nestor-sh 2.7.1 → 3.0.0

package/dist/nestor.mjs

@@ -6567,18 +6567,51 @@ var init_store = __esm({
       }
       /**
        * Search missions by objective text (LIKE query).
+       * Supports optional filters for type, status, date range.
+       * Returns results sorted by relevance (title matches ranked higher).
        */
-      searchMissions(query, limit = 5) {
-        const pattern = `%${query}%`;
-        const rows = queryAll(
-          this.db,
-          `SELECT * FROM missions
-       WHERE objective LIKE ? OR title LIKE ?
-       ORDER BY created_at DESC
-       LIMIT ?`,
-          [pattern, pattern, limit]
-        );
-        return rows.map((row) => this.rowToMission(row));
+      searchMissions(query, opts) {
+        let sql = "SELECT * FROM missions WHERE 1=1";
+        const params = [];
+        if (query) {
+          sql += " AND (title LIKE ? OR objective LIKE ? OR findings LIKE ?)";
+          const q = `%${query}%`;
+          params.push(q, q, q);
+        }
+        if (opts?.type) {
+          sql += " AND type = ?";
+          params.push(opts.type);
+        }
+        if (opts?.status) {
+          sql += " AND status = ?";
+          params.push(opts.status);
+        }
+        if (opts?.from) {
+          sql += " AND created_at >= ?";
+          params.push(new Date(opts.from).getTime());
+        }
+        if (opts?.to) {
+          sql += " AND created_at <= ?";
+          params.push(new Date(opts.to).getTime());
+        }
+        sql += " ORDER BY created_at DESC";
+        sql += ` LIMIT ${opts?.limit || 20}`;
+        const rows = queryAll(this.db, sql, params);
+        const missions = rows.map((row) => this.rowToMission(row));
+        if (query) {
+          const lowerQ = query.toLowerCase();
+          missions.sort((a, b) => {
+            const aInTitle = a.title.toLowerCase().includes(lowerQ) ? 1 : 0;
+            const bInTitle = b.title.toLowerCase().includes(lowerQ) ? 1 : 0;
+            if (aInTitle !== bInTitle) return bInTitle - aInTitle;
+            return b.createdAt - a.createdAt;
+          });
+        }
+        return missions.map((m) => ({
+          ...m,
+          findingCount: Array.isArray(m.findings) ? m.findings.length : 0,
+          qualityScore: m.evaluation && typeof m.evaluation === "object" && "overall" in m.evaluation ? m.evaluation.overall : null
+        }));
       }
       /**
        * List all missions, optionally filtered by tenant.
@@ -6589,6 +6622,44 @@ var init_store = __esm({
         const rows = queryAll(this.db, sql, params);
         return rows.map((row) => this.rowToMission(row));
       }
+      /**
+       * Get aggregate mission statistics.
+       */
+      getMissionStats(tenantId) {
+        const baseSql = tenantId ? "SELECT * FROM missions WHERE tenant_id = ?" : "SELECT * FROM missions";
+        const params = tenantId ? [tenantId] : [];
+        const rows = queryAll(this.db, baseSql, params);
+        const missions = rows.map((row) => this.rowToMission(row));
+        const byType = {};
+        const byStatus = {};
+        let totalCost = 0;
+        let totalFindings = 0;
+        let qualitySum = 0;
+        let qualityCount = 0;
+        for (const m of missions) {
+          byType[m.type] = (byType[m.type] || 0) + 1;
+          byStatus[m.status] = (byStatus[m.status] || 0) + 1;
+          totalCost += m.spentUsd || 0;
+          totalFindings += Array.isArray(m.findings) ? m.findings.length : 0;
+          if (m.evaluation && typeof m.evaluation === "object" && "overall" in m.evaluation) {
+            const overall = m.evaluation.overall;
+            if (typeof overall === "number") {
+              qualitySum += overall;
+              qualityCount++;
+            }
+          }
+        }
+        const topCategories = Object.entries(byType).sort((a, b) => b[1] - a[1]).map(([cat]) => cat);
+        return {
+          total: missions.length,
+          byType,
+          byStatus,
+          totalCost: Math.round(totalCost * 100) / 100,
+          totalFindings,
+          avgQuality: qualityCount > 0 ? Math.round(qualitySum / qualityCount * 100) / 100 : 0,
+          topCategories
+        };
+      }
       /**
        * Search findings across all missions (LIKE query).
        */
@@ -7738,9 +7809,9 @@ var init_request_validator = __esm({
 });
 
 // ../server/src/security/input-sanitizer.ts
-function resolvePath(base, relative6) {
-  if (relative6.startsWith("/")) return relative6;
-  const parts = (base + "/" + relative6).split("/");
+function resolvePath(base, relative7) {
+  if (relative7.startsWith("/")) return relative7;
+  const parts = (base + "/" + relative7).split("/");
   const resolved = [];
   for (const part of parts) {
     if (part === "..") {
@@ -9279,7 +9350,7 @@ import path from "node:path";
 import fs2 from "node:fs";
 function validateSkillFile(filePath, content) {
   const ext = path.extname(filePath).toLowerCase();
-  const basename5 = path.basename(filePath);
+  const basename6 = path.basename(filePath);
   const extensionlessAllowed = /* @__PURE__ */ new Set([
     "LICENSE",
     "LICENCE",
@@ -9295,14 +9366,14 @@ function validateSkillFile(filePath, content) {
     ".prettierrc",
     ".eslintrc"
   ]);
-  if (!ext && !extensionlessAllowed.has(basename5)) {
+  if (!ext && !extensionlessAllowed.has(basename6)) {
     return {
       valid: false,
-      reason: `File without extension is not in the allowlist: ${basename5}`,
+      reason: `File without extension is not in the allowlist: ${basename6}`,
       extension: ""
     };
   }
-  if (!ext && extensionlessAllowed.has(basename5)) {
+  if (!ext && extensionlessAllowed.has(basename6)) {
     if (content && content.length >= 4) {
       const binaryCheck = checkForBinaryContent(content, "");
       if (binaryCheck) {
@@ -11430,7 +11501,7 @@ var SERVER_VERSION, startTime;
 var init_health = __esm({
   "../server/src/routes/health.ts"() {
     "use strict";
-    SERVER_VERSION = "2.7.1";
+    SERVER_VERSION = "3.0.0";
     startTime = Date.now();
   }
 });
@@ -12843,7 +12914,7 @@ var init_system = __esm({
     init_error_handler();
     init_broadcaster();
     init_approval_service();
-    SERVER_VERSION2 = "2.7.1";
+    SERVER_VERSION2 = "3.0.0";
     startTime2 = Date.now();
     UpdateConfigSchema = z9.object({
       server: z9.object({
@@ -20273,7 +20344,7 @@ function isNativeAvailable() {
   return nativeModule !== null;
 }
 function getNativeVersion() {
-  return nativeModule ? "2.7.1" : null;
+  return nativeModule ? "3.0.0" : null;
 }
 function validateSsrf(url, allowPrivate = false) {
   if (nativeModule) {
@@ -71039,7 +71110,7 @@ var require_util2 = __commonJS({
       return path30;
     }
     exports2.normalize = normalize4;
-    function join30(aRoot, aPath) {
+    function join31(aRoot, aPath) {
       if (aRoot === "") {
         aRoot = ".";
       }
@@ -71071,11 +71142,11 @@ var require_util2 = __commonJS({
       }
       return joined;
     }
-    exports2.join = join30;
+    exports2.join = join31;
     exports2.isAbsolute = function(aPath) {
       return aPath.charAt(0) === "/" || urlRegexp.test(aPath);
     };
-    function relative6(aRoot, aPath) {
+    function relative7(aRoot, aPath) {
       if (aRoot === "") {
         aRoot = ".";
       }
@@ -71094,7 +71165,7 @@ var require_util2 = __commonJS({
       }
       return Array(level + 1).join("../") + aPath.substr(aRoot.length + 1);
     }
-    exports2.relative = relative6;
+    exports2.relative = relative7;
     var supportsNullProto = function() {
       var obj = /* @__PURE__ */ Object.create(null);
       return !("__proto__" in obj);
@@ -71244,7 +71315,7 @@ var require_util2 = __commonJS({
             parsed.path = parsed.path.substring(0, index + 1);
           }
         }
-        sourceURL = join30(urlGenerate(parsed), sourceURL);
+        sourceURL = join31(urlGenerate(parsed), sourceURL);
       }
       return normalize4(sourceURL);
     }
@@ -73046,7 +73117,7 @@ var require_escodegen = __commonJS({
       function noEmptySpace() {
         return space ? space : " ";
       }
-      function join30(left2, right2) {
+      function join31(left2, right2) {
         var leftSource, rightSource, leftCharCode, rightCharCode;
         leftSource = toSourceNodeWhenNeeded(left2).toString();
         if (leftSource.length === 0) {
@@ -73377,8 +73448,8 @@ var require_escodegen = __commonJS({
           } else {
             result.push(that.generateExpression(stmt.left, Precedence.Call, E_TTT));
           }
-          result = join30(result, operator);
-          result = [join30(
+          result = join31(result, operator);
+          result = [join31(
             result,
             that.generateExpression(stmt.right, Precedence.Assignment, E_TTT)
           ), ")"];
@@ -73521,11 +73592,11 @@ var require_escodegen = __commonJS({
           var result, fragment;
           result = ["class"];
           if (stmt.id) {
-            result = join30(result, this.generateExpression(stmt.id, Precedence.Sequence, E_TTT));
+            result = join31(result, this.generateExpression(stmt.id, Precedence.Sequence, E_TTT));
           }
           if (stmt.superClass) {
-            fragment = join30("extends", this.generateExpression(stmt.superClass, Precedence.Unary, E_TTT));
-            result = join30(result, fragment);
+            fragment = join31("extends", this.generateExpression(stmt.superClass, Precedence.Unary, E_TTT));
+            result = join31(result, fragment);
           }
           result.push(space);
           result.push(this.generateStatement(stmt.body, S_TFFT));
@@ -73538,9 +73609,9 @@ var require_escodegen = __commonJS({
           return escapeDirective(stmt.directive) + this.semicolon(flags);
         },
         DoWhileStatement: function(stmt, flags) {
-          var result = join30("do", this.maybeBlock(stmt.body, S_TFFF));
+          var result = join31("do", this.maybeBlock(stmt.body, S_TFFF));
           result = this.maybeBlockSuffix(stmt.body, result);
-          return join30(result, [
+          return join31(result, [
             "while" + space + "(",
             this.generateExpression(stmt.test, Precedence.Sequence, E_TTT),
             ")" + this.semicolon(flags)
@@ -73576,11 +73647,11 @@ var require_escodegen = __commonJS({
         ExportDefaultDeclaration: function(stmt, flags) {
           var result = ["export"], bodyFlags;
           bodyFlags = flags & F_SEMICOLON_OPT ? S_TFFT : S_TFFF;
-          result = join30(result, "default");
+          result = join31(result, "default");
           if (isStatement(stmt.declaration)) {
-            result = join30(result, this.generateStatement(stmt.declaration, bodyFlags));
+            result = join31(result, this.generateStatement(stmt.declaration, bodyFlags));
           } else {
-            result = join30(result, this.generateExpression(stmt.declaration, Precedence.Assignment, E_TTT) + this.semicolon(flags));
