = join25(fragment, expr.of ? "of" : "in");
-          fragment = join25(fragment, this.generateExpression(expr.right, Precedence.Sequence, E_TTT));
+          fragment = join26(fragment, expr.of ? "of" : "in");
+          fragment = join26(fragment, this.generateExpression(expr.right, Precedence.Sequence, E_TTT));
           return ["for" + space + "(", fragment, ")"];
         },
         SpreadElement: function(expr, precedence, flags) {
@@ -101249,8 +101339,8 @@ function findChromePath() {
     for (const p8 of paths) {
       if (p8) {
         try {
-          const { existsSync: existsSync21 } = __require("node:fs");
-          if (existsSync21(p8)) return p8;
+          const { existsSync: existsSync22 } = __require("node:fs");
+          if (existsSync22(p8)) return p8;
         } catch {
         }
       }
@@ -101265,8 +101355,8 @@ function findChromePath() {
     ];
     for (const p8 of paths) {
       try {
-        const { existsSync: existsSync21 } = __require("node:fs");
-        if (existsSync21(p8)) return p8;
+        const { existsSync: existsSync22 } = __require("node:fs");
+        if (existsSync22(p8)) return p8;
       } catch {
       }
     }
@@ -101281,8 +101371,8 @@ function findChromePath() {
   ];
   for (const p8 of linuxPaths) {
     try {
-      const { existsSync: existsSync21 } = __require("node:fs");
-      if (existsSync21(p8)) return p8;
+      const { existsSync: existsSync22 } = __require("node:fs");
+      if (existsSync22(p8)) return p8;
     } catch {
     }
   }
@@ -102464,8 +102554,19 @@ async function fileListHandler(input, context3) {
     return { output: `Failed to list directory: ${message}`, isError: true };
   }
 }
+function htmlToText(html) {
+  return html.replace(/<script[^>]*>[\s\S]*?<\/script>/gi, "").replace(/<style[^>]*>[\s\S]*?<\/style>/gi, "").replace(/<noscript[^>]*>[\s\S]*?<\/noscript>/gi, "").replace(/<br\s*\/?>/gi, "\n").replace(/<\/p>/gi, "\n\n").replace(/<\/div>/gi, "\n").replace(/<\/h[1-6]>/gi, "\n\n").replace(/<h[1-6][^>]*>/gi, "\n\n## ").replace(/<li>/gi, "- ").replace(/<\/li>/gi, "\n").replace(/<\/tr>/gi, "\n").replace(/<\/td>/gi, " | ").replace(/<\/th>/gi, " | ").replace(/<hr[^>]*>/gi, "\n---\n").replace(/<[^>]*>/g, "").replace(/&amp;/g, "&").replace(/&lt;/g, "<").replace(/&gt;/g, ">").replace(/&quot;/g, '"').replace(/&#039;/g, "'").replace(/&#x27;/g, "'").replace(/&apos;/g, "'").replace(/&nbsp;/g, " ").replace(/&mdash;/g, "\u2014").replace(/&ndash;/g, "\u2013").replace(/&hellip;/g, "...").replace(/&laquo;/g, "\xAB").replace(/&raquo;/g, "\xBB").replace(/&#(\d+);/g, (_m, code) => String.fromCharCode(parseInt(code, 10))).replace(/&#x([0-9a-fA-F]+);/g, (_m, code) => String.fromCharCode(parseInt(code, 16))).replace(/\n{3,}/g, "\n\n").replace(/[ \t]+/g, " ").replace(/^ +/gm, "").trim();
+}
+function extractTitle(html) {
+  const match = html.match(/<title[^>]*>(.*?)<\/title>/i);
+  return match ? match[1].replace(/<[^>]*>/g, "").trim() : "";
+}
+function extractMetaDescription(html) {
+  const match = html.match(/<meta[^>]*name=["']description["'][^>]*content=["'](.*?)["'][^>]*>/i) || html.match(/<meta[^>]*content=["'](.*?)["'][^>]*name=["']description["'][^>]*>/i);
+  return match ? match[1].trim() : "";
+}
 async function webFetchHandler(input, context3) {
-  const { url, method, headers, body, timeout: timeout2 } = input;
+  const { url, method, headers, body, timeout: timeout2, raw } = input;
   const timeoutMs = timeout2 ?? 15e3;
   try {
     const controller = new AbortController();
@@ -102473,11 +102574,17 @@ async function webFetchHandler(input, context3) {
     if (context3.signal) {
       context3.signal.addEventListener("abort", () => controller.abort(), { once: true });
     }
+    const defaultHeaders = {
+      "User-Agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36",
+      "Accept": "text/html,application/xhtml+xml,application/xml;q=0.9,application/json;q=0.8,*/*;q=0.7",
+      "Accept-Language": "en-US,en;q=0.9,fr;q=0.8"
+    };
     const resp = await fetch(url, {
       method: method ?? "GET",
-      headers: headers ?? {},
+      headers: { ...defaultHeaders, ...headers ?? {} },
       body: body ?? void 0,
-      signal: controller.signal
+      signal: controller.signal,
+      redirect: "follow"
     });
     clearTimeout(timer2);
     const contentType = resp.headers.get("content-type") ?? "";
@@ -102486,9 +102593,22 @@ async function webFetchHandler(input, context3) {
       const json = await resp.json();
       responseBody = JSON.stringify(json, null, 2);
     } else {
-      responseBody = await resp.text();
+      const rawText = await resp.text();
+      if (!raw && contentType.includes("text/html")) {
+        const title = extractTitle(rawText);
+        const description = extractMetaDescription(rawText);
+        const textContent = htmlToText(rawText);
+        const parts = [];
+        if (title) parts.push(`# ${title}`);
+        if (description) parts.push(`> ${description}`);
+        if (parts.length > 0) parts.push("");
+        parts.push(textContent);
+        responseBody = parts.join("\n");
+      } else {
+        responseBody = rawText;
+      }
     }
-    const maxLen = 1e5;
+    const maxLen = !raw && contentType.includes("text/html") ? 1e4 : 1e5;
     if (responseBody.length > maxLen) {
       responseBody = responseBody.slice(0, maxLen) + `
 
@@ -102497,6 +102617,7 @@ async function webFetchHandler(input, context3) {
     const output = [
       `HTTP ${resp.status} ${resp.statusText}`,
       `Content-Type: ${contentType}`,
+      `URL: ${resp.url}`,
       "",
       responseBody
     ].join("\n");
@@ -102509,6 +102630,130 @@ async function webFetchHandler(input, context3) {
     return { output: `Fetch failed: ${message}`, isError: true };
   }
 }
+async function webSearchHandler(input, context3) {
+  const { query, engine, maxResults } = input;
+  const max = maxResults || 5;
+  const searchEngine = engine || "duckduckgo";
+  let searchUrl;
+  switch (searchEngine) {
+    case "google":
+      searchUrl = `https://www.google.com/search?q=${encodeURIComponent(query)}&num=${max}`;
+      break;
+    case "bing":
+      searchUrl = `https://www.bing.com/search?q=${encodeURIComponent(query)}&count=${max}`;
+      break;
+    case "duckduckgo":
+    default:
+      searchUrl = `https://html.duckduckgo.com/html/?q=${encodeURIComponent(query)}`;
+      break;
+  }
+  try {
+    const controller = new AbortController();
+    const timer2 = setTimeout(() => controller.abort(), 15e3);
+    if (context3.signal) {
+      context3.signal.addEventListener("abort", () => controller.abort(), { once: true });
+    }
+    const resp = await fetch(searchUrl, {
+      headers: {
+        "User-Agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36",
+        "Accept": "text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8",
+        "Accept-Language": "en-US,en;q=0.9,fr;q=0.8"
+      },
+      signal: controller.signal,
+      redirect: "follow"
+    });
+    clearTimeout(timer2);
+    if (!resp.ok) {
+      return { output: `Search failed: HTTP ${resp.status}. Try a different search engine with engine:"google" or engine:"bing".`, isError: true };
+    }
+    const html = await resp.text();
+    const results = [];
+    if (searchEngine === "duckduckgo") {
+      const linkRegex = /<a[^>]*class="result__a"[^>]*href="([^"]*)"[^>]*>(.*?)<\/a>/gi;
+      const snippetRegex = /<a[^>]*class="result__snippet"[^>]*>(.*?)<\/a>/gi;
+      let linkMatch;
+      const links = [];
+      while ((linkMatch = linkRegex.exec(html)) !== null && links.length < max) {
+        let url = linkMatch[1];
+        const uddg = url.match(/uddg=([^&]*)/);
+        if (uddg) url = decodeURIComponent(uddg[1]);
+        const title = linkMatch[2].replace(/<[^>]*>/g, "").trim();
+        if (url.startsWith("http")) {
+          links.push({ url, title });
+        }
+      }
+      let snippetMatch;
+      const snippets = [];
+      while ((snippetMatch = snippetRegex.exec(html)) !== null) {
+        snippets.push(snippetMatch[1].replace(/<[^>]*>/g, "").trim());
+      }
+      for (let i = 0; i < links.length; i++) {
+        results.push({
+          title: links[i].title,
+          url: links[i].url,
+          snippet: snippets[i] || ""
+        });
+      }
+    } else if (searchEngine === "google") {
+      const resultBlockRegex = /<div class="[^"]*g[^"]*"[^>]*>[\s\S]*?<a[^>]*href="(https?:\/\/[^"]*)"[^>]*>([\s\S]*?)<\/a>[\s\S]*?(?:<span[^>]*>([\s\S]*?)<\/span>)?/gi;
+      let blockMatch;
+      while ((blockMatch = resultBlockRegex.exec(html)) !== null && results.length < max) {
+        const url = blockMatch[1];
+        const title = blockMatch[2].replace(/<[^>]*>/g, "").trim();
+        const snippet = (blockMatch[3] || "").replace(/<[^>]*>/g, "").trim();
+        if (title.length > 3 && !url.includes("google.com")) {
+          results.push({ title, url, snippet });
+        }
+      }
+    } else if (searchEngine === "bing") {
+      const bingRegex = /<li class="b_algo"[^>]*>[\s\S]*?<a[^>]*href="(https?:\/\/[^"]*)"[^>]*>([\s\S]*?)<\/a>[\s\S]*?<p[^>]*>([\s\S]*?)<\/p>/gi;
+      let bingMatch;
+      while ((bingMatch = bingRegex.exec(html)) !== null && results.length < max) {
+        const url = bingMatch[1];
+        const title = bingMatch[2].replace(/<[^>]*>/g, "").trim();
+        const snippet = bingMatch[3].replace(/<[^>]*>/g, "").trim();
+        if (title.length > 3) {
+          results.push({ title, url, snippet });
+        }
+      }
+    }
+    if (results.length === 0) {
+      const anyLinkRegex = /<a[^>]*href="(https?:\/\/[^"]*)"[^>]*>(.*?)<\/a>/gi;
+      let anyMatch;
+      while ((anyMatch = anyLinkRegex.exec(html)) !== null && results.length < max) {
+        const url = anyMatch[1];
+        const title = anyMatch[2].replace(/<[^>]*>/g, "").trim();
+        if (title.length > 5 && !url.includes("duckduckgo.com") && !url.includes("google.com") && !url.includes("bing.com")) {
+          results.push({ title, url, snippet: "" });
+        }
+      }
+    }
+    if (results.length === 0) {
+      return {
+        output: `No results found for "${query}". Try a different query or use a different engine (engine:"google" or engine:"bing"). You can also try web_fetch directly on a relevant URL.`,
+        isError: false
+      };
+    }
+    const formatted = results.map(
+      (r, i) => `${i + 1}. ${r.title}
+   ${r.url}
+   ${r.snippet}`
+    ).join("\n\n");
+    return {
+      output: `Search results for "${query}":
+
+${formatted}
+
+Use web_fetch on any URL above to get the full page content.`,
+      isError: false
+    };
+  } catch (err) {
+    if (err.name === "AbortError") {
+      return { output: `Search timed out for "${query}". Try a simpler query or different engine.`, isError: true };
+    }
+    return { output: `Search error: ${err.message}. Try a different search engine with engine:"google" or engine:"bing".`, isError: true };
+  }
+}
 async function messageSendHandler(input, context3) {
   const { to, subject, body } = input;
   try {
@@ -102610,6 +102855,7 @@ function registerBuiltinTools(registry) {
   registry.register(fileWriteTool);
   registry.register(fileListTool);
   registry.register(webFetchTool);
+  registry.register(webSearchTool);
   registry.register(messageSendTool);
   registry.register(messageReadTool);
   registry.register(handoffTool);
@@ -102626,7 +102872,7 @@ function registerBrowserTools(registry, config2) {
   }
   return manager;
 }
-var shellExecSchema, sandboxCache, DANGEROUS_METACHARACTERS, shellExecTool, fileReadSchema, fileReadTool, fileWriteSchema, fileWriteTool, fileListSchema, fileListTool, webFetchSchema, webFetchTool, messageSendSchema, messageSendTool, messageReadSchema, messageReadTool, handoffSchema, handoffTool, undoSchema;
+var shellExecSchema, sandboxCache, DANGEROUS_METACHARACTERS, shellExecTool, fileReadSchema, fileReadTool, fileWriteSchema, fileWriteTool, fileListSchema, fileListTool, webFetchSchema, webFetchTool, webSearchSchema, webSearchTool, messageSendSchema, messageSendTool, messageReadSchema, messageReadTool, handoffSchema, handoffTool, undoSchema;
 var init_builtin = __esm({
   "../agent/src/tools/builtin.ts"() {
     "use strict";
@@ -102692,14 +102938,26 @@ var init_builtin = __esm({
       method: z26.enum(["GET", "POST", "PUT", "PATCH", "DELETE"]).optional().describe("HTTP method (default: GET)"),
       headers: z26.record(z26.string()).optional().describe("HTTP headers"),
       body: z26.string().optional().describe("Request body (for POST/PUT/PATCH)"),
-      timeout: z26.number().optional().describe("Timeout in milliseconds (default: 15000)")
+      timeout: z26.number().optional().describe("Timeout in milliseconds (default: 15000)"),
+      raw: z26.boolean().optional().describe("If true, return raw response without HTML-to-text conversion (default: false)")
     });
     webFetchTool = {
       name: "web_fetch",
-      description: "Make an HTTP request (GET, POST, PUT, PATCH, DELETE) and return the response.",
+      description: "Fetch a URL and return its content. For HTML pages, automatically converts to readable text. Use raw:true to get the original HTML. Useful for reading articles, documentation, API responses, etc.",
       inputSchema: webFetchSchema,
       handler: webFetchHandler
     };
+    webSearchSchema = z26.object({
+      query: z26.string().describe("The search query"),
+      engine: z26.string().optional().describe("Search engine: google, duckduckgo, bing. Default: duckduckgo"),
+      maxResults: z26.number().optional().describe("Max results to return. Default: 5")
+    });
+    webSearchTool = {
+      name: "web_search",
+      description: "Search the internet using DuckDuckGo, Google, or Bing. Returns titles, URLs, and snippets. Use web_fetch on result URLs to read full page content. Always try this FIRST when you need to find information online.",
+      inputSchema: webSearchSchema,
+      handler: webSearchHandler
+    };
     messageSendSchema = z26.object({
       to: z26.string().describe('Target agent ID or name. Use "*" to broadcast to all agents.'),
       subject: z26.string().describe("Message subject \u2014 a short label describing the purpose."),
@@ -111354,6 +111612,7 @@ __export(src_exports3, {
   shellExecTool: () => shellExecTool,
   unloadPlugin: () => unloadPlugin,
   webFetchTool: () => webFetchTool,
+  webSearchTool: () => webSearchTool,
   withinBudget: () => withinBudget,
   withinDuration: () => withinDuration,
   wrapExternalData: () => wrapExternalData,
@@ -144297,22 +144556,64 @@ function chatRoutes(store) {
           initialMessages.push({ role: msg.role, content: msg.content });
         }
       }
-      const systemPromptPrefix = `You are a Nestor AI agent with full access to the Nestor platform.
-
-Available system tools:
-- nestor_list_agents, nestor_create_agent, nestor_run_agent, nestor_delete_agent
-- nestor_list_workflows, nestor_create_workflow
-- nestor_search_memory, nestor_store_memory
-- nestor_list_skills, nestor_list_plans, nestor_list_guardrails, nestor_create_guardrail
-- nestor_system_info, nestor_read_config
-
-You also have access to:
-- shell_exec: Execute shell commands on the local machine
-- file_read/file_write/file_list: Read, write, and list files
-- web_fetch: Fetch web pages
-
-When asked to create agents, workflows, or manage the platform, use the nestor_* tools.
-When asked to work with code or files, use shell_exec and file_* tools.
+      const toolCount = registry.size;
+      const systemPromptPrefix = `You are a Nestor AI agent \u2014 a proactive, resourceful assistant that NEVER gives up.
+
+## Core Behavior Rules
+1. NEVER say "I can't do that" or "I don't have the ability to" \u2014 ALWAYS find a way using your tools
+2. NEVER ask for permission to use tools \u2014 just use them
+3. If one approach fails, try another approach immediately
+4. Break complex tasks into steps and execute them one by one
+5. When searching for information, use web_search first, then web_fetch to read specific pages
+6. When asked to do something on the system, use shell_exec and file_* tools
+7. When asked to manage the Nestor platform, use nestor_* tools
+8. Always show your work \u2014 explain what you're doing as you do it
+9. If you encounter an error, analyze it and try a different approach
+10. Complete tasks from 0% to 100% \u2014 don't stop halfway
+
+## Problem-Solving Strategy
+- Need information? \u2192 web_search \u2192 web_fetch the best results
+- Need to install something? \u2192 shell_exec with npm/pip/apt/choco
+- Need to transform data? \u2192 shell_exec with built-in tools (jq, sed, awk, etc.) or write a script
+- Need to check something? \u2192 Use the right tool, don't guess
+- Something failed? \u2192 Read the error, fix it, try again. Never give up after one failure.
+- Don't know how? \u2192 web_search for the answer, then do it
+
+## Available Tools (${toolCount} tools)
+
+### Internet & Web
+- **web_search**: Search the internet (DuckDuckGo/Google/Bing). Use this FIRST for any information lookup.