+            result = join31(result, this.generateExpression(stmt.declaration, Precedence.Assignment, E_TTT) + this.semicolon(flags));
           }
           return result;
         },
@@ -73588,15 +73659,15 @@ var require_escodegen = __commonJS({
           var result = ["export"], bodyFlags, that = this;
           bodyFlags = flags & F_SEMICOLON_OPT ? S_TFFT : S_TFFF;
           if (stmt.declaration) {
-            return join30(result, this.generateStatement(stmt.declaration, bodyFlags));
+            return join31(result, this.generateStatement(stmt.declaration, bodyFlags));
           }
           if (stmt.specifiers) {
             if (stmt.specifiers.length === 0) {
-              result = join30(result, "{" + space + "}");
+              result = join31(result, "{" + space + "}");
             } else if (stmt.specifiers[0].type === Syntax.ExportBatchSpecifier) {
-              result = join30(result, this.generateExpression(stmt.specifiers[0], Precedence.Sequence, E_TTT));
+              result = join31(result, this.generateExpression(stmt.specifiers[0], Precedence.Sequence, E_TTT));
             } else {
-              result = join30(result, "{");
+              result = join31(result, "{");
               withIndent(function(indent2) {
                 var i, iz;
                 result.push(newline);
@@ -73614,7 +73685,7 @@ var require_escodegen = __commonJS({
               result.push(base + "}");
             }
             if (stmt.source) {
-              result = join30(result, [
+              result = join31(result, [
                 "from" + space,
                 // ModuleSpecifier
                 this.generateExpression(stmt.source, Precedence.Sequence, E_TTT),
@@ -73702,7 +73773,7 @@ var require_escodegen = __commonJS({
           ];
           cursor = 0;
           if (stmt.specifiers[cursor].type === Syntax.ImportDefaultSpecifier) {
-            result = join30(result, [
+            result = join31(result, [
               this.generateExpression(stmt.specifiers[cursor], Precedence.Sequence, E_TTT)
             ]);
             ++cursor;
@@ -73712,7 +73783,7 @@ var require_escodegen = __commonJS({
               result.push(",");
             }
             if (stmt.specifiers[cursor].type === Syntax.ImportNamespaceSpecifier) {
-              result = join30(result, [
+              result = join31(result, [
                 space,
                 this.generateExpression(stmt.specifiers[cursor], Precedence.Sequence, E_TTT)
               ]);
@@ -73741,7 +73812,7 @@ var require_escodegen = __commonJS({
               }
             }
           }
-          result = join30(result, [
+          result = join31(result, [
             "from" + space,
             // ModuleSpecifier
             this.generateExpression(stmt.source, Precedence.Sequence, E_TTT),
@@ -73795,7 +73866,7 @@ var require_escodegen = __commonJS({
           return result;
         },
         ThrowStatement: function(stmt, flags) {
-          return [join30(
+          return [join31(
             "throw",
             this.generateExpression(stmt.argument, Precedence.Sequence, E_TTT)
           ), this.semicolon(flags)];
@@ -73806,7 +73877,7 @@ var require_escodegen = __commonJS({
           result = this.maybeBlockSuffix(stmt.block, result);
           if (stmt.handlers) {
             for (i = 0, iz = stmt.handlers.length; i < iz; ++i) {
-              result = join30(result, this.generateStatement(stmt.handlers[i], S_TFFF));
+              result = join31(result, this.generateStatement(stmt.handlers[i], S_TFFF));
               if (stmt.finalizer || i + 1 !== iz) {
                 result = this.maybeBlockSuffix(stmt.handlers[i].body, result);
               }
@@ -73814,7 +73885,7 @@ var require_escodegen = __commonJS({
           } else {
             guardedHandlers = stmt.guardedHandlers || [];
             for (i = 0, iz = guardedHandlers.length; i < iz; ++i) {
-              result = join30(result, this.generateStatement(guardedHandlers[i], S_TFFF));
+              result = join31(result, this.generateStatement(guardedHandlers[i], S_TFFF));
               if (stmt.finalizer || i + 1 !== iz) {
                 result = this.maybeBlockSuffix(guardedHandlers[i].body, result);
               }
@@ -73822,13 +73893,13 @@ var require_escodegen = __commonJS({
             if (stmt.handler) {
               if (Array.isArray(stmt.handler)) {
                 for (i = 0, iz = stmt.handler.length; i < iz; ++i) {
-                  result = join30(result, this.generateStatement(stmt.handler[i], S_TFFF));
+                  result = join31(result, this.generateStatement(stmt.handler[i], S_TFFF));
                   if (stmt.finalizer || i + 1 !== iz) {
                     result = this.maybeBlockSuffix(stmt.handler[i].body, result);
                   }
                 }
               } else {
-                result = join30(result, this.generateStatement(stmt.handler, S_TFFF));
+                result = join31(result, this.generateStatement(stmt.handler, S_TFFF));
                 if (stmt.finalizer) {
                   result = this.maybeBlockSuffix(stmt.handler.body, result);
                 }
@@ -73836,7 +73907,7 @@ var require_escodegen = __commonJS({
             }
           }
           if (stmt.finalizer) {
-            result = join30(result, ["finally", this.maybeBlock(stmt.finalizer, S_TFFF)]);
+            result = join31(result, ["finally", this.maybeBlock(stmt.finalizer, S_TFFF)]);
           }
           return result;
         },
@@ -73870,7 +73941,7 @@ var require_escodegen = __commonJS({
           withIndent(function() {
             if (stmt.test) {
               result = [
-                join30("case", that.generateExpression(stmt.test, Precedence.Sequence, E_TTT)),
+                join31("case", that.generateExpression(stmt.test, Precedence.Sequence, E_TTT)),
                 ":"
               ];
             } else {
@@ -73918,9 +73989,9 @@ var require_escodegen = __commonJS({
             result.push(this.maybeBlock(stmt.consequent, S_TFFF));
             result = this.maybeBlockSuffix(stmt.consequent, result);
             if (stmt.alternate.type === Syntax.IfStatement) {
-              result = join30(result, ["else ", this.generateStatement(stmt.alternate, bodyFlags)]);
+              result = join31(result, ["else ", this.generateStatement(stmt.alternate, bodyFlags)]);
             } else {
-              result = join30(result, join30("else", this.maybeBlock(stmt.alternate, bodyFlags)));
+              result = join31(result, join31("else", this.maybeBlock(stmt.alternate, bodyFlags)));
             }
           } else {
             result.push(this.maybeBlock(stmt.consequent, bodyFlags));
@@ -74021,7 +74092,7 @@ var require_escodegen = __commonJS({
         },
         ReturnStatement: function(stmt, flags) {
           if (stmt.argument) {
-            return [join30(
+            return [join31(
               "return",
               this.generateExpression(stmt.argument, Precedence.Sequence, E_TTT)
             ), this.semicolon(flags)];
@@ -74110,14 +74181,14 @@ var require_escodegen = __commonJS({
           if (leftSource.charCodeAt(leftSource.length - 1) === 47 && esutils.code.isIdentifierPartES5(expr.operator.charCodeAt(0))) {
             result = [fragment, noEmptySpace(), expr.operator];
           } else {
-            result = join30(fragment, expr.operator);
+            result = join31(fragment, expr.operator);
           }
           fragment = this.generateExpression(expr.right, rightPrecedence, flags);
           if (expr.operator === "/" && fragment.toString().charAt(0) === "/" || expr.operator.slice(-1) === "<" && fragment.toString().slice(0, 3) === "!--") {
             result.push(noEmptySpace());
             result.push(fragment);
           } else {
-            result = join30(result, fragment);
+            result = join31(result, fragment);
           }
           if (expr.operator === "in" && !(flags & F_ALLOW_IN)) {
             return ["(", result, ")"];
@@ -74157,7 +74228,7 @@ var require_escodegen = __commonJS({
           var result, length, i, iz, itemFlags;
           length = expr["arguments"].length;
           itemFlags = flags & F_ALLOW_UNPARATH_NEW && !parentheses && length === 0 ? E_TFT : E_TFF;
-          result = join30(
+          result = join31(
             "new",
             this.generateExpression(expr.callee, Precedence.New, itemFlags)
           );
@@ -74207,11 +74278,11 @@ var require_escodegen = __commonJS({
           var result, fragment, rightCharCode, leftSource, leftCharCode;
           fragment = this.generateExpression(expr.argument, Precedence.Unary, E_TTT);
           if (space === "") {
-            result = join30(expr.operator, fragment);
+            result = join31(expr.operator, fragment);
           } else {
             result = [expr.operator];
             if (expr.operator.length > 2) {
-              result = join30(result, fragment);
+              result = join31(result, fragment);
             } else {
               leftSource = toSourceNodeWhenNeeded(result).toString();
               leftCharCode = leftSource.charCodeAt(leftSource.length - 1);
@@ -74234,7 +74305,7 @@ var require_escodegen = __commonJS({
             result = "yield";
           }
           if (expr.argument) {
-            result = join30(
+            result = join31(
               result,
               this.generateExpression(expr.argument, Precedence.Yield, E_TTT)
             );
@@ -74242,7 +74313,7 @@ var require_escodegen = __commonJS({
           return parenthesize(result, Precedence.Yield, precedence);
         },
         AwaitExpression: function(expr, precedence, flags) {
-          var result = join30(
+          var result = join31(
             expr.all ? "await*" : "await",
             this.generateExpression(expr.argument, Precedence.Await, E_TTT)
           );
@@ -74325,11 +74396,11 @@ var require_escodegen = __commonJS({
           var result, fragment;
           result = ["class"];
           if (expr.id) {
-            result = join30(result, this.generateExpression(expr.id, Precedence.Sequence, E_TTT));
+            result = join31(result, this.generateExpression(expr.id, Precedence.Sequence, E_TTT));
           }
           if (expr.superClass) {
-            fragment = join30("extends", this.generateExpression(expr.superClass, Precedence.Unary, E_TTT));
-            result = join30(result, fragment);
+            fragment = join31("extends", this.generateExpression(expr.superClass, Precedence.Unary, E_TTT));
+            result = join31(result, fragment);
           }
           result.push(space);
           result.push(this.generateStatement(expr.body, S_TFFT));
@@ -74344,7 +74415,7 @@ var require_escodegen = __commonJS({
           }