+- **web_fetch**: Fetch and read a specific URL. Automatically converts HTML to readable text.
+
+### System & Files
+- **shell_exec**: Execute shell commands. Use for builds, tests, git, installs, data processing, anything.
+- **file_read**: Read file contents.
+- **file_write**: Write/create files. Can append.
+- **file_list**: List directory contents.
+
+### Nestor Platform
+- **nestor_create_agent**: Create new AI agents
+- **nestor_list_agents**: List all agents
+- **nestor_run_agent**: Run an agent with a prompt
+- **nestor_delete_agent**: Delete an agent
+- **nestor_create_workflow**: Create automation workflows
+- **nestor_list_workflows**: List all workflows
+- **nestor_search_memory**: Search stored knowledge
+- **nestor_store_memory**: Remember information for later
+- **nestor_list_skills**: List installed skills
+- **nestor_list_plans**: List execution plans
+- **nestor_list_guardrails / nestor_create_guardrail**: Manage safety rules
+- **nestor_system_info**: Check platform status
+- **nestor_read_config**: Read configuration
+
+### Communication
+- **message_send**: Send messages to other agents
+- **message_read**: Read incoming messages
+- **handoff**: Hand off to human when truly stuck (last resort)
+
+## Language
+Respond in the same language the user writes in. If they write in French, respond in French.
+If they write in English, respond in English.
 `;
       const agentDescription = agent.description || "You are a helpful AI assistant.";
       const runtime = new AgentRuntime({
@@ -144516,10 +144817,384 @@ var init_providers = __esm({
   }
 });
 
+// ../server/src/services/key-vault.ts
+import { createCipheriv as createCipheriv2, createDecipheriv as createDecipheriv2, randomBytes as randomBytes7, scryptSync as scryptSync2 } from "node:crypto";
+import { readFileSync as readFileSync16, writeFileSync as writeFileSync8, existsSync as existsSync11, mkdirSync as mkdirSync6 } from "node:fs";
+import { join as join17, dirname as dirname8 } from "node:path";
+import { homedir as homedir5 } from "node:os";
+function getVaultKey() {
+  if (!existsSync11(KEY_FILE)) {
+    const dir = dirname8(KEY_FILE);
+    if (!existsSync11(dir)) {
+      mkdirSync6(dir, { recursive: true });
+    }
+    const masterSecret = randomBytes7(32).toString("hex");
+    writeFileSync8(KEY_FILE, masterSecret, { mode: 384 });
+  }
+  const secret = readFileSync16(KEY_FILE, "utf-8").trim();
+  return scryptSync2(secret, "nestor-vault-salt", 32);
+}
+function encryptApiKey(plainKey) {
+  const key = getVaultKey();
+  const iv = randomBytes7(16);
+  const cipher = createCipheriv2(ALGORITHM2, key, iv);
+  let encrypted = cipher.update(plainKey, "utf8", "hex");
+  encrypted += cipher.final("hex");
+  const authTag = cipher.getAuthTag().toString("hex");
+  return `${iv.toString("hex")}:${authTag}:${encrypted}`;
+}
+function decryptApiKey(encryptedStr) {
+  const key = getVaultKey();
+  const parts = encryptedStr.split(":");
+  if (parts.length !== 3) {
+    throw new Error("Invalid encrypted key format");
+  }
+  const [ivHex, authTagHex, encrypted] = parts;
+  const iv = Buffer.from(ivHex, "hex");
+  const authTag = Buffer.from(authTagHex, "hex");
+  const decipher = createDecipheriv2(ALGORITHM2, key, iv);
+  decipher.setAuthTag(authTag);
+  let decrypted = decipher.update(encrypted, "hex", "utf8");
+  decrypted += decipher.final("utf8");
+  return decrypted;
+}
+function maskKey(key) {
+  if (key.length <= 8) return "\u2022\u2022\u2022\u2022\u2022\u2022\u2022\u2022";
+  return key.slice(0, 4) + "\u2022".repeat(Math.min(key.length - 8, 20)) + key.slice(-4);
+}
+function loadApiKeysIntoEnv(store, tenantId = "default") {
+  try {
+    if (!store.listApiKeysRaw) return;
+    const keys = store.listApiKeysRaw(tenantId);
+    for (const { provider, keyEncrypted } of keys) {
+      const envVar = PROVIDER_ENV_MAP[provider];
+      if (envVar && !process.env[envVar]) {
+        try {
+          process.env[envVar] = decryptApiKey(keyEncrypted);
+        } catch {
+        }
+      }
+    }
+  } catch {
+  }
+}
+var ALGORITHM2, KEY_FILE, PROVIDER_ENV_MAP;
+var init_key_vault = __esm({
+  "../server/src/services/key-vault.ts"() {
+    "use strict";
+    ALGORITHM2 = "aes-256-gcm";
+    KEY_FILE = join17(homedir5(), ".nestor", ".vault-key");
+    PROVIDER_ENV_MAP = {
+      claude: "ANTHROPIC_API_KEY",
+      openai: "OPENAI_API_KEY",
+      gemini: "GEMINI_API_KEY",
+      grok: "XAI_API_KEY",
+      mistral: "MISTRAL_API_KEY",
+      ollama: ""
+      // Ollama doesn't need an API key
+    };
+  }
+});
+
+// ../server/src/routes/api-keys.ts
+import { Router as Router39 } from "express";
+function isValidProvider(p8) {
+  return VALID_PROVIDERS.includes(p8);
+}
+async function testClaude(apiKey) {
+  try {
+    const res = await fetch("https://api.anthropic.com/v1/messages", {
+      method: "POST",
+      headers: {
+        "Content-Type": "application/json",
+        "x-api-key": apiKey,
+        "anthropic-version": "2023-06-01"
+      },
+      body: JSON.stringify({
+        model: "claude-sonnet-4-20250514",
+        max_tokens: 1,
+        messages: [{ role: "user", content: "Hi" }]
+      })
+    });
+    if (res.ok) {
+      return { valid: true, message: "API key is valid. Claude is accessible." };
+    }
+    const body = await res.json().catch(() => ({}));
+    const errMsg = body?.error?.message || res.statusText;
+    if (res.status === 401) return { valid: false, message: `Invalid API key: ${errMsg}` };
+    if (res.status === 429 || res.status === 400) {
+      return { valid: true, message: `Key accepted (status ${res.status}: ${errMsg})` };
+    }
+    return { valid: false, message: `API error ${res.status}: ${errMsg}` };
+  } catch (err) {
+    return { valid: false, message: `Connection failed: ${err.message}` };
+  }
+}
+async function testOpenAI(apiKey) {
+  try {
+    const res = await fetch("https://api.openai.com/v1/models", {
+      headers: { Authorization: `Bearer ${apiKey}` }
+    });
+    if (res.ok) {
+      const body = await res.json();
+      const models = (body.data || []).slice(0, 10).map((m) => m.id);
+      return { valid: true, message: "API key is valid.", models };
+    }
+    if (res.status === 401) return { valid: false, message: "Invalid API key." };
+    return { valid: false, message: `API error ${res.status}: ${res.statusText}` };
+  } catch (err) {
+    return { valid: false, message: `Connection failed: ${err.message}` };
+  }
+}
+async function testGemini(apiKey) {
+  try {
+    const res = await fetch(`https://generativelanguage.googleapis.com/v1beta/models?key=${apiKey}`);
+    if (res.ok) {
+      const body = await res.json();
+      const models = (body.models || []).slice(0, 10).map((m) => m.name.replace("models/", ""));
+      return { valid: true, message: "API key is valid.", models };
+    }
+    if (res.status === 400 || res.status === 403) {
+      return { valid: false, message: "Invalid API key." };
+    }
+    return { valid: false, message: `API error ${res.status}: ${res.statusText}` };
+  } catch (err) {
+    return { valid: false, message: `Connection failed: ${err.message}` };
+  }
+}
+async function testGrok(apiKey) {
+  try {
+    const res = await fetch("https://api.x.ai/v1/models", {
+      headers: { Authorization: `Bearer ${apiKey}` }
+    });
+    if (res.ok) {
+      const body = await res.json();
+      const models = (body.data || []).slice(0, 10).map((m) => m.id);
+      return { valid: true, message: "API key is valid.", models };
+    }
+    if (res.status === 401) return { valid: false, message: "Invalid API key." };
+    return { valid: false, message: `API error ${res.status}: ${res.statusText}` };
+  } catch (err) {
+    return { valid: false, message: `Connection failed: ${err.message}` };
+  }
+}
+async function testMistral(apiKey) {
+  try {
+    const res = await fetch("https://api.mistral.ai/v1/models", {
+      headers: { Authorization: `Bearer ${apiKey}` }
+    });
+    if (res.ok) {
+      const body = await res.json();
+      const models = (body.data || []).slice(0, 10).map((m) => m.id);
+      return { valid: true, message: "API key is valid.", models };
+    }
+    if (res.status === 401) return { valid: false, message: "Invalid API key." };