           if (expr.kind === "get" || expr.kind === "set") {
             fragment = [
-              join30(expr.kind, this.generatePropertyKey(expr.key, expr.computed)),
+              join31(expr.kind, this.generatePropertyKey(expr.key, expr.computed)),
               this.generateFunctionBody(expr.value)
             ];
           } else {
@@ -74354,7 +74425,7 @@ var require_escodegen = __commonJS({
               this.generateFunctionBody(expr.value)
             ];
           }
-          return join30(result, fragment);
+          return join31(result, fragment);
         },
         Property: function(expr, precedence, flags) {
           if (expr.kind === "get" || expr.kind === "set") {
@@ -74549,7 +74620,7 @@ var require_escodegen = __commonJS({
               for (i = 0, iz = expr.blocks.length; i < iz; ++i) {
                 fragment = that.generateExpression(expr.blocks[i], Precedence.Sequence, E_TTT);
                 if (i > 0 || extra.moz.comprehensionExpressionStartsWithAssignment) {
-                  result = join30(result, fragment);
+                  result = join31(result, fragment);
                 } else {
                   result.push(fragment);
                 }
@@ -74557,13 +74628,13 @@ var require_escodegen = __commonJS({
             });
           }
           if (expr.filter) {
-            result = join30(result, "if" + space);
+            result = join31(result, "if" + space);
             fragment = this.generateExpression(expr.filter, Precedence.Sequence, E_TTT);
-            result = join30(result, ["(", fragment, ")"]);
+            result = join31(result, ["(", fragment, ")"]);
           }
           if (!extra.moz.comprehensionExpressionStartsWithAssignment) {
             fragment = this.generateExpression(expr.body, Precedence.Assignment, E_TTT);
-            result = join30(result, fragment);
+            result = join31(result, fragment);
           }
           result.push(expr.type === Syntax.GeneratorExpression ? ")" : "]");
           return result;
@@ -74579,8 +74650,8 @@ var require_escodegen = __commonJS({
           } else {
             fragment = this.generateExpression(expr.left, Precedence.Call, E_TTT);
           }
-          fragment = join30(fragment, expr.of ? "of" : "in");
-          fragment = join30(fragment, this.generateExpression(expr.right, Precedence.Sequence, E_TTT));
+          fragment = join31(fragment, expr.of ? "of" : "in");
+          fragment = join31(fragment, this.generateExpression(expr.right, Precedence.Sequence, E_TTT));
           return ["for" + space + "(", fragment, ")"];
         },
         SpreadElement: function(expr, precedence, flags) {
@@ -102139,8 +102210,8 @@ function findChromePath() {
     for (const p8 of paths) {
       if (p8) {
         try {
-          const { existsSync: existsSync26 } = __require("node:fs");
-          if (existsSync26(p8)) return p8;
+          const { existsSync: existsSync28 } = __require("node:fs");
+          if (existsSync28(p8)) return p8;
         } catch {
         }
       }
@@ -102155,8 +102226,8 @@ function findChromePath() {
     ];
     for (const p8 of paths) {
       try {
-        const { existsSync: existsSync26 } = __require("node:fs");
-        if (existsSync26(p8)) return p8;
+        const { existsSync: existsSync28 } = __require("node:fs");
+        if (existsSync28(p8)) return p8;
       } catch {
       }
     }
@@ -102171,8 +102242,8 @@ function findChromePath() {
   ];
   for (const p8 of linuxPaths) {
     try {
-      const { existsSync: existsSync26 } = __require("node:fs");
-      if (existsSync26(p8)) return p8;
+      const { existsSync: existsSync28 } = __require("node:fs");
+      if (existsSync28(p8)) return p8;
     } catch {
     }
   }
@@ -103436,11 +103507,305 @@ var init_meta_tool_factory = __esm({
   }
 });
 
+// ../agent/src/memory/layered-memory.ts
+var LayeredMemory, EpisodicLayer, SemanticLayer;
+var init_layered_memory = __esm({
+  "../agent/src/memory/layered-memory.ts"() {
+    "use strict";
+    LayeredMemory = class {
+      constructor(store) {
+        this.store = store;
+        this.layers = [
+          new EpisodicLayer(store),
+          new SemanticLayer(store)
+        ];
+      }
+      layers = [];
+      /** Query all layers and merge results by relevance */
+      async query(input, limit = 10) {
+        const allResults = [];
+        for (const layer of this.layers) {
+          try {
+            const results = await layer.query(input, limit);
+            allResults.push(...results);
+          } catch {
+          }
+        }
+        return allResults.sort((a, b) => b.relevance - a.relevance).slice(0, limit);
+      }
+      /** Get stats about each memory layer */
+      stats() {
+        return [
+          { name: "Working", type: "working", count: 0 },
+          // managed externally
+          { name: "Episodic", type: "episodic", count: this.getEpisodicCount() },
+          { name: "Semantic", type: "semantic", count: this.getSemanticCount() }
+        ];
+      }
+      getEpisodicCount() {
+        try {
+          const missions = this.store.listMissions("default");
+          return missions.length;
+        } catch {
+          return 0;
+        }
+      }
+      getSemanticCount() {
+        try {
+          const stats = this.store.getKgStats();
+          return stats.totalEntities + stats.totalFacts;
+        } catch {
+          return 0;
+        }
+      }
+    };
+    EpisodicLayer = class {
+      constructor(store) {
+        this.store = store;
+      }
+      name = "Episodic";
+      type = "episodic";
+      async query(input, limit = 5) {
+        try {
+          const missions = this.store.searchMissions(input, { limit });
+          return missions.map((m) => ({
+            content: `Mission "${m.title}" (${m.type}, ${m.status}): ${(m.objective ?? "").substring(0, 200)}. ${m.findingCount} findings, score: ${m.qualityScore ?? "N/A"}`,
+            source: `mission:${m.id}`,
+            layer: "episodic",
+            relevance: 0.6,
+            timestamp: m.createdAt
+          }));
+        } catch {
+          return [];
+        }
+      }
+    };
+    SemanticLayer = class {
+      constructor(store) {
+        this.store = store;
+      }
+      name = "Semantic";
+      type = "semantic";
+      async query(input, limit = 5) {
+        const results = [];
+        try {
+          const entities = this.store.searchKgEntities(input);
+          for (const e of entities.slice(0, limit)) {
+            results.push({
+              content: `Entity: ${e.canonicalName} (${e.type})${e.aliases?.length ? ` \u2014 aliases: ${e.aliases.join(", ")}` : ""}`,
+              source: `kg:entity:${e.id}`,
+              layer: "semantic",
+              relevance: 0.7
+            });
+          }
+          const facts = this.store.getKgFacts(input.substring(0, 50));
+          for (const f of facts.slice(0, limit)) {
+            results.push({
+              content: `Fact: ${f.predicate} \u2192 ${f.object.substring(0, 150)} (confidence: ${f.confidence})`,
+              source: `kg:fact:${f.sourceMissionId ?? "unknown"}`,
+              layer: "semantic",
+              relevance: 0.8 * (f.confidence || 0.5)
+            });
+          }
+        } catch {
+        }
+        return results;
+      }
+    };
+  }
+});
+
+// ../agent/src/integrations/obsidian.ts
+import { existsSync as existsSync5, readFileSync as readFileSync8, writeFileSync as writeFileSync3, mkdirSync as mkdirSync3, readdirSync as readdirSync2, statSync as statSync3 } from "node:fs";
+import { join as join8, basename as basename3, relative as relative3 } from "node:path";
+var ObsidianIntegration;
+var init_obsidian = __esm({
+  "../agent/src/integrations/obsidian.ts"() {
+    "use strict";
+    ObsidianIntegration = class {
+      constructor(config2) {
+        this.config = config2;
+        this.nestorDir = join8(config2.vaultPath, config2.nestorFolder || "Nestor");
+        if (!existsSync5(this.nestorDir)) {
+          mkdirSync3(this.nestorDir, { recursive: true });
+        }
+      }
+      nestorDir;
+      /** Check if vault exists and is accessible */
+      isAvailable() {
+        return existsSync5(this.config.vaultPath);
+      }
+      /** Write a note to the vault */
+      writeNote(opts) {
+        const folder5 = opts.folder ? join8(this.nestorDir, opts.folder) : this.nestorDir;
+        if (!existsSync5(folder5)) mkdirSync3(folder5, { recursive: true });
+        const filename = this.sanitizeFilename(opts.title) + ".md";
+        const filepath = join8(folder5, filename);
+        const fm = {
+          created: (/* @__PURE__ */ new Date()).toISOString(),
+          source: "nestor",
+          tags: [...this.config.defaultTags || [], ...opts.tags || []],
+          ...opts.frontmatter
+        };
+        const frontmatter = `---
+${Object.entries(fm).map(
+          ([k, v]) => `${k}: ${typeof v === "object" ? JSON.stringify(v) : v}`
+        ).join("\n")}
+---
+
+`;
+        writeFileSync3(filepath, frontmatter + opts.content);
+        return filepath;
+      }
+      /** Read a note from the vault */
+      readNote(path30) {
+        const fullPath = path30.startsWith("/") || path30.includes(":") ? path30 : join8(this.nestorDir, path30);
+        if (!existsSync5(fullPath)) return null;
+        const raw = readFileSync8(fullPath, "utf-8");
+        const fmMatch = raw.match(/^---\n([\s\S]*?)\n---\n\n?([\s\S]*)$/);
+        if (fmMatch) {
+          const frontmatter = {};
+          for (const line of fmMatch[1].split("\n")) {
+            const [key, ...rest] = line.split(": ");
+            if (key) frontmatter[key.trim()] = rest.join(": ").trim();
+          }
+          return { frontmatter, content: fmMatch[2] };
+        }
+        return { frontmatter: {}, content: raw };
+      }
+      /** Search notes in the vault */
+      searchNotes(query, limit = 10) {
+        const results = [];
+        const q = query.toLowerCase();
+        this.walkDir(this.nestorDir, (filepath) => {
+          if (!filepath.endsWith(".md") || results.length >= limit) return;
+          try {
+            const content = readFileSync8(filepath, "utf-8");
+            if (content.toLowerCase().includes(q)) {
+              const relPath = relative3(this.nestorDir, filepath);
+              const title = basename3(filepath, ".md");
+              const idx = content.toLowerCase().indexOf(q);
+              const snippet = content.substring(Math.max(0, idx - 50), idx + 100).replace(/\n/g, " ");
+              results.push({ path: relPath, title, snippet });
+            }
+          } catch {
+          }
+        });
+        return results;
+      }
+      /** List all notes in a folder */
+      listNotes(folder5) {
+        const dir = folder5 ? join8(this.nestorDir, folder5) : this.nestorDir;
+        if (!existsSync5(dir)) return [];
+        const notes = [];
+        this.walkDir(dir, (filepath) => {
+          if (!filepath.endsWith(".md")) return;
+          const stat = statSync3(filepath);
+          notes.push({
+            path: relative3(this.nestorDir, filepath),
+            title: basename3(filepath, ".md"),
+            modified: stat.mtime
+          });
+        });
+        return notes.sort((a, b) => b.modified.getTime() - a.modified.getTime());
+      }
+      /** Write a mission report to the vault */
+      writeMissionReport(mission) {
+        return this.writeNote({
+          title: mission.title,
+          content: mission.report,
+          folder: `missions/${mission.type}`,
+          tags: ["mission", mission.type],
+          frontmatter: {
+            type: mission.type,
+            quality: mission.evaluation?.overall
+          }
+        });
+      }
+      sanitizeFilename(name) {
+        return name.replace(/[<>:"/\\|?*]/g, "-").substring(0, 100);
+      }
+      walkDir(dir, callback) {
+        if (!existsSync5(dir)) return;
+        for (const entry of readdirSync2(dir, { withFileTypes: true })) {
+          const fullPath = join8(dir, entry.name);
+          if (entry.isDirectory()) {
+            this.walkDir(fullPath, callback);
+          } else {
+            callback(fullPath);
+          }
+        }
+      }
+    };
+  }
+});
+
+// ../agent/src/integrations/n8n.ts
+var N8nIntegration;
+var init_n8n = __esm({
+  "../agent/src/integrations/n8n.ts"() {
+    "use strict";
+    N8nIntegration = class {
+      constructor(config2) {
+        this.config = config2;
+      }
+      /** Check if n8n is accessible */
+      async isAvailable() {
+        try {
+          const res = await fetch(`${this.config.baseUrl}/api/v1/workflows`, {
+            headers: this.headers(),
+            signal: AbortSignal.timeout(5e3)
+          });
+          return res.ok;
+        } catch {
+          return false;
+        }
+      }
+      /** Trigger a webhook workflow */
+      async triggerWebhook(webhookPath, data) {
+        const url = `${this.config.baseUrl}/webhook/${webhookPath}`;
+        const res = await fetch(url, {
+          method: "POST",
+          headers: { "Content-Type": "application/json" },
+          body: JSON.stringify(data),
+          signal: AbortSignal.timeout(3e4)
+        });
+        return res.json();
+      }
+      /** List workflows */
+      async listWorkflows() {
+        const res = await fetch(`${this.config.baseUrl}/api/v1/workflows`, {
+          headers: this.headers(),
+          signal: AbortSignal.timeout(1e4)
+        });
+        if (!res.ok) return [];
+        const data = await res.json();
+        return data.data || [];
+      }
+      /** Execute a workflow by ID */
+      async executeWorkflow(id, data) {
+        const res = await fetch(`${this.config.baseUrl}/api/v1/workflows/${id}/execute`, {
+          method: "POST",
+          headers: this.headers(),
+          body: data ? JSON.stringify(data) : void 0,
+          signal: AbortSignal.timeout(6e4)
+        });
+        return res.json();
+      }
+      headers() {
+        const h = { "Content-Type": "application/json" };
+        if (this.config.apiKey) h["X-N8N-API-KEY"] = this.config.apiKey;
+        return h;
+      }
+    };
+  }
+});
+
 // ../agent/src/tools/system-tools.ts
 import { z as z28 } from "zod";
 import { randomUUID as randomUUID23 } from "node:crypto";
-import { readFileSync as readFileSync8 } from "node:fs";
-import { join as join8 } from "node:path";
+import { readFileSync as readFileSync9 } from "node:fs";
+import { join as join9 } from "node:path";
 import { homedir as homedir3 } from "node:os";
 function registerSystemTools(registry, store, defaultTenantId = "default") {
   const tid = defaultTenantId;
@@ -103680,9 +104045,9 @@ Direct sub-agent execution from chat is not yet supported. Use the Studio UI or
     description: "Read the current Nestor configuration from ~/.nestor/nestor.config.json.",
     inputSchema: emptySchema,
     handler: async (_input, _ctx) => {
-      const configPath = join8(homedir3(), ".nestor", "nestor.config.json");
+      const configPath = join9(homedir3(), ".nestor", "nestor.config.json");
       try {
-        const config2 = readFileSync8(configPath, "utf-8");
+        const config2 = readFileSync9(configPath, "utf-8");
         return { output: config2, isError: false };
       } catch {
         return { output: "No config file found at ~/.nestor/nestor.config.json", isError: false };
@@ -103827,11 +104192,363 @@ ${summary}`, isError: false };
       }
     }
   });
+  const searchMissionsSchema = z28.object({
+    query: z28.string().describe("Search query (searches titles, objectives, findings)"),
+    type: z28.string().optional().describe("Filter by mission type (osint, research, code, audit, creation, analysis)"),
+    limit: z28.number().optional().describe("Max results (default: 5)")
+  });
+  registry.register({
+    name: "nestor_search_missions",
+    description: "Search past missions by topic, type, or content. Returns matching missions with their findings count and quality scores. Use this to find relevant past work before starting a new mission.",
+    inputSchema: searchMissionsSchema,
+    handler: async (input, _ctx) => {
+      const args2 = input;
+      try {
+        const results = store.searchMissions(args2.query, {
+          type: args2.type,
+          limit: args2.limit || 5
+        });
+        if (results.length === 0) {
+          return { output: `No missions found matching "${args2.query}".`, isError: false };
+        }
+        const summary = results.map((m) => {
+          const quality = m.qualityScore !== null ? ` \u2014 quality: ${(m.qualityScore * 100).toFixed(0)}%` : "";
+          return `\u2022 [${m.status}] ${m.title} (${m.type}) \u2014 ${m.findingCount} findings, $${m.spentUsd.toFixed(4)}${quality}
+  ID: ${m.id}
+  Objective: ${m.objective.substring(0, 200)}`;
+        }).join("\n\n");
+        return {
+          output: `Found ${results.length} mission(s) matching "${args2.query}":
+
+${summary}`,
+          isError: false
+        };
+      } catch (err) {
+        const msg = err instanceof Error ? err.message : String(err);
+        return { output: `Error searching missions: ${msg}`, isError: true };
+      }
+    }
+  });
+  registry.register({
+    name: "nestor_get_mission_report",
+    description: "Get the full report of a specific past mission by ID. Returns the markdown report, evaluation scores, and key findings.",
+    inputSchema: missionIdSchema,
+    handler: async (input, _ctx) => {
+      const args2 = input;
+      try {
+        const mission = store.getMission(args2.missionId);
+        if (!mission) {
+          return { output: `Mission "${args2.missionId}" not found.`, isError: true };
+        }
+        let output = `# Mission: ${mission.title}
+`;
+        output += `Type: ${mission.type} | Status: ${mission.status}
+`;
+        output += `Objective: ${mission.objective}
+`;
+        output += `Cost: $${mission.spentUsd.toFixed(4)} | Findings: ${Array.isArray(mission.findings) ? mission.findings.length : 0}
+`;
+        if (mission.evaluation && typeof mission.evaluation === "object") {
+          const eval_ = mission.evaluation;
+          output += `
+## Evaluation
+`;
+          if (typeof eval_.overall === "number") output += `Overall: ${(eval_.overall * 100).toFixed(0)}%
+`;
+          if (typeof eval_.completeness === "number") output += `Completeness: ${(eval_.completeness * 100).toFixed(0)}%
+`;
+          if (typeof eval_.accuracy === "number") output += `Accuracy: ${(eval_.accuracy * 100).toFixed(0)}%
+`;
+          if (typeof eval_.depth === "number") output += `Depth: ${(eval_.depth * 100).toFixed(0)}%
+`;
+          if (typeof eval_.relevance === "number") output += `Relevance: ${(eval_.relevance * 100).toFixed(0)}%
+`;
+        }
+        if (mission.report) {
+          output += `
+## Report
+${mission.report}`;
+        } else {
+          output += `
+## Findings Summary
+`;
+          const findings = Array.isArray(mission.findings) ? mission.findings : [];
+          for (const f of findings.slice(0, 20)) {
+            const finding = f;
+            output += `- [${finding.type || "finding"}] ${finding.title || "Untitled"}: ${String(finding.content || "").substring(0, 300)}
+`;
+          }
+          if (findings.length > 20) {
+            output += `
+... and ${findings.length - 20} more findings.`;
+          }
+        }
+        return { output, isError: false };
+      } catch (err) {
+        const msg = err instanceof Error ? err.message : String(err);
+        return { output: `Error getting mission report: ${msg}`, isError: true };
+      }
+    }
+  });
+  registry.register({
+    name: "nestor_query_memory",
+    description: "Query all memory layers (episodic: past missions, semantic: knowledge graph) for relevant information. Returns merged results sorted by relevance.",
+    inputSchema: queryMemorySchema,
+    handler: async (input, _ctx) => {
+      const args2 = input;
+      try {
+        const memory = new LayeredMemory(store);
+        const results = await memory.query(String(args2.query), 10);
+        const layerStats = memory.stats();
+        return {
+          output: JSON.stringify({ results, layers: layerStats }, null, 2),
+          isError: false
+        };
+      } catch (err) {
+        const msg = err instanceof Error ? err.message : String(err);
+        return { output: `Memory query failed: ${msg}`, isError: true };
+      }
+    }
+  });
+  function loadIntegrationConfig() {
+    const configPath = join9(homedir3(), ".nestor", "nestor.config.json");
+    try {
+      const raw = readFileSync9(configPath, "utf-8");
+      const config2 = JSON.parse(raw);
+      return {
+        obsidian: config2.obsidian,
+        n8n: config2.n8n
+      };
+    } catch {
+      return {};
+    }
+  }
+  const obsidianWriteNoteSchema = z28.object({
+    title: z28.string().describe("Note title (used as filename)"),
+    content: z28.string().describe("Markdown content of the note"),
+    folder: z28.string().optional().describe('Subfolder within Nestor dir (e.g., "research", "missions/osint")'),
+    tags: z28.array(z28.string()).optional().describe("Tags to add to the note frontmatter")
+  });
+  const obsidianSearchSchema = z28.object({
+    query: z28.string().describe("Search query (full-text search across note titles and content)"),
+    limit: z28.number().optional().describe("Max results (default: 10)")
+  });
+  const obsidianReadNoteSchema = z28.object({
+    path: z28.string().describe('Relative path within the Nestor folder (e.g., "research/AI Frameworks.md") or absolute path')
+  });
+  const obsidianListNotesSchema = z28.object({
+    folder: z28.string().optional().describe('Subfolder to list (e.g., "missions"). Omit for root Nestor folder.')