+    return { valid: false, message: `API error ${res.status}: ${res.statusText}` };
+  } catch (err) {
+    return { valid: false, message: `Connection failed: ${err.message}` };
+  }
+}
+async function testOllama() {
+  const baseUrl = process.env.OLLAMA_BASE_URL || "http://localhost:11434";
+  try {
+    const res = await fetch(`${baseUrl}/api/tags`);
+    if (res.ok) {
+      const body = await res.json();
+      const models = (body.models || []).map((m) => m.name);
+      return { valid: true, message: `Ollama is running at ${baseUrl}.`, models };
+    }
+    return { valid: false, message: `Ollama returned ${res.status}: ${res.statusText}` };
+  } catch (err) {
+    return { valid: false, message: `Ollama not reachable at ${baseUrl}: ${err.message}` };
+  }
+}
+function apiKeyRoutes(db) {
+  const router = Router39();
+  router.get("/", (req, res) => {
+    const tenantId = req.tenantId || "default";
+    const dbKeys = db.listProviderKeys(tenantId);
+    const dbProviders = new Set(dbKeys.map((k) => k.provider));
+    const result = [];
+    for (const provider of VALID_PROVIDERS) {
+      const envVar = PROVIDER_ENV_MAP[provider];
+      const dbEntry = dbKeys.find((k) => k.provider === provider);
+      if (dbEntry) {
+        try {
+          const encrypted = db.getApiKey(provider, tenantId);
+          const decrypted = encrypted ? decryptApiKey(encrypted) : "";
+          result.push({
+            provider,
+            configured: true,
+            source: "db",
+            maskedKey: decrypted ? maskKey(decrypted) : null,
+            label: dbEntry.label,
+            createdAt: dbEntry.createdAt,
+            updatedAt: dbEntry.updatedAt
+          });
+        } catch {
+          result.push({
+            provider,
+            configured: true,
+            source: "db",
+            maskedKey: "\u2022\u2022\u2022\u2022\u2022\u2022\u2022\u2022",
+            label: dbEntry.label,
+            createdAt: dbEntry.createdAt,
+            updatedAt: dbEntry.updatedAt
+          });
+        }
+      } else if (envVar && process.env[envVar]) {
+        result.push({
+          provider,
+          configured: true,
+          source: "env",
+          maskedKey: maskKey(process.env[envVar]),
+          label: "From environment variable",
+          createdAt: null,
+          updatedAt: null
+        });
+      } else if (provider === "ollama") {
+        result.push({
+          provider,
+          configured: true,
+          source: "none",
+          maskedKey: null,
+          label: "Local \u2014 no key required",
+          createdAt: null,
+          updatedAt: null
+        });
+      } else {
+        result.push({
+          provider,
+          configured: false,
+          source: "none",
+          maskedKey: null,
+          label: "",
+          createdAt: null,
+          updatedAt: null
+        });
+      }
+    }
+    res.json({ data: result });
+  });
+  router.post("/", (req, res) => {
+    const tenantId = req.tenantId || "default";
+    const { provider, key, label } = req.body;
+    if (!provider || !isValidProvider(provider)) {
+      res.status(400).json({
+        error: { code: "INVALID_PROVIDER", message: `Provider must be one of: ${VALID_PROVIDERS.join(", ")}` }
+      });
+      return;
+    }
+    if (!key || typeof key !== "string" || key.trim().length === 0) {
+      res.status(400).json({
+        error: { code: "INVALID_KEY", message: "API key is required and must be a non-empty string." }
+      });
+      return;
+    }
+    const encrypted = encryptApiKey(key.trim());
+    db.setApiKey(provider, encrypted, tenantId, label || "");
+    const envVar = PROVIDER_ENV_MAP[provider];
+    if (envVar) {
+      process.env[envVar] = key.trim();
+    }
+    res.json({
+      data: {
+        provider,
+        configured: true,
+        source: "db",
+        maskedKey: maskKey(key.trim()),
+        label: label || ""
+      },
+      message: `API key for ${provider} saved successfully.`
+    });
+  });
+  router.delete("/:provider", (req, res) => {
+    const tenantId = req.tenantId || "default";
+    const { provider } = req.params;
+    if (!isValidProvider(provider)) {
+      res.status(400).json({
+        error: { code: "INVALID_PROVIDER", message: `Provider must be one of: ${VALID_PROVIDERS.join(", ")}` }
+      });
+      return;
+    }
+    const deleted = db.deleteProviderKey(provider, tenantId);
+    const envVar = PROVIDER_ENV_MAP[provider];
+    if (envVar) {
+      delete process.env[envVar];
+    }
+    if (deleted) {
+      res.json({ message: `API key for ${provider} removed.` });
+    } else {
+      res.status(404).json({
+        error: { code: "NOT_FOUND", message: `No API key found for provider: ${provider}` }
+      });
+    }
+  });
+  router.get("/test/:provider", async (req, res) => {
+    const tenantId = req.tenantId || "default";
+    const { provider } = req.params;
+    if (!isValidProvider(provider)) {
+      res.status(400).json({
+        error: { code: "INVALID_PROVIDER", message: `Provider must be one of: ${VALID_PROVIDERS.join(", ")}` }
+      });
+      return;
+    }
+    let apiKey = null;
+    const encrypted = db.getApiKey(provider, tenantId);
+    if (encrypted) {
+      try {
+        apiKey = decryptApiKey(encrypted);
+      } catch {
+      }
+    }
+    if (!apiKey) {
+      const envVar = PROVIDER_ENV_MAP[provider];
+      if (envVar && process.env[envVar]) {
+        apiKey = process.env[envVar];
+      }
+    }
+    if (provider === "ollama") {
+      apiKey = "";
+    }
+    if (apiKey === null) {
+      res.json({
+        data: { valid: false, message: "No API key configured for this provider." }
+      });
+      return;
+    }
+    try {
+      const testFn = TEST_FUNCTIONS[provider];
+      const result = await testFn(apiKey);
+      res.json({ data: result });
+    } catch (err) {
+      res.json({
+        data: { valid: false, message: `Test failed: ${err.message}` }
+      });
+    }
+  });
+  return router;
+}
+var VALID_PROVIDERS, TEST_FUNCTIONS;
+var init_api_keys = __esm({
+  "../server/src/routes/api-keys.ts"() {
+    "use strict";
+    init_key_vault();
+    VALID_PROVIDERS = ["claude", "openai", "gemini", "grok", "mistral", "ollama"];
+    TEST_FUNCTIONS = {
+      claude: testClaude,
+      openai: testOpenAI,
+      gemini: testGemini,
+      grok: testGrok,
+      mistral: testMistral,
+      ollama: () => testOllama()
+    };
+  }
+});
+
 // ../server/src/app.ts
 import express from "express";
-import { resolve as resolve13, join as join17 } from "node:path";
-import { existsSync as existsSync11 } from "node:fs";
+import { resolve as resolve13, join as join18 } from "node:path";
+import { existsSync as existsSync12 } from "node:fs";
 import compression from "compression";
 import cors from "cors";
 function getStudioState() {
@@ -144539,6 +145214,10 @@ function createApp(config2) {
   const anomalyDetector = new AnomalyDetector();
   const incidentResponder = new IncidentResponder(config2.db, anomalyDetector, auditLogger);
   const securityCtx = { anomalyDetector, auditLogger, incidentResponder };
+  try {
+    loadApiKeysIntoEnv(config2.db);
+  } catch {
+  }
   const corsOrigins = config2.corsConfig?.allowedOrigins ?? [];
   const corsOptions = {
     origin: (origin, callback) => {
@@ -144673,6 +145352,7 @@ function createApp(config2) {
   app.use("/api/execution", executionRoutes(authService));
   app.use("/api/chat", chatRoutes(config2.db));
   app.use("/api/providers", providerRoutes());
+  app.use("/api/keys", apiKeyRoutes(config2.db));
   app.use("/api/audit", auditRoutes(config2.db));
   app.use("/api/admin", adminMiddleware(config2.apiKey), adminRoutes(config2.db));
   app.get("/api/docs/openapi.json", (_req, res) => {
@@ -144738,7 +145418,7 @@ function createApp(config2) {
   }
   for (const dir of candidateDirs) {
     try {
-      if (existsSync11(join17(dir, "index.html"))) {
+      if (existsSync12(join18(dir, "index.html"))) {
         studioDistDir = dir;
         break;
       }
@@ -144762,7 +145442,7 @@ function createApp(config2) {
       if (!studioState.enabled) {
         return res.status(403).json({ error: { code: "STUDIO_DISABLED", message: "Studio is disabled." } });
       }
-      res.sendFile(join17(studioDistDir, "index.html"));
+      res.sendFile(join18(studioDistDir, "index.html"));
     });
     app.use("/studio", express.static(studioDistDir, { index: false }));
     app.use(express.static(studioDistDir, { index: false }));
@@ -144770,7 +145450,7 @@ function createApp(config2) {
       if (!studioState.enabled) {
         return res.status(403).json({ error: { code: "STUDIO_DISABLED", message: "Studio is disabled." } });
       }
-      res.sendFile(join17(studioDistDir, "index.html"));
+      res.sendFile(join18(studioDistDir, "index.html"));
     });
   } else {
     app.get("/studio", (_req, res) => {
@@ -144798,7 +145478,7 @@ function createApp(config2) {
       if (!studioState.enabled) {
         return res.status(403).json({ error: { code: "STUDIO_DISABLED", message: "Studio is disabled." } });
       }
-      res.sendFile(join17(studioDistDir, "index.html"));
+      res.sendFile(join18(studioDistDir, "index.html"));
     });
   }
   app.use(errorHandler());
@@ -144865,12 +145545,14 @@ var init_app = __esm({
     init_knowledge2();
     init_chat();
     init_providers();
+    init_api_keys();
+    init_key_vault();
     studioState = { enabled: true };
   }
 });
 
 // ../server/src/services/config-watcher.ts
-import { watch, existsSync as existsSync12 } from "node:fs";
+import { watch, existsSync as existsSync13 } from "node:fs";
 import { readFile as readFile2 } from "node:fs/promises";
 var ConfigWatcher;
 var init_config_watcher = __esm({
@@ -144894,7 +145576,7 @@ var init_config_watcher = __esm({
        */
       async start() {
         await this.reload();
-        if (existsSync12(this.configPath)) {
+        if (existsSync13(this.configPath)) {
           this.watcher = watch(this.configPath, { persistent: false }, (eventType) => {
             if (eventType === "change") {
               if (this.debounceTimer) clearTimeout(this.debounceTimer);
@@ -144930,7 +145612,7 @@ var init_config_watcher = __esm({
       // ─── Internal ───────────────────────────────────────────────────────
       async reload() {
         try {
-          if (!existsSync12(this.configPath)) {
+          if (!existsSync13(this.configPath)) {
             console.warn("[config-watcher] Config file not found, keeping current config.");
             return;
           }
@@ -144974,9 +145656,9 @@ __export(telemetry_exports, {
   resetTelemetry: () => resetTelemetry
 });
 import { randomUUID as randomUUID35 } from "node:crypto";
-import { existsSync as existsSync13, readFileSync as readFileSync16, writeFileSync as writeFileSync8, appendFileSync as appendFileSync2, mkdirSync as mkdirSync6 } from "node:fs";
-import { join as join18 } from "node:path";
-import { homedir as homedir5 } from "node:os";
+import { existsSync as existsSync14, readFileSync as readFileSync17, writeFileSync as writeFileSync9, appendFileSync as appendFileSync2, mkdirSync as mkdirSync7 } from "node:fs";
+import { join as join19 } from "node:path";
+import { homedir as homedir6 } from "node:os";
 function getTelemetry(config2) {
   if (!_instance2) {
     _instance2 = new TelemetryService(config2 ?? { enabled: false, flushIntervalMs: 6e4 });
@@ -144991,9 +145673,9 @@ var init_telemetry2 = __esm({
   "../server/src/services/telemetry.ts"() {
     "use strict";
     VERSION2 = "0.1.0";
-    DATA_DIR3 = join18(homedir5(), ".nestor");
-    TELEMETRY_ID_FILE = join18(DATA_DIR3, "telemetry-id");
-    TELEMETRY_LOG_FILE = join18(DATA_DIR3, "telemetry.jsonl");
+    DATA_DIR3 = join19(homedir6(), ".nestor");
+    TELEMETRY_ID_FILE = join19(DATA_DIR3, "telemetry-id");
+    TELEMETRY_LOG_FILE = join19(DATA_DIR3, "telemetry.jsonl");
     DEFAULT_FLUSH_THRESHOLD = 10;
     TelemetryService = class {
       enabled;
@@ -145086,8 +145768,8 @@ var init_telemetry2 = __esm({
       // ─── Private ─────────────────────────────────────────────────────────
       getOrCreateInstallId() {
         try {
-          if (existsSync13(TELEMETRY_ID_FILE)) {
-            const id = readFileSync16(TELEMETRY_ID_FILE, "utf-8").trim();
+          if (existsSync14(TELEMETRY_ID_FILE)) {
+            const id = readFileSync17(TELEMETRY_ID_FILE, "utf-8").trim();
             if (id.length > 0) return id;
           }
         } catch {
@@ -145095,14 +145777,14 @@ var init_telemetry2 = __esm({
         const newId = randomUUID35();
         try {
           this.ensureDataDir();
-          writeFileSync8(TELEMETRY_ID_FILE, newId + "\n", "utf-8");
+          writeFileSync9(TELEMETRY_ID_FILE, newId + "\n", "utf-8");
         } catch {
         }
         return newId;
       }
       ensureDataDir() {
-        if (!existsSync13(DATA_DIR3)) {
-          mkdirSync6(DATA_DIR3, { recursive: true });
+        if (!existsSync14(DATA_DIR3)) {
+          mkdirSync7(DATA_DIR3, { recursive: true });
         }
       }
       startFlushTimer() {
@@ -156688,7 +157370,7 @@ var require_dist12 = __commonJS({
 });
 
 // ../skill-tester/src/yaml-loader.ts
-import { readFileSync as readFileSync17 } from "node:fs";
+import { readFileSync as readFileSync18 } from "node:fs";
 function parseYamlContent(content) {
   try {
     return JSON.parse(content);
@@ -156804,7 +157486,7 @@ var init_yaml_loader = __esm({
        * Load a YAML test suite from a file path.
        */
       static loadFile(filePath) {
-        const content = readFileSync17(filePath, "utf-8");
+        const content = readFileSync18(filePath, "utf-8");
         return _YamlTestLoader.parse(content);
       }
       /**
@@ -156883,8 +157565,8 @@ var init_yaml_loader = __esm({
 });
 
 // ../skill-tester/src/runner.ts
-import { readFileSync as readFileSync18, readdirSync as readdirSync4, statSync as statSync5, existsSync as existsSync15, mkdirSync as mkdirSync8, rmSync as rmSync2 } from "node:fs";
-import { join as join20, resolve as resolve14 } from "node:path";
+import { readFileSync as readFileSync19, readdirSync as readdirSync4, statSync as statSync5, existsSync as existsSync16, mkdirSync as mkdirSync9, rmSync as rmSync2 } from "node:fs";
+import { join as join21, resolve as resolve14 } from "node:path";
 import { tmpdir as tmpdir4 } from "node:os";
 import { randomUUID as randomUUID37 } from "node:crypto";
 var SequentialMockAdapter, SkillTestRunner;
@@ -156959,25 +157641,25 @@ var init_runner2 = __esm({
         try {
           const mockResponses = test.mockResponses.length > 0 ? test.mockResponses : [{ content: "Test completed." }];
           const adapter = new SequentialMockAdapter(mockResponses);
-          const tempDir = join20(tmpdir4(), `nestor-skill-test-${randomUUID37()}`);
-          mkdirSync8(tempDir, { recursive: true });
+          const tempDir = join21(tmpdir4(), `nestor-skill-test-${randomUUID37()}`);
+          mkdirSync9(tempDir, { recursive: true });
           try {
             const agentModule = await Promise.resolve().then(() => (init_src5(), src_exports3));
             const events = new agentModule.RuntimeEventBus();
             const tools = new agentModule.ToolRegistry();
             const toolExecutor = new agentModule.ToolExecutor();
             let instructions = "You are a helpful AI assistant.";
-            if (test.skill && existsSync15(test.skill)) {
-              instructions = readFileSync18(test.skill, "utf-8");
+            if (test.skill && existsSync16(test.skill)) {
+              instructions = readFileSync19(test.skill, "utf-8");
             } else if (test.skill) {
               const skillPaths = [
-                join20(process.cwd(), ".nestor", "skills", test.skill, "SKILL.md"),
-                join20(process.cwd(), "skills", test.skill, "SKILL.md"),
-                join20(process.cwd(), "skills-registry", test.skill, "SKILL.md")
+                join21(process.cwd(), ".nestor", "skills", test.skill, "SKILL.md"),
+                join21(process.cwd(), "skills", test.skill, "SKILL.md"),
+                join21(process.cwd(), "skills-registry", test.skill, "SKILL.md")
               ];
               for (const p8 of skillPaths) {
-                if (existsSync15(p8)) {
-                  instructions = readFileSync18(p8, "utf-8");
+                if (existsSync16(p8)) {
+                  instructions = readFileSync19(p8, "utf-8");
                   break;