+  });
+  registry.register({
+    name: "obsidian_write_note",
+    description: 'Write a note to the connected Obsidian vault. Creates a .md file with YAML frontmatter in the Nestor subfolder. Configure vault path in nestor.config.json under "obsidian.vaultPath".',
+    inputSchema: obsidianWriteNoteSchema,
+    handler: async (input, _ctx) => {
+      const args2 = input;
+      const cfg = loadIntegrationConfig();
+      if (!cfg.obsidian?.vaultPath) {
+        return {
+          output: 'Obsidian integration not configured. Add "obsidian": { "vaultPath": "/path/to/vault" } to ~/.nestor/nestor.config.json',
+          isError: true
+        };
+      }
+      try {
+        const obsidian = new ObsidianIntegration(cfg.obsidian);
+        if (!obsidian.isAvailable()) {
+          return { output: `Obsidian vault not found at: ${cfg.obsidian.vaultPath}`, isError: true };
+        }
+        const filepath = obsidian.writeNote({
+          title: args2.title,
+          content: args2.content,
+          folder: args2.folder,
+          tags: args2.tags
+        });
+        return { output: `Note written: ${filepath}`, isError: false };
+      } catch (err) {
+        const msg = err instanceof Error ? err.message : String(err);
+        return { output: `Failed to write note: ${msg}`, isError: true };
+      }
+    }
+  });
+  registry.register({
+    name: "obsidian_search",
+    description: "Search notes in the connected Obsidian vault. Full-text search across all .md files in the Nestor subfolder.",
+    inputSchema: obsidianSearchSchema,
+    handler: async (input, _ctx) => {
+      const args2 = input;
+      const cfg = loadIntegrationConfig();
+      if (!cfg.obsidian?.vaultPath) {
+        return {
+          output: 'Obsidian integration not configured. Add "obsidian": { "vaultPath": "/path/to/vault" } to ~/.nestor/nestor.config.json',
+          isError: true
+        };
+      }
+      try {
+        const obsidian = new ObsidianIntegration(cfg.obsidian);
+        if (!obsidian.isAvailable()) {
+          return { output: `Obsidian vault not found at: ${cfg.obsidian.vaultPath}`, isError: true };
+        }
+        const results = obsidian.searchNotes(args2.query, args2.limit ?? 10);
+        if (results.length === 0) {
+          return { output: `No notes found matching "${args2.query}".`, isError: false };
+        }
+        return { output: JSON.stringify(results, null, 2), isError: false };
+      } catch (err) {
+        const msg = err instanceof Error ? err.message : String(err);
+        return { output: `Search failed: ${msg}`, isError: true };
+      }
+    }
+  });
+  registry.register({
+    name: "obsidian_read_note",
+    description: "Read a note from the connected Obsidian vault. Returns frontmatter and content.",
+    inputSchema: obsidianReadNoteSchema,
+    handler: async (input, _ctx) => {
+      const args2 = input;
+      const cfg = loadIntegrationConfig();
+      if (!cfg.obsidian?.vaultPath) {
+        return {
+          output: 'Obsidian integration not configured. Add "obsidian": { "vaultPath": "/path/to/vault" } to ~/.nestor/nestor.config.json',
+          isError: true
+        };
+      }
+      try {
+        const obsidian = new ObsidianIntegration(cfg.obsidian);
+        const note2 = obsidian.readNote(args2.path);
+        if (!note2) {
+          return { output: `Note not found: ${args2.path}`, isError: true };
+        }
+        return { output: JSON.stringify(note2, null, 2), isError: false };
+      } catch (err) {
+        const msg = err instanceof Error ? err.message : String(err);
+        return { output: `Failed to read note: ${msg}`, isError: true };
+      }
+    }
+  });
+  registry.register({
+    name: "obsidian_list_notes",
+    description: "List all notes in the Obsidian vault Nestor folder, sorted by most recently modified.",
+    inputSchema: obsidianListNotesSchema,
+    handler: async (input, _ctx) => {
+      const args2 = input;
+      const cfg = loadIntegrationConfig();
+      if (!cfg.obsidian?.vaultPath) {
+        return {
+          output: 'Obsidian integration not configured. Add "obsidian": { "vaultPath": "/path/to/vault" } to ~/.nestor/nestor.config.json',
+          isError: true
+        };
+      }
+      try {
+        const obsidian = new ObsidianIntegration(cfg.obsidian);
+        if (!obsidian.isAvailable()) {
+          return { output: `Obsidian vault not found at: ${cfg.obsidian.vaultPath}`, isError: true };
+        }
+        const notes = obsidian.listNotes(args2.folder);
+        if (notes.length === 0) {
+          return { output: "No notes found.", isError: false };
+        }
+        const list = notes.map((n) => `- ${n.title} (${n.path}) \u2014 modified: ${n.modified.toISOString()}`).join("\n");
+        return { output: `Found ${notes.length} note(s):
+${list}`, isError: false };
+      } catch (err) {
+        const msg = err instanceof Error ? err.message : String(err);
+        return { output: `Failed to list notes: ${msg}`, isError: true };
+      }
+    }
+  });
+  const n8nTriggerSchema = z28.object({
+    webhook: z28.string().describe('Webhook path (e.g., "nestor-report" \u2014 will call {baseUrl}/webhook/nestor-report)'),
+    data: z28.record(z28.unknown()).optional().describe("JSON data to send to the webhook")
+  });
+  const n8nExecuteWorkflowSchema = z28.object({
+    workflowId: z28.string().describe("n8n workflow ID to execute"),
+    data: z28.record(z28.unknown()).optional().describe("Input data for the workflow")
+  });
+  registry.register({
+    name: "n8n_trigger",
+    description: 'Trigger an n8n webhook workflow. Sends JSON data to a webhook endpoint. Configure n8n in nestor.config.json under "n8n": { "baseUrl": "http://localhost:5678", "apiKey": "..." }.',
+    inputSchema: n8nTriggerSchema,
+    handler: async (input, _ctx) => {
+      const args2 = input;
+      const cfg = loadIntegrationConfig();
+      if (!cfg.n8n?.baseUrl) {
+        return {
+          output: 'n8n integration not configured. Add "n8n": { "baseUrl": "http://localhost:5678" } to ~/.nestor/nestor.config.json',
+          isError: true
+        };
+      }
+      try {
+        const n8n = new N8nIntegration(cfg.n8n);
+        const result = await n8n.triggerWebhook(args2.webhook, args2.data || {});
+        return { output: JSON.stringify(result, null, 2), isError: false };
+      } catch (err) {
+        const msg = err instanceof Error ? err.message : String(err);
+        return { output: `n8n webhook trigger failed: ${msg}`, isError: true };
+      }
+    }
+  });
+  registry.register({
+    name: "n8n_list_workflows",
+    description: "List available n8n workflows with their ID, name, and active status.",
+    inputSchema: emptySchema,
+    handler: async (_input, _ctx) => {
+      const cfg = loadIntegrationConfig();
+      if (!cfg.n8n?.baseUrl) {
+        return {
+          output: 'n8n integration not configured. Add "n8n": { "baseUrl": "http://localhost:5678" } to ~/.nestor/nestor.config.json',
+          isError: true
+        };
+      }
+      try {
+        const n8n = new N8nIntegration(cfg.n8n);
+        const available = await n8n.isAvailable();
+        if (!available) {
+          return { output: `n8n is not reachable at: ${cfg.n8n.baseUrl}`, isError: true };
+        }
+        const workflows = await n8n.listWorkflows();
+        if (workflows.length === 0) {
+          return { output: "No workflows found.", isError: false };
+        }
+        const list = workflows.map((w) => `- [${w.active ? "ACTIVE" : "inactive"}] ${w.name} (id: ${w.id})`).join("\n");
+        return { output: `Found ${workflows.length} workflow(s):
+${list}`, isError: false };
+      } catch (err) {
+        const msg = err instanceof Error ? err.message : String(err);
+        return { output: `Failed to list n8n workflows: ${msg}`, isError: true };
+      }
+    }
+  });
+  registry.register({
+    name: "n8n_execute_workflow",
+    description: "Execute an n8n workflow by its ID. Optionally pass input data.",
+    inputSchema: n8nExecuteWorkflowSchema,
+    handler: async (input, _ctx) => {
+      const args2 = input;
+      const cfg = loadIntegrationConfig();
+      if (!cfg.n8n?.baseUrl) {
+        return {
+          output: 'n8n integration not configured. Add "n8n": { "baseUrl": "http://localhost:5678" } to ~/.nestor/nestor.config.json',
+          isError: true
+        };
+      }
+      try {
+        const n8n = new N8nIntegration(cfg.n8n);
+        const result = await n8n.executeWorkflow(args2.workflowId, args2.data);
+        return { output: JSON.stringify(result, null, 2), isError: false };
+      } catch (err) {
+        const msg = err instanceof Error ? err.message : String(err);
+        return { output: `n8n workflow execution failed: ${msg}`, isError: true };
+      }
+    }
+  });
 }
-var emptySchema, createAgentSchema, runAgentSchema, deleteAgentSchema, createWorkflowSchema, searchMemorySchema, storeMemorySchema, createGuardrailSchema, createMissionSchema, missionIdSchema;
+var emptySchema, createAgentSchema, runAgentSchema, deleteAgentSchema, createWorkflowSchema, searchMemorySchema, storeMemorySchema, createGuardrailSchema, createMissionSchema, missionIdSchema, queryMemorySchema;
 var init_system_tools = __esm({
   "../agent/src/tools/system-tools.ts"() {
     "use strict";
+    init_layered_memory();
+    init_obsidian();
+    init_n8n();
     emptySchema = z28.object({}).passthrough();
     createAgentSchema = z28.object({
       name: z28.string().describe("Agent name"),
@@ -103879,6 +104596,9 @@ var init_system_tools = __esm({
     missionIdSchema = z28.object({
       missionId: z28.string().describe("The mission ID")
     });
+    queryMemorySchema = z28.object({
+      query: z28.string().describe("Natural language query to search across all memory layers (episodic: past missions, semantic: knowledge graph)")
+    });
   }
 });
 
@@ -103886,7 +104606,7 @@ var init_system_tools = __esm({
 import { z as z29 } from "zod";
 import { promises as fs14 } from "node:fs";
 import { execFile as execFile6 } from "node:child_process";
-import { resolve as resolve10, join as join9 } from "node:path";
+import { resolve as resolve10, join as join10 } from "node:path";
 function buildSandboxConfig(context3) {
   const s = context3.sandbox;
   return {
@@ -104167,11 +104887,11 @@ async function fileListHandler(input, context3) {
       const items = await fs14.readdir(dir, { withFileTypes: true });
       for (const item of items) {
         if (item.name.startsWith(".") || item.name === "node_modules") continue;
-        const relativePath = join9(dir, item.name).replace(absolutePath, "").replace(/^[/\\]/, "");
+        const relativePath = join10(dir, item.name).replace(absolutePath, "").replace(/^[/\\]/, "");
         if (item.isDirectory()) {
           entries.push(`${relativePath}/`);
           if (recursive) {
-            await listDir(join9(dir, item.name), depth + 1);