                 }
               }
@@ -157187,7 +157869,7 @@ var init_runner2 = __esm({
       discoverTestFiles(dir) {
         const files = [];
         const resolvedDir = resolve14(dir);
-        if (!existsSync15(resolvedDir)) return files;
+        if (!existsSync16(resolvedDir)) return files;
         const stat = statSync5(resolvedDir);
         if (!stat.isDirectory()) {
           return [resolvedDir];
@@ -157201,7 +157883,7 @@ var init_runner2 = __esm({
           }
           for (const entry of entries) {
             if (entry === "node_modules" || entry === ".git" || entry === "dist") continue;
-            const fullPath = join20(current, entry);
+            const fullPath = join21(current, entry);
             try {
               const s = statSync5(fullPath);
               if (s.isDirectory()) {
@@ -159071,7 +159753,7 @@ var init_server = __esm({
     MCP_PROTOCOL_VERSION = "2024-11-05";
     SERVER_INFO = {
       name: "nestor",
-      version: "2.1.0"
+      version: "2.1.1"
     };
     SERVER_CAPABILITIES = {
       tools: { listChanged: false },
@@ -159257,9 +159939,9 @@ __export(shell_exports, {
   registerShellCommand: () => registerShellCommand
 });
 import * as readline3 from "node:readline";
-import { existsSync as existsSync16, readFileSync as readFileSync19, writeFileSync as writeFileSync10, mkdirSync as mkdirSync9, appendFileSync as appendFileSync3 } from "node:fs";
-import { join as join21, resolve as resolve15, dirname as dirname9, basename as basename4 } from "node:path";
-import { homedir as homedir6 } from "node:os";
+import { existsSync as existsSync17, readFileSync as readFileSync20, writeFileSync as writeFileSync11, mkdirSync as mkdirSync10, appendFileSync as appendFileSync3 } from "node:fs";
+import { join as join22, resolve as resolve15, dirname as dirname10, basename as basename4 } from "node:path";
+import { homedir as homedir7 } from "node:os";
 import { readdirSync as readdirSync5 } from "node:fs";
 import { randomUUID as randomUUID43 } from "node:crypto";
 import chalk11 from "chalk";
@@ -159291,8 +159973,8 @@ async function startShell() {
     currentRouter: null,
     verbose: false
   };
-  if (!existsSync16(NESTOR_DIR)) {
-    mkdirSync9(NESTOR_DIR, { recursive: true });
+  if (!existsSync17(NESTOR_DIR)) {
+    mkdirSync10(NESTOR_DIR, { recursive: true });
   }
   refreshAgentNameCache(session);
   const history = loadHistory();
@@ -160012,8 +160694,8 @@ function cmdExport(args2, session) {
         timestamp: new Date(e.timestamp).toISOString()
       }))
     };
-    const filename = join21(NESTOR_DIR, `conversation-${timestamp}.json`);
-    writeFileSync10(filename, JSON.stringify(data, null, 2), "utf-8");
+    const filename = join22(NESTOR_DIR, `conversation-${timestamp}.json`);
+    writeFileSync11(filename, JSON.stringify(data, null, 2), "utf-8");
     console.log(chalk11.green(`Exported to: ${filename}`));
     return;
   }
@@ -160037,8 +160719,8 @@ function cmdExport(args2, session) {
       lines.push(entry.content);
       lines.push("");
     }
-    const filename = join21(NESTOR_DIR, `conversation-${timestamp}.md`);
-    writeFileSync10(filename, lines.join("\n"), "utf-8");
+    const filename = join22(NESTOR_DIR, `conversation-${timestamp}.md`);
+    writeFileSync11(filename, lines.join("\n"), "utf-8");
     console.log(chalk11.green(`Exported to: ${filename}`));
     return;
   }
@@ -160074,8 +160756,8 @@ ${rows}
 <div class="stats">Tokens: ${fmtNum(session.totalTokensIn)} in / ${fmtNum(session.totalTokensOut)} out | Cost: $${session.totalCostUsd.toFixed(4)} | Tool calls: ${session.totalToolCalls}</div>
 </body>
 </html>`;
-    const filename = join21(NESTOR_DIR, `conversation-${timestamp}.html`);
-    writeFileSync10(filename, html, "utf-8");
+    const filename = join22(NESTOR_DIR, `conversation-${timestamp}.html`);
+    writeFileSync11(filename, html, "utf-8");
     console.log(chalk11.green(`Exported to: ${filename}`));
   }
 }
@@ -160580,7 +161262,7 @@ function createUnifiedDiff(oldText, newText, fileName) {
 function showDiffForStep(filePath, newContent) {
   try {
     const absolutePath = resolve15(process.cwd(), filePath);
-    const oldContent = readFileSync19(absolutePath, "utf-8");
+    const oldContent = readFileSync20(absolutePath, "utf-8");
     const diff = createUnifiedDiff(oldContent, newContent, filePath);
     for (const line of diff.split("\n")) {
       if (line.startsWith("+") && !line.startsWith("+++")) {
@@ -160986,11 +161668,11 @@ function completeFilePath(partial) {
         dir = resolved;
         prefix = partial.endsWith("/") || partial.endsWith("\\") ? partial : partial + "/";
       } else {
-        dir = dirname9(resolved);
+        dir = dirname10(resolved);
         prefix = partial.substring(0, partial.lastIndexOf("/") + 1) || partial.substring(0, partial.lastIndexOf("\\") + 1);
       }
     } catch {
-      dir = dirname9(resolved);
+      dir = dirname10(resolved);
       prefix = partial.substring(0, Math.max(partial.lastIndexOf("/"), partial.lastIndexOf("\\")) + 1);
     }
     const entries = readdirSync5(dir, { withFileTypes: true });
@@ -161024,8 +161706,8 @@ function refreshAgentNameCache(session) {
 }
 function loadHistory() {
   try {
-    if (existsSync16(HISTORY_FILE)) {
-      const raw = readFileSync19(HISTORY_FILE, "utf-8");
+    if (existsSync17(HISTORY_FILE)) {
+      const raw = readFileSync20(HISTORY_FILE, "utf-8");
       return raw.split("\n").filter((l) => l.trim().length > 0).slice(-MAX_HISTORY);
     }
   } catch {
@@ -161036,8 +161718,8 @@ function saveHistory(rl) {
 }
 function appendToHistoryFile(line) {
   try {
-    if (!existsSync16(NESTOR_DIR)) {
-      mkdirSync9(NESTOR_DIR, { recursive: true });
+    if (!existsSync17(NESTOR_DIR)) {
+      mkdirSync10(NESTOR_DIR, { recursive: true });
     }
     appendFileSync3(HISTORY_FILE, line + "\n", "utf-8");
   } catch {
@@ -161379,8 +162061,8 @@ var init_shell = __esm({
     init_config2();
     init_spinner();
     init_table();
-    NESTOR_DIR = join21(homedir6(), ".nestor");
-    HISTORY_FILE = join21(NESTOR_DIR, "shell_history");
+    NESTOR_DIR = join22(homedir7(), ".nestor");
+    HISTORY_FILE = join22(NESTOR_DIR, "shell_history");
     MAX_HISTORY = 1e3;
     SLASH_COMMANDS = {
       "/help": { description: "Show all commands", usage: "/help" },
@@ -161432,9 +162114,9 @@ var init_shell = __esm({
 
 // src/index.ts
 import { Command } from "commander";
-import { existsSync as existsSync20, readFileSync as readFileSync23 } from "node:fs";
-import { join as join24 } from "node:path";
-import { homedir as homedir9 } from "node:os";
+import { existsSync as existsSync21, readFileSync as readFileSync24 } from "node:fs";
+import { join as join25 } from "node:path";
+import { homedir as homedir10 } from "node:os";
 
 // src/commands/start.ts
 init_config2();
@@ -161578,16 +162260,16 @@ init_config();
 init_config2();
 import * as p from "@clack/prompts";
 import chalk2 from "chalk";
-import { mkdirSync as mkdirSync7, existsSync as existsSync14 } from "node:fs";
-import { join as join19 } from "node:path";
-import { randomBytes as randomBytes7 } from "node:crypto";
+import { mkdirSync as mkdirSync8, existsSync as existsSync15 } from "node:fs";
+import { join as join20 } from "node:path";
+import { randomBytes as randomBytes8 } from "node:crypto";
 function generateApiKey() {
-  return `nst_${randomBytes7(32).toString("hex")}`;
+  return `nst_${randomBytes8(32).toString("hex")}`;
 }
 function randomSegment() {
   const chars = "ABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789";
   let result = "";
-  const bytes = randomBytes7(4);
+  const bytes = randomBytes8(4);
   for (let i = 0; i < 4; i++) {
     result += chars[bytes[i] % chars.length];
   }
@@ -161598,7 +162280,7 @@ function generateBetaKey() {
 }
 async function initializeDatabase(dataDir) {
   const { NestorStore: NestorStore2 } = await Promise.resolve().then(() => (init_src2(), src_exports));
-  const dbPath = join19(dataDir, "nestor.db");
+  const dbPath = join20(dataDir, "nestor.db");
   const store = await NestorStore2.open(dbPath);
   store.close();
 }
@@ -161646,31 +162328,31 @@ async function runNonInteractiveInstall() {
   console.log();
   const config2 = buildConfigFromDefaults();