+            await listDir(join10(dir, item.name), depth + 1);
           }
         } else {
           entries.push(relativePath);
@@ -104264,32 +104984,19 @@ async function webFetchHandler(input, context3) {
     return { output: `Fetch failed: ${message}`, isError: true };
   }
 }
-async function webSearchHandler(input, context3) {
-  const { query, engine, maxResults } = input;
-  const max = maxResults || 5;
-  const searchEngine = engine || "duckduckgo";
-  let searchUrl;
-  switch (searchEngine) {
-    case "google":
-      searchUrl = `https://www.google.com/search?q=${encodeURIComponent(query)}&num=${max}`;
-      break;
-    case "bing":
-      searchUrl = `https://www.bing.com/search?q=${encodeURIComponent(query)}&count=${max}`;
-      break;
-    case "duckduckgo":
-    default:
-      searchUrl = `https://html.duckduckgo.com/html/?q=${encodeURIComponent(query)}`;
-      break;
+function pickUserAgent(attempt = 0) {
+  return SEARCH_USER_AGENTS[attempt % SEARCH_USER_AGENTS.length];
+}
+async function fetchSearchHtml(searchUrl, context3, userAgent, timeoutMs = 15e3) {
+  const controller = new AbortController();
+  const timer2 = setTimeout(() => controller.abort(), timeoutMs);
+  if (context3.signal) {
+    context3.signal.addEventListener("abort", () => controller.abort(), { once: true });
   }
   try {
-    const controller = new AbortController();
-    const timer2 = setTimeout(() => controller.abort(), 15e3);
-    if (context3.signal) {
-      context3.signal.addEventListener("abort", () => controller.abort(), { once: true });
-    }
     const resp = await fetch(searchUrl, {
       headers: {
-        "User-Agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36",
+        "User-Agent": userAgent,
         "Accept": "text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8",
         "Accept-Language": "en-US,en;q=0.9,fr;q=0.8"
       },
@@ -104297,96 +105004,217 @@ async function webSearchHandler(input, context3) {
       redirect: "follow"
     });
     clearTimeout(timer2);
-    if (!resp.ok) {
-      return { output: `Search failed: HTTP ${resp.status}. Try a different search engine with engine:"google" or engine:"bing".`, isError: true };
-    }
     const html = await resp.text();
-    const results = [];
-    if (searchEngine === "duckduckgo") {
-      const linkRegex = /<a[^>]*class="result__a"[^>]*href="([^"]*)"[^>]*>(.*?)<\/a>/gi;
-      const snippetRegex = /<a[^>]*class="result__snippet"[^>]*>(.*?)<\/a>/gi;
-      let linkMatch;
-      const links = [];
-      while ((linkMatch = linkRegex.exec(html)) !== null && links.length < max) {
-        let url = linkMatch[1];
-        const uddg = url.match(/uddg=([^&]*)/);
-        if (uddg) url = decodeURIComponent(uddg[1]);
-        const title = linkMatch[2].replace(/<[^>]*>/g, "").trim();
-        if (url.startsWith("http") && !url.includes("duckduckgo.com/y.js") && !url.includes("ad_domain=")) {
-          links.push({ url, title });
-        }
-      }
-      let snippetMatch;
-      const snippets = [];
-      while ((snippetMatch = snippetRegex.exec(html)) !== null) {
-        snippets.push(snippetMatch[1].replace(/<[^>]*>/g, "").trim());
-      }
-      for (let i = 0; i < links.length; i++) {
-        results.push({
-          title: links[i].title,
-          url: links[i].url,
-          snippet: snippets[i] || ""
-        });
-      }
-    } else if (searchEngine === "google") {
-      const resultBlockRegex = /<div class="[^"]*g[^"]*"[^>]*>[\s\S]*?<a[^>]*href="(https?:\/\/[^"]*)"[^>]*>([\s\S]*?)<\/a>[\s\S]*?(?:<span[^>]*>([\s\S]*?)<\/span>)?/gi;
-      let blockMatch;
-      while ((blockMatch = resultBlockRegex.exec(html)) !== null && results.length < max) {
-        const url = blockMatch[1];
-        const title = blockMatch[2].replace(/<[^>]*>/g, "").trim();
-        const snippet = (blockMatch[3] || "").replace(/<[^>]*>/g, "").trim();
-        if (title.length > 3 && !url.includes("google.com")) {
-          results.push({ title, url, snippet });
-        }
-      }
-    } else if (searchEngine === "bing") {
-      const bingRegex = /<li class="b_algo"[^>]*>[\s\S]*?<a[^>]*href="(https?:\/\/[^"]*)"[^>]*>([\s\S]*?)<\/a>[\s\S]*?<p[^>]*>([\s\S]*?)<\/p>/gi;
-      let bingMatch;
-      while ((bingMatch = bingRegex.exec(html)) !== null && results.length < max) {
-        const url = bingMatch[1];
-        const title = bingMatch[2].replace(/<[^>]*>/g, "").trim();
-        const snippet = bingMatch[3].replace(/<[^>]*>/g, "").trim();
-        if (title.length > 3) {
-          results.push({ title, url, snippet });
-        }
+    return { ok: resp.ok, status: resp.status, html };
+  } catch {
+    clearTimeout(timer2);
+    return { ok: false, status: 0, html: "" };
+  }
+}
+function parseDuckDuckGo(html, max) {
+  const results = [];
+  const linkRegex = /<a[^>]*class="result__a"[^>]*href="([^"]*)"[^>]*>(.*?)<\/a>/gi;
+  const snippetRegex = /<a[^>]*class="result__snippet"[^>]*>(.*?)<\/a>/gi;
+  let linkMatch;
+  const links = [];
+  while ((linkMatch = linkRegex.exec(html)) !== null && links.length < max) {
+    let url = linkMatch[1];
+    const uddg = url.match(/uddg=([^&]*)/);
+    if (uddg) url = decodeURIComponent(uddg[1]);
+    const title = linkMatch[2].replace(/<[^>]*>/g, "").trim();
+    if (url.startsWith("http") && !url.includes("duckduckgo.com/y.js") && !url.includes("ad_domain=")) {
+      links.push({ url, title });
+    }
+  }
+  let snippetMatch;
+  const snippets = [];
+  while ((snippetMatch = snippetRegex.exec(html)) !== null) {
+    snippets.push(snippetMatch[1].replace(/<[^>]*>/g, "").trim());
+  }
+  for (let i = 0; i < links.length; i++) {
+    results.push({
+      title: links[i].title,
+      url: links[i].url,
+      snippet: snippets[i] || ""
+    });
+  }
+  return results;
+}
+function parseGoogle(html, max) {
+  const results = [];
+  const googleRegex = /<a[^>]*href="(https?:\/\/[^"]*)"[^>]*><h3[^>]*>([^<]+)<\/h3>/gi;
+  let gMatch;
+  while ((gMatch = googleRegex.exec(html)) !== null && results.length < max) {
+    const url = gMatch[1];
+    const title = gMatch[2].trim();
+    if (title.length > 3 && !url.includes("google.com")) {
+      results.push({ title, url, snippet: "" });
+    }
+  }
+  if (results.length > 0) {
+    const snippetRegex = /<div[^>]*class="[^"]*VwiC3b[^"]*"[^>]*>([\s\S]*?)<\/div>/gi;
+    let sMatch;
+    let idx = 0;
+    while ((sMatch = snippetRegex.exec(html)) !== null && idx < results.length) {
+      const snippet = sMatch[1].replace(/<[^>]*>/g, "").trim();
+      if (snippet.length > 10) {
+        results[idx].snippet = snippet;
+        idx++;
       }
     }
-    if (results.length === 0) {
-      const anyLinkRegex = /<a[^>]*href="(https?:\/\/[^"]*)"[^>]*>(.*?)<\/a>/gi;
-      let anyMatch;
-      while ((anyMatch = anyLinkRegex.exec(html)) !== null && results.length < max) {
-        const url = anyMatch[1];
-        const title = anyMatch[2].replace(/<[^>]*>/g, "").trim();
-        if (title.length > 5 && !url.includes("duckduckgo.com") && !url.includes("google.com") && !url.includes("bing.com")) {
-          results.push({ title, url, snippet: "" });
-        }
+    return results;
+  }
+  const resultBlockRegex = /<div class="[^"]*g[^"]*"[^>]*>[\s\S]*?<a[^>]*href="(https?:\/\/[^"]*)"[^>]*>([\s\S]*?)<\/a>[\s\S]*?(?:<span[^>]*>([\s\S]*?)<\/span>)?/gi;
+  let blockMatch;
+  while ((blockMatch = resultBlockRegex.exec(html)) !== null && results.length < max) {
+    const url = blockMatch[1];
+    const title = blockMatch[2].replace(/<[^>]*>/g, "").trim();
+    const snippet = (blockMatch[3] || "").replace(/<[^>]*>/g, "").trim();
+    if (title.length > 3 && !url.includes("google.com")) {
+      results.push({ title, url, snippet });
+    }
+  }
+  return results;
+}
+function parseBing(html, max) {
+  const results = [];
+  const bingRegex = /<li[^>]*class="b_algo"[^>]*>[\s\S]*?<a[^>]*href="([^"]*)"[^>]*>([^<]+)<\/a>[\s\S]*?<p[^>]*>([^<]*)/gi;
+  let bingMatch;
+  while ((bingMatch = bingRegex.exec(html)) !== null && results.length < max) {
+    const url = bingMatch[1];
+    const title = bingMatch[2].replace(/<[^>]*>/g, "").trim();
+    const snippet = bingMatch[3].replace(/<[^>]*>/g, "").trim();
+    if (title.length > 3) {
+      results.push({ title, url, snippet });
+    }
+  }
+  if (results.length === 0) {
+    const fallbackRegex = /<li class="b_algo"[^>]*>[\s\S]*?<a[^>]*href="(https?:\/\/[^"]*)"[^>]*>([\s\S]*?)<\/a>[\s\S]*?<p[^>]*>([\s\S]*?)<\/p>/gi;
+    let fbMatch;
+    while ((fbMatch = fallbackRegex.exec(html)) !== null && results.length < max) {
+      const url = fbMatch[1];
+      const title = fbMatch[2].replace(/<[^>]*>/g, "").trim();
+      const snippet = fbMatch[3].replace(/<[^>]*>/g, "").trim();
+      if (title.length > 3) {
+        results.push({ title, url, snippet });
       }
     }
+  }
+  return results;
+}
+function parseAnyLinks(html, max) {
+  const results = [];
+  const anyLinkRegex = /<a[^>]*href="(https?:\/\/[^"]*)"[^>]*>(.*?)<\/a>/gi;
+  let anyMatch;
+  while ((anyMatch = anyLinkRegex.exec(html)) !== null && results.length < max) {
+    const url = anyMatch[1];
+    const title = anyMatch[2].replace(/<[^>]*>/g, "").trim();
+    if (title.length > 5 && !url.includes("duckduckgo.com") && !url.includes("google.com") && !url.includes("bing.com")) {
+      results.push({ title, url, snippet: "" });
+    }
+  }
+  return results;
+}
+async function searchSingleEngine(engineName, query, max, context3) {
+  let searchUrl;
+  let parser2;
+  switch (engineName) {
+    case "google":
+      searchUrl = `https://www.google.com/search?q=${encodeURIComponent(query)}&num=${max}`;
+      parser2 = parseGoogle;
+      break;
+    case "bing":
+      searchUrl = `https://www.bing.com/search?q=${encodeURIComponent(query)}&count=${max}`;
+      parser2 = parseBing;
+      break;
+    case "duckduckgo":
+    default:
+      searchUrl = `https://html.duckduckgo.com/html/?q=${encodeURIComponent(query)}`;
+      parser2 = parseDuckDuckGo;
+      break;
+  }
+  for (let attempt = 0; attempt < 2; attempt++) {
+    const ua = pickUserAgent(attempt);
+    const { ok, status, html } = await fetchSearchHtml(searchUrl, context3, ua);
+    if (!ok) {
+      if (attempt === 0) continue;
+      return { results: [], engineUsed: engineName, error: `HTTP ${status}` };
+    }
+    let results = parser2(html, max);
     if (results.length === 0) {
+      results = parseAnyLinks(html, max);
+    }
+    if (results.length > 0) {
+      return { results, engineUsed: engineName };
+    }
+  }
+  return { results: [], engineUsed: engineName, error: "0 results after UA rotation" };
+}
+async function webSearchHandler(input, context3) {
+  const { query, engine, maxResults } = input;
+  const max = maxResults || 5;
+  const searchEngine = engine || "auto";
+  if (searchEngine !== "auto") {
+    try {
+      const { results, error } = await searchSingleEngine(searchEngine, query, max, context3);