   const dataDir = expandPath(config2.server.dataDir);
-  if (!existsSync14(dataDir)) {
-    mkdirSync7(dataDir, { recursive: true });
+  if (!existsSync15(dataDir)) {
+    mkdirSync8(dataDir, { recursive: true });
     console.log(chalk2.green("  Created data directory:"), dataDir);
   }
   for (const sub of ["adapters", "skills", "plugins", "logs"]) {
-    const subDir = join19(dataDir, sub);
-    if (!existsSync14(subDir)) {
-      mkdirSync7(subDir, { recursive: true });
+    const subDir = join20(dataDir, sub);
+    if (!existsSync15(subDir)) {
+      mkdirSync8(subDir, { recursive: true });
     }
   }
   writeConfigFile(config2);
   console.log(chalk2.green("  Configuration saved:"), getConfigPath());
   try {
     await initializeDatabase(dataDir);
-    console.log(chalk2.green("  Database initialized:"), join19(dataDir, "nestor.db"));
+    console.log(chalk2.green("  Database initialized:"), join20(dataDir, "nestor.db"));
   } catch (err) {
     console.log(chalk2.yellow("  Database initialization skipped (install @nestor/db first)"));
   }
   const apiKey = generateApiKey();
-  const apiKeyPath = join19(dataDir, ".api-keys");
-  const { writeFileSync: writeFileSync13 } = await import("node:fs");
-  writeFileSync13(apiKeyPath, JSON.stringify({ admin: apiKey }, null, 2) + "\n", "utf-8");
+  const apiKeyPath = join20(dataDir, ".api-keys");
+  const { writeFileSync: writeFileSync14 } = await import("node:fs");
+  writeFileSync14(apiKeyPath, JSON.stringify({ admin: apiKey }, null, 2) + "\n", "utf-8");
   console.log(chalk2.green("  Admin API key created"));
   const betaKey = generateBetaKey();
-  writeFileSync13(join19(dataDir, "license.key"), betaKey, "utf-8");
+  writeFileSync14(join20(dataDir, "license.key"), betaKey, "utf-8");
   console.log(chalk2.green("  Beta key created"));
   console.log();
   console.log(chalk2.bold("Admin API Key:"), chalk2.yellow(apiKey));
@@ -161766,9 +162448,9 @@ async function runInteractiveInstall() {
   const dataDir = expandPath(config2.server.dataDir);
   const spinner3 = p.spinner();
   spinner3.start("Creating directories...");
-  for (const dir of [dataDir, join19(dataDir, "adapters"), join19(dataDir, "skills"), join19(dataDir, "plugins"), join19(dataDir, "logs")]) {
-    if (!existsSync14(dir)) {
-      mkdirSync7(dir, { recursive: true });
+  for (const dir of [dataDir, join20(dataDir, "adapters"), join20(dataDir, "skills"), join20(dataDir, "plugins"), join20(dataDir, "logs")]) {
+    if (!existsSync15(dir)) {
+      mkdirSync8(dir, { recursive: true });
     }
   }
   spinner3.stop("Directories created");
@@ -161793,14 +162475,14 @@ async function runInteractiveInstall() {
   const spinner4 = p.spinner();
   spinner4.start("Generating admin API key...");
   const apiKey = generateApiKey();
-  const apiKeyPath = join19(dataDir, ".api-keys");
-  const { writeFileSync: writeFileSync13 } = await import("node:fs");
-  writeFileSync13(apiKeyPath, JSON.stringify({ admin: apiKey }, null, 2) + "\n", "utf-8");
+  const apiKeyPath = join20(dataDir, ".api-keys");
+  const { writeFileSync: writeFileSync14 } = await import("node:fs");
+  writeFileSync14(apiKeyPath, JSON.stringify({ admin: apiKey }, null, 2) + "\n", "utf-8");
   spinner4.stop("Admin API key created!");
   const spinner5 = p.spinner();
   spinner5.start("Generating beta key...");
   const betaKey = generateBetaKey();
-  writeFileSync13(join19(dataDir, "license.key"), betaKey, "utf-8");
+  writeFileSync14(join20(dataDir, "license.key"), betaKey, "utf-8");
   spinner5.stop("Beta key created!");
   p.note(
     `Config file:     ${getConfigPath()}
@@ -163093,23 +163775,23 @@ init_db();
 init_spinner();
 init_table();
 import {
-  existsSync as existsSync17,
-  readFileSync as readFileSync20,
-  writeFileSync as writeFileSync11,
-  mkdirSync as mkdirSync10,
+  existsSync as existsSync18,
+  readFileSync as readFileSync21,
+  writeFileSync as writeFileSync12,
+  mkdirSync as mkdirSync11,
   unlinkSync,
   appendFileSync as appendFileSync4
 } from "node:fs";
-import { join as join22 } from "node:path";
-import { homedir as homedir7 } from "node:os";
+import { join as join23 } from "node:path";
+import { homedir as homedir8 } from "node:os";
 import { fork as fork2 } from "node:child_process";
 import "node:readline";
 import chalk12 from "chalk";
-var NESTOR_DIR2 = join22(homedir7(), ".nestor");
-var PID_FILE = join22(NESTOR_DIR2, "daemon.pid");
-var LOG_DIR = join22(NESTOR_DIR2, "logs");
-var LOG_FILE = join22(LOG_DIR, "daemon.log");
-var HEARTBEAT_FILE = join22(NESTOR_DIR2, "daemon.heartbeat");
+var NESTOR_DIR2 = join23(homedir8(), ".nestor");
+var PID_FILE = join23(NESTOR_DIR2, "daemon.pid");
+var LOG_DIR = join23(NESTOR_DIR2, "logs");
+var LOG_FILE = join23(LOG_DIR, "daemon.log");
+var HEARTBEAT_FILE = join23(NESTOR_DIR2, "daemon.heartbeat");
 var HEARTBEAT_INTERVAL_MS2 = 3e4;
 function registerDaemonCommand(program2) {
   const daemon = program2.command("daemon").description("Manage the Nestor background daemon");
@@ -163277,13 +163959,13 @@ async function showStatus() {
   console.log("");
 }
 async function showLogs(follow, lineCount) {
-  if (!existsSync17(LOG_FILE)) {
+  if (!existsSync18(LOG_FILE)) {
     console.log(chalk12.yellow("No daemon log file found."));
     console.log(chalk12.dim(`Expected at: ${LOG_FILE}`));
     return;
   }
   if (!follow) {
-    const content = readFileSync20(LOG_FILE, "utf-8");
+    const content = readFileSync21(LOG_FILE, "utf-8");
     const lines = content.split("\n").filter((l) => l.length > 0);
     const lastLines = lines.slice(-lineCount);
     if (lastLines.length === 0) {
@@ -163297,19 +163979,19 @@ async function showLogs(follow, lineCount) {
   }
   console.log(chalk12.dim(`Following ${LOG_FILE}... (Ctrl+C to stop)`));
   console.log("");
-  if (existsSync17(LOG_FILE)) {
-    const content = readFileSync20(LOG_FILE, "utf-8");
+  if (existsSync18(LOG_FILE)) {
+    const content = readFileSync21(LOG_FILE, "utf-8");
     const lines = content.split("\n").filter((l) => l.length > 0);
     const lastLines = lines.slice(-10);
     for (const line of lastLines) {
       console.log(colorizeLogLine(line));
     }
   }
-  let lastSize = existsSync17(LOG_FILE) ? readFileSync20(LOG_FILE).length : 0;
+  let lastSize = existsSync18(LOG_FILE) ? readFileSync21(LOG_FILE).length : 0;
   const watcher = setInterval(() => {
     try {
-      if (!existsSync17(LOG_FILE)) return;
-      const content = readFileSync20(LOG_FILE, "utf-8");
+      if (!existsSync18(LOG_FILE)) return;
+      const content = readFileSync21(LOG_FILE, "utf-8");
       if (content.length > lastSize) {
         const newContent = content.substring(lastSize);
         const newLines = newContent.split("\n").filter((l) => l.length > 0);
@@ -163619,7 +164301,7 @@ var DaemonRunner = class {
         activeAgents: this.runningAgents.size,
         nextScheduledRun: void 0
       };
-      writeFileSync11(HEARTBEAT_FILE, JSON.stringify(data), "utf-8");
+      writeFileSync12(HEARTBEAT_FILE, JSON.stringify(data), "utf-8");
     } catch {
     }
   }
@@ -163637,8 +164319,8 @@ async function importDaemonAgentModule() {
 }
 function readHeartbeat() {
   try {
-    if (existsSync17(HEARTBEAT_FILE)) {
-      const raw = readFileSync20(HEARTBEAT_FILE, "utf-8");
+    if (existsSync18(HEARTBEAT_FILE)) {
+      const raw = readFileSync21(HEARTBEAT_FILE, "utf-8");
       return JSON.parse(raw);
     }
   } catch {
@@ -163647,8 +164329,8 @@ function readHeartbeat() {
 }
 function readPid() {
   try {
-    if (existsSync17(PID_FILE)) {
-      const raw = readFileSync20(PID_FILE, "utf-8").trim();
+    if (existsSync18(PID_FILE)) {
+      const raw = readFileSync21(PID_FILE, "utf-8").trim();
       const pid = parseInt(raw, 10);
       return isNaN(pid) ? null : pid;
     }
@@ -163658,11 +164340,11 @@ function readPid() {
 }
 function writePid(pid) {
   ensureDirs();
-  writeFileSync11(PID_FILE, String(pid), "utf-8");
+  writeFileSync12(PID_FILE, String(pid), "utf-8");
 }
 function cleanupPid() {
   try {
-    if (existsSync17(PID_FILE)) {
+    if (existsSync18(PID_FILE)) {
       unlinkSync(PID_FILE);
     }
   } catch {
@@ -163702,11 +164384,11 @@ function colorizeLogLine(line) {
   return line;
 }
 function ensureDirs() {