+      if (results.length === 0) {
+        return {
+          output: `No results found for "${query}" on ${searchEngine}${error ? ` (${error})` : ""}. Try a different query or use engine:"auto" for multi-engine fallback. You can also try web_fetch directly on a relevant URL.`,
+          isError: false
+        };
+      }
+      const formatted = results.map(
+        (r, i) => `${i + 1}. ${r.title}
+   ${r.url}
+   ${r.snippet}`
+      ).join("\n\n");
       return {
-        output: `No results found for "${query}". Try a different query or use a different engine (engine:"google" or engine:"bing"). You can also try web_fetch directly on a relevant URL.`,
+        output: `Search results for "${query}" (${searchEngine}):
+
+${formatted}
+
+Use web_fetch on any URL above to get the full page content.`,
         isError: false
       };
+    } catch (err) {
+      if (err.name === "AbortError") {
+        return { output: `Search timed out for "${query}". Try a simpler query or different engine.`, isError: true };
+      }
+      return { output: `Search error: ${err.message}. Try engine:"auto" for multi-engine fallback.`, isError: true };
     }
-    const formatted = results.map(
-      (r, i) => `${i + 1}. ${r.title}
+  }
+  const fallbackChain = ["duckduckgo", "google", "bing"];
+  const errors = [];
+  for (const eng of fallbackChain) {
+    try {
+      const { results, engineUsed, error } = await searchSingleEngine(eng, query, max, context3);
+      if (results.length > 0) {
+        const formatted = results.map(
+          (r, i) => `${i + 1}. ${r.title}
    ${r.url}
    ${r.snippet}`
-    ).join("\n\n");
-    return {
-      output: `Search results for "${query}":
+        ).join("\n\n");
+        const fallbackNote = eng !== "duckduckgo" ? `
+
+(Note: Results from ${engineUsed} \u2014 earlier engines returned 0 results)` : "";
+        return {
+          output: `Search results for "${query}" (${engineUsed}):
 
 ${formatted}
 
-Use web_fetch on any URL above to get the full page content.`,
-      isError: false
-    };
-  } catch (err) {
-    if (err.name === "AbortError") {
-      return { output: `Search timed out for "${query}". Try a simpler query or different engine.`, isError: true };
+Use web_fetch on any URL above to get the full page content.${fallbackNote}`,
+          isError: false
+        };
+      }
+      errors.push(`${eng}: ${error || "0 results"}`);
+    } catch (err) {
+      errors.push(`${eng}: ${err.message || "unknown error"}`);
     }
-    return { output: `Search error: ${err.message}. Try a different search engine with engine:"google" or engine:"bing".`, isError: true };
   }
+  return {
+    output: `All search engines failed for "${query}". Tried: ${errors.join("; ")}. Try web_fetch directly on known URLs (e.g., Wikipedia, company sites, social profiles) instead of searching.`,
+    isError: true
+  };
 }
 async function messageSendHandler(input, context3) {
   const { to, subject, body } = input;
@@ -104525,7 +105353,7 @@ function registerBrowserTools(registry, config2) {
   }
   return manager;
 }
-var shellExecSchema, sandboxCache, DANGEROUS_METACHARACTERS, shellExecTool, fileReadSchema, fileReadTool, fileWriteSchema, fileWriteTool, fileListSchema, fileListTool, webFetchSchema, webFetchTool, webSearchSchema, webSearchTool, messageSendSchema, messageSendTool, messageReadSchema, messageReadTool, handoffSchema, handoffTool, undoSchema;
+var shellExecSchema, sandboxCache, DANGEROUS_METACHARACTERS, shellExecTool, fileReadSchema, fileReadTool, fileWriteSchema, fileWriteTool, fileListSchema, fileListTool, webFetchSchema, webFetchTool, webSearchSchema, SEARCH_USER_AGENTS, webSearchTool, messageSendSchema, messageSendTool, messageReadSchema, messageReadTool, handoffSchema, handoffTool, undoSchema;
 var init_builtin = __esm({
   "../agent/src/tools/builtin.ts"() {
     "use strict";
@@ -104605,12 +105433,17 @@ var init_builtin = __esm({
     };
     webSearchSchema = z29.object({
       query: z29.string().describe("The search query"),
-      engine: z29.string().optional().describe("Search engine: google, duckduckgo, bing. Default: duckduckgo"),
+      engine: z29.string().optional().describe('Search engine: google, duckduckgo, bing, or "auto" for multi-engine fallback (default). Default: auto'),
       maxResults: z29.number().optional().describe("Max results to return. Default: 5")
     });
+    SEARCH_USER_AGENTS = [
+      "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36",
+      "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.0 Safari/605.1.15",
+      "Mozilla/5.0 (X11; Linux x86_64; rv:121.0) Gecko/20100101 Firefox/121.0"
+    ];
     webSearchTool = {
       name: "web_search",
-      description: "Search the internet using DuckDuckGo, Google, or Bing. Returns titles, URLs, and snippets. Use web_fetch on result URLs to read full page content. Always try this FIRST when you need to find information online.",
+      description: 'Search the internet using DuckDuckGo, Google, or Bing with automatic multi-engine fallback. Returns titles, URLs, and snippets. Use web_fetch on result URLs to read full page content. Default mode "auto" tries DuckDuckGo first, then Google, then Bing if previous engines return 0 results.',
       inputSchema: webSearchSchema,
       handler: webSearchHandler
     };
@@ -106534,8 +107367,8 @@ var init_store2 = __esm({
 });
 
 // ../agent/src/memory/files.ts
-import { readFileSync as readFileSync9, writeFileSync as writeFileSync3, existsSync as existsSync5, mkdirSync as mkdirSync3 } from "node:fs";
-import { join as join10, dirname as dirname5 } from "node:path";
+import { readFileSync as readFileSync10, writeFileSync as writeFileSync4, existsSync as existsSync6, mkdirSync as mkdirSync4 } from "node:fs";
+import { join as join11, dirname as dirname5 } from "node:path";
 var MemoryFiles;
 var init_files = __esm({
   "../agent/src/memory/files.ts"() {
@@ -106543,8 +107376,8 @@ var init_files = __esm({
     MemoryFiles = class {
       constructor(workDir) {
         this.workDir = workDir;
-        this.memoryPath = join10(workDir, "MEMORY.md");
-        this.userPath = join10(workDir, "USER.md");
+        this.memoryPath = join11(workDir, "MEMORY.md");
+        this.userPath = join11(workDir, "USER.md");
       }
       memoryPath;
       userPath;
@@ -106553,8 +107386,8 @@ var init_files = __esm({
        */
       readMemoryFile() {
         try {
-          if (!existsSync5(this.memoryPath)) return null;
-          return readFileSync9(this.memoryPath, "utf-8");
+          if (!existsSync6(this.memoryPath)) return null;
+          return readFileSync10(this.memoryPath, "utf-8");
         } catch {
           return null;
         }
@@ -106564,8 +107397,8 @@ var init_files = __esm({
        */
       readUserFile() {
         try {
-          if (!existsSync5(this.userPath)) return null;
-          return readFileSync9(this.userPath, "utf-8");
+          if (!existsSync6(this.userPath)) return null;
+          return readFileSync10(this.userPath, "utf-8");
         } catch {
           return null;
         }
@@ -106575,16 +107408,16 @@ var init_files = __esm({
        */
       appendMemory(observation) {
         const dir = dirname5(this.memoryPath);
-        if (!existsSync5(dir)) {
-          mkdirSync3(dir, { recursive: true });
+        if (!existsSync6(dir)) {
+          mkdirSync4(dir, { recursive: true });
         }
         const timestamp = (/* @__PURE__ */ new Date()).toISOString().split("T")[0];
         const entry = `
 - [${timestamp}] ${observation}
 `;
-        if (existsSync5(this.memoryPath)) {
-          const existing = readFileSync9(this.memoryPath, "utf-8");
-          writeFileSync3(this.memoryPath, existing + entry, "utf-8");
+        if (existsSync6(this.memoryPath)) {
+          const existing = readFileSync10(this.memoryPath, "utf-8");
+          writeFileSync4(this.memoryPath, existing + entry, "utf-8");
         } else {
           const header = `# Agent Memory
 
@@ -106592,7 +107425,7 @@ Persistent observations and notes.
 
 ## Observations
 `;
-          writeFileSync3(this.memoryPath, header + entry, "utf-8");
+          writeFileSync4(this.memoryPath, header + entry, "utf-8");
         }
       }
       /**
@@ -106600,8 +107433,8 @@ Persistent observations and notes.
        */
       updateUserProfile(info) {
         const dir = dirname5(this.userPath);
-        if (!existsSync5(dir)) {
-          mkdirSync3(dir, { recursive: true });
+        if (!existsSync6(dir)) {
+          mkdirSync4(dir, { recursive: true });
         }
         const lines = ["# User Profile\n"];
         for (const [key, value] of Object.entries(info)) {
@@ -106610,7 +107443,7 @@ Persistent observations and notes.
           }
         }
         lines.push("");
-        writeFileSync3(this.userPath, lines.join("\n"), "utf-8");
+        writeFileSync4(this.userPath, lines.join("\n"), "utf-8");
       }
       /**
        * Parse MEMORY.md into structured entries.
@@ -107896,6 +108729,7 @@ var init_memory = __esm({
     init_vector_store();
     init_persistent_vector_store();
     init_embedding_provider();
+    init_layered_memory();
     AgentMemory = class {
       constructor(store, agentId) {
         this.store = store;
@@ -108365,6 +109199,217 @@ ${e.reasoning}${ctx}`;
   }
 });
 
+// ../agent/src/safety/context-rotator.ts
+var ContextRotator;
+var init_context_rotator = __esm({
+  "../agent/src/safety/context-rotator.ts"() {
+    "use strict";
+    ContextRotator = class {
+      cfg;
+      messageCount = 0;
+      estimatedTokens = 0;
+      constructor(config2 = {}) {
+        this.cfg = {
+          maxMessages: config2.maxMessages ?? 50,
+          maxTokensEstimate: config2.maxTokensEstimate ?? 1e5,
+          charsPerToken: config2.charsPerToken ?? 4,
+          recentToKeep: config2.recentToKeep ?? 10
+        };
+      }
+      // ── Recording ───────────────────────────────────────────────────────
+      /** Record a message added to context. */
+      recordMessage(content) {
+        this.messageCount++;
+        this.estimatedTokens += Math.ceil(content.length / this.cfg.charsPerToken);
+      }
+      // ── Checking ────────────────────────────────────────────────────────
+      /** Check if context should be rotated. */
+      shouldRotate() {
+        if (this.messageCount >= this.cfg.maxMessages) {
+          return {
+            rotate: true,
+            reason: `${this.messageCount} messages (limit: ${this.cfg.maxMessages})`
+          };
+        }
+        if (this.estimatedTokens >= this.cfg.maxTokensEstimate) {
+          return {
+            rotate: true,
+            reason: `~${this.estimatedTokens} tokens (limit: ${this.cfg.maxTokensEstimate})`
+          };
+        }
+        return { rotate: false };
+      }
+      // ── Rotation helpers ────────────────────────────────────────────────
+      /**
+       * Build a compact summary for context rotation.