-  if (!existsSync17(NESTOR_DIR2)) {
-    mkdirSync10(NESTOR_DIR2, { recursive: true });
+  if (!existsSync18(NESTOR_DIR2)) {
+    mkdirSync11(NESTOR_DIR2, { recursive: true });
   }
-  if (!existsSync17(LOG_DIR)) {
-    mkdirSync10(LOG_DIR, { recursive: true });
+  if (!existsSync18(LOG_DIR)) {
+    mkdirSync11(LOG_DIR, { recursive: true });
   }
 }
 function delay(ms) {
@@ -163747,13 +164429,13 @@ if (process.argv[2] === "__daemon_child__" || process.env.NESTOR_DAEMON_MODE ===
 
 // src/commands/watch.ts
 init_db();
-import { existsSync as existsSync18, readFileSync as readFileSync21 } from "node:fs";
-import { join as join23 } from "node:path";
-import { homedir as homedir8 } from "node:os";
+import { existsSync as existsSync19, readFileSync as readFileSync22 } from "node:fs";
+import { join as join24 } from "node:path";
+import { homedir as homedir9 } from "node:os";
 import chalk13 from "chalk";
-var NESTOR_DIR3 = join23(homedir8(), ".nestor");
-var HEARTBEAT_FILE2 = join23(NESTOR_DIR3, "daemon.heartbeat");
-var LOG_FILE2 = join23(NESTOR_DIR3, "logs", "daemon.log");
+var NESTOR_DIR3 = join24(homedir9(), ".nestor");
+var HEARTBEAT_FILE2 = join24(NESTOR_DIR3, "daemon.heartbeat");
+var LOG_FILE2 = join24(NESTOR_DIR3, "logs", "daemon.log");
 var REFRESH_INTERVAL_MS = 1e3;
 var MAX_EVENTS = 12;
 function registerWatchCommand(program2) {
@@ -163821,8 +164503,8 @@ async function refreshData(state) {
   } catch {
   }
   try {
-    if (existsSync18(HEARTBEAT_FILE2)) {
-      const raw = readFileSync21(HEARTBEAT_FILE2, "utf-8");
+    if (existsSync19(HEARTBEAT_FILE2)) {
+      const raw = readFileSync22(HEARTBEAT_FILE2, "utf-8");
       const heartbeat = JSON.parse(raw);
       state.daemonRunning = isDaemonAlive(heartbeat.pid);
       state.daemonPid = heartbeat.pid;
@@ -163839,8 +164521,8 @@ async function refreshData(state) {
 }
 function loadRecentEvents(state) {
   try {
-    if (!existsSync18(LOG_FILE2)) return;
-    const content = readFileSync21(LOG_FILE2, "utf-8");
+    if (!existsSync19(LOG_FILE2)) return;
+    const content = readFileSync22(LOG_FILE2, "utf-8");
     const lines = content.split("\n").filter((l) => l.length > 0);
     const recent = lines.slice(-MAX_EVENTS);
     state.recentEvents = recent.map((line) => {
@@ -164166,10 +164848,10 @@ function registerTelemetryCommand(program2) {
       }
       console.log(`  ${chalk15.dim("Flush:")}     every ${(config2.telemetry?.flushIntervalMs ?? 6e4) / 1e3}s`);
     }
-    const { join: join25 } = __require("node:path");
-    const { homedir: homedir10 } = __require("node:os");
-    const telemetryFile = join25(homedir10(), ".nestor", "telemetry.jsonl");
-    const idFile = join25(homedir10(), ".nestor", "telemetry-id");
+    const { join: join26 } = __require("node:path");
+    const { homedir: homedir11 } = __require("node:os");
+    const telemetryFile = join26(homedir11(), ".nestor", "telemetry.jsonl");
+    const idFile = join26(homedir11(), ".nestor", "telemetry-id");
     if (fs28.existsSync(idFile)) {
       const installId = fs28.readFileSync(idFile, "utf-8").trim();
       console.log(`  ${chalk15.dim("Install ID:")} ${installId.slice(0, 8)}...`);
@@ -164210,7 +164892,7 @@ function setTelemetryEnabled(enabled) {
 init_db();
 init_table();
 import chalk16 from "chalk";
-import { readFileSync as readFileSync22, writeFileSync as writeFileSync12 } from "node:fs";
+import { readFileSync as readFileSync23, writeFileSync as writeFileSync13 } from "node:fs";
 function registerMemoryCommand(program2) {
   const memory = program2.command("memory").description("Manage agent persistent memories");
   memory.command("list").description("List memories for an agent").option("-a, --agent <id>", "Agent ID to filter by").option("-t, --type <type>", "Memory type filter (observation, fact, instruction, reflection)").option("-l, --limit <n>", "Maximum results", "20").action(async (options) => {
@@ -164414,13 +165096,13 @@ Memory Statistics for ${agentId}`));
       }
     }
     const json = JSON.stringify(allMemories, null, 2);
-    writeFileSync12(outputFile, json, "utf-8");
+    writeFileSync13(outputFile, json, "utf-8");
     console.log(chalk16.green(`Exported ${allMemories.length} memories to ${outputFile}`));
   });
   memory.command("import <file>").description("Import memories from JSON").action(async (file) => {
     const store = await getStore();
     try {
-      const raw = readFileSync22(file, "utf-8");
+      const raw = readFileSync23(file, "utf-8");
       const entries = JSON.parse(raw);
       if (!Array.isArray(entries)) {
         console.error(chalk16.red("Invalid format: expected a JSON array of memory entries."));
@@ -164941,7 +165623,7 @@ ${results.length} results for "${query}":
 
 // src/commands/test.ts
 import { resolve as resolve17, relative as relative5 } from "node:path";
-import { readdirSync as readdirSync6, statSync as statSync6, existsSync as existsSync19 } from "node:fs";
+import { readdirSync as readdirSync6, statSync as statSync6, existsSync as existsSync20 } from "node:fs";
 import chalk20 from "chalk";
 var TEST_FILE_PATTERNS = [
   ".nestor-test.yaml",
@@ -164954,7 +165636,7 @@ function registerTestCommand(program2) {
   program2.command("test [path]").description("Run skill and agent test suites").option("-l, --list", "List discovered test files", false).option("-f, --file <file>", "Run a specific test file").option("-r, --record <file>", "Record LLM responses to a fixture file").option("-p, --prompt <prompt>", "Prompt for recording mode").option("-v, --verbose", "Show detailed test output", false).option("-j, --json", "Output results as JSON (for CI)", false).action(async (path30, opts) => {
     if (opts.file) {
       const filePath = resolve17(opts.file);
-      if (!existsSync19(filePath)) {
+      if (!existsSync20(filePath)) {
         console.error(chalk20.red(`File not found: ${opts.file}`));
         process.exit(1);
       }
@@ -164985,7 +165667,7 @@ function registerTestCommand(program2) {
     ];
     const allFiles = [];
     for (const testDir of defaultTestDirs) {
-      if (existsSync19(testDir)) {
+      if (existsSync20(testDir)) {
         allFiles.push(...discoverTestFiles(testDir));
       }
     }
@@ -165028,7 +165710,7 @@ function discoverTestFiles(dir) {
       }
     }
   }
-  if (existsSync19(dir) && !statSync6(dir).isDirectory()) {
+  if (existsSync20(dir) && !statSync6(dir).isDirectory()) {
     return [dir];
   }
   walk(dir);
@@ -165037,7 +165719,7 @@ function discoverTestFiles(dir) {
 async function listTestFiles(dir) {
   const files = discoverTestFiles(dir);
   const nestorTestDir = resolve17(dir, ".nestor", "tests");
-  if (existsSync19(nestorTestDir)) {
+  if (existsSync20(nestorTestDir)) {
     files.push(...discoverTestFiles(nestorTestDir));
   }
   const unique = [...new Set(files)];
@@ -165093,7 +165775,7 @@ async function runSkillTestsByName(skillName, verbose, json) {
   ];
   const matchingFiles = [];
   for (const dir of searchDirs) {
-    if (!existsSync19(dir)) continue;
+    if (!existsSync20(dir)) continue;
     const files = discoverTestFiles(dir);
     for (const file of files) {
       if (file.includes(skillName)) {
@@ -165291,9 +165973,9 @@ function registerGuardrailCommand(program2) {
 
 // src/index.ts
 function checkBetaAccess() {
-  const licenseFile = join24(homedir9(), ".nestor", "license.key");
-  if (!existsSync20(licenseFile)) return false;
-  const key = readFileSync23(licenseFile, "utf-8").trim();
+  const licenseFile = join25(homedir10(), ".nestor", "license.key");
+  if (!existsSync21(licenseFile)) return false;
+  const key = readFileSync24(licenseFile, "utf-8").trim();
   return /^NESTOR-BETA-[A-Z0-9]{4}-[A-Z0-9]{4}-[A-Z0-9]{4}$/.test(key);
 }
 var command2 = process.argv[2];
@@ -165313,7 +165995,7 @@ if (command2 && !["--help", "-h", "--version", "-V", "install"].includes(command
   }
 }
 var program = new Command();
-program.name("nestor-sh").description("Nestor AI Agent Platform \u2014 orchestrate, secure and monitor AI agents").version("2.1.0");
+program.name("nestor-sh").description("Nestor AI Agent Platform \u2014 orchestrate, secure and monitor AI agents").version("2.1.1");
 registerStartCommand(program);
 registerInstallCommand(program);
 registerAgentCommand(program);