+       *
+       * Strategy:
+       * - Preserve the system message verbatim
+       * - Summarize the middle messages into a compact block
+       * - Keep the last N recent messages verbatim
+       *
+       * Returns the summary text to inject as a single assistant message
+       * between the system prompt and the recent messages.
+       */
+      buildRotationSummary(messages) {
+        const keepCount = this.cfg.recentToKeep;
+        const system = messages.find((m) => m.role === "system");
+        const nonSystem = messages.filter((m) => m.role !== "system");
+        const recent = nonSystem.slice(-keepCount);
+        const middle = nonSystem.slice(0, Math.max(0, nonSystem.length - keepCount));
+        const parts = [];
+        if (system) {
+          parts.push("[System prompt preserved]");
+        }
+        if (middle.length > 0) {
+          const toolCalls = middle.filter(
+            (m) => m.content.includes("tool_use") || m.content.includes("function_call") || m.content.includes("tool_result")
+          ).length;
+          const findings = middle.filter(
+            (m) => m.content.includes("finding") || m.content.includes("result") || m.content.includes("discovered")
+          ).length;
+          const errors = middle.filter(
+            (m) => m.content.includes("error") || m.content.includes("failed")
+          ).length;
+          parts.push(
+            `[${middle.length} earlier messages summarized: ${toolCalls} tool interactions, ${findings} results/findings, ${errors} errors]`
+          );
+        }
+        parts.push(`[${recent.length} recent messages preserved below]`);
+        return parts.join("\n");
+      }
+      // ── Lifecycle ───────────────────────────────────────────────────────
+      /** Reset counters after rotation. */
+      reset() {
+        this.messageCount = 0;
+        this.estimatedTokens = 0;
+      }
+      /** Get current stats (useful for logging/telemetry). */
+      getStats() {
+        return {
+          messageCount: this.messageCount,
+          estimatedTokens: this.estimatedTokens
+        };
+      }
+    };
+  }
+});
+
+// ../agent/src/safety/stuck-detector.ts
+var StuckDetector;
+var init_stuck_detector = __esm({
+  "../agent/src/safety/stuck-detector.ts"() {
+    "use strict";
+    StuckDetector = class {
+      cfg;
+      toolCallHistory = [];
+      findingsCount = 0;
+      iterationsWithoutProgress = 0;
+      consecutiveErrors = 0;
+      startTime = Date.now();
+      constructor(config2 = {}) {
+        this.cfg = {
+          maxRepeatedCalls: config2.maxRepeatedCalls ?? 3,
+          maxIterationsWithoutProgress: config2.maxIterationsWithoutProgress ?? 5,
+          maxConsecutiveErrors: config2.maxConsecutiveErrors ?? 3,
+          maxSubObjectiveTimeMs: config2.maxSubObjectiveTimeMs ?? 3e5
+        };
+      }
+      // ── Recording ───────────────────────────────────────────────────────
+      /** Record a tool call for pattern detection. */
+      recordToolCall(name, args2) {
+        this.toolCallHistory.push({
+          name,
+          args: JSON.stringify(args2),
+          timestamp: Date.now()
+        });
+      }
+      /** Record a tool result (success or error). */
+      recordResult(isError) {
+        if (isError) {
+          this.consecutiveErrors++;
+        } else {
+          this.consecutiveErrors = 0;
+        }
+      }
+      /** Update findings count — call after each iteration of the agent loop. */
+      updateProgress(currentFindings) {
+        if (currentFindings > this.findingsCount) {
+          this.findingsCount = currentFindings;
+          this.iterationsWithoutProgress = 0;
+        } else {
+          this.iterationsWithoutProgress++;
+        }
+      }
+      // ── Checking ────────────────────────────────────────────────────────
+      /** Check if the agent appears stuck. */
+      check() {
+        const elapsed = Date.now() - this.startTime;
+        if (elapsed > this.cfg.maxSubObjectiveTimeMs) {
+          return {
+            isStuck: true,
+            reason: "timeout",
+            details: `Sub-objective exceeded ${this.cfg.maxSubObjectiveTimeMs}ms (elapsed: ${elapsed}ms)`,
+            suggestedAction: "skip"
+          };
+        }
+        const windowSize = this.cfg.maxRepeatedCalls;
+        if (this.toolCallHistory.length >= windowSize) {
+          const recent = this.toolCallHistory.slice(-windowSize);
+          const first2 = recent[0];
+          const allSame = recent.every(
+            (c) => c.name === first2.name && c.args === first2.args
+          );
+          if (allSame) {
+            return {
+              isStuck: true,
+              reason: "repeated_calls",
+              details: `Tool "${first2.name}" called ${windowSize}x with identical args`,
+              suggestedAction: "retry_different"
+            };
+          }
+        }
+        if (this.iterationsWithoutProgress >= this.cfg.maxIterationsWithoutProgress) {
+          return {
+            isStuck: true,
+            reason: "no_progress",
+            details: `${this.iterationsWithoutProgress} iterations without new findings`,
+            suggestedAction: "escalate_model"
+          };
+        }
+        if (this.consecutiveErrors >= this.cfg.maxConsecutiveErrors) {
+          return {
+            isStuck: true,
+            reason: "error_loop",
+            details: `${this.consecutiveErrors} consecutive tool errors`,
+            suggestedAction: "retry_different"
+          };
+        }
+        return { isStuck: false };
+      }
+      // ── Lifecycle ───────────────────────────────────────────────────────
+      /** Reset all state for reuse (e.g., new sub-objective). */
+      reset() {
+        this.toolCallHistory = [];
+        this.findingsCount = 0;
+        this.iterationsWithoutProgress = 0;
+        this.consecutiveErrors = 0;
+        this.startTime = Date.now();
+      }
+      /** Get a diagnostic snapshot (useful for logging/telemetry). */
+      getSnapshot() {
+        return {
+          totalCalls: this.toolCallHistory.length,
+          consecutiveErrors: this.consecutiveErrors,
+          iterationsWithoutProgress: this.iterationsWithoutProgress,
+          findingsCount: this.findingsCount,
+          elapsedMs: Date.now() - this.startTime
+        };
+      }
+    };
+  }
+});
+
 // ../agent/src/runtime.ts
 function estimateCost(model, inputTokens, outputTokens) {
   let costs = COST_PER_1M_TOKENS[model];
@@ -108432,6 +109477,8 @@ var init_runtime = __esm({
     init_hot_swap();
     init_auto_downgrade();
     init_reason_logger();
+    init_context_rotator();
+    init_stuck_detector();
     COST_PER_1M_TOKENS = {
       "claude-sonnet-4-20250514": { input: 3, output: 15 },
       "claude-3-5-sonnet": { input: 3, output: 15 },
@@ -108466,6 +109513,10 @@ var init_runtime = __esm({
       autoDowngrade = null;
       /** Explainability: logs the agent's reasoning at each step. */
       reasonLogger = new ReasonLogger();
+      /** Context rotator for fresh-context pattern (Ralph methodology). */
+      contextRotator;
+      /** Stuck detector for loop/stall detection. */
+      stuckDetector;
       constructor(config2) {
         this.config = config2;
         this.hotSwap = new HotSwapAdapter(config2.adapter);
@@ -108550,6 +109601,8 @@ var init_runtime = __esm({
           workspaceContext,
           errorCorrections
         });
+        this.contextRotator = new ContextRotator(config2.contextRotation);
+        this.stuckDetector = new StuckDetector(config2.stuckDetection);
       }
       /**
        * Run the agent loop for a given task.
@@ -108577,6 +109630,9 @@ var init_runtime = __esm({
         let lastOutput = "";
         let exitReason = "completed";
         let error;
+        let consecutiveStucks = 0;
+        this.contextRotator.reset();
+        this.stuckDetector.reset();
         if (this.config.dryRun) {
           this.dryRunInterceptor = new DryRunInterceptor();
         } else {
@@ -108901,8 +109957,51 @@ ${this.config.orgChartContext}` : this.config.orgChartContext;
                 }
               ]);
               messages.push(...toolResultMessages);
+              this.stuckDetector.recordToolCall(toolCall.name, toolCall.arguments);
+              this.stuckDetector.recordResult(result2.isError ?? false);
+              const stuckCheck = this.stuckDetector.check();
+              if (stuckCheck.isStuck) {
+                this.log.warn("Agent stuck detected", {
+                  reason: stuckCheck.reason,
+                  suggestion: stuckCheck.suggestedAction
+                });
+                messages.push({
+                  role: "user",
+                  content: `[System] You appear to be stuck (${stuckCheck.reason}). ${stuckCheck.suggestedAction === "retry_different" ? "Try a completely different approach." : stuckCheck.suggestedAction === "skip" ? "Skip this and move to the next task." : stuckCheck.suggestedAction === "escalate_model" ? "This task may require deeper analysis." : "Consider aborting this approach."}`
+                });
+                if (stuckCheck.reason === "timeout" || consecutiveStucks >= 2) {
+                  exitReason = "error";
+                  error = `Agent stuck: ${stuckCheck.reason} \u2014 ${stuckCheck.details ?? ""}`;
+                  break;
+                }
+                consecutiveStucks++;
+              } else {
+                consecutiveStucks = 0;
+              }
             }
             if (exitReason === "aborted") break;
+            if (exitReason === "error") break;
+            this.contextRotator.recordMessage(response.content);
+            const rotationCheck = this.contextRotator.shouldRotate();
+            if (rotationCheck.rotate) {
+              const summary = this.contextRotator.buildRotationSummary(messages);
+              const systemMsg = messages[0];
+              const recent = messages.slice(-3);
+              messages.length = 0;
+              messages.push(
+                systemMsg,
+                {
+                  role: "user",
+                  content: `[Context rotation \u2014 previous messages summarized]
+${summary}
+
+Continue from where you left off.`
+                },
+                ...recent
+              );
+              this.contextRotator.reset();
+              this.log.info("Context rotated", { reason: rotationCheck.reason });
+            }
           }
           if (iterations >= maxIterations && exitReason === "completed") {
             exitReason = "max_iterations";
@@ -109144,6 +110243,9 @@ ${this.config.orgChartContext}` : this.config.orgChartContext;
         let consecutiveFailures = 0;
         let lastFailedToolName = "";
         const MAX_CONSECUTIVE_FAILURES = 3;
+        let consecutiveStucks = 0;
+        this.contextRotator.reset();
+        this.stuckDetector.reset();
         const messages = this.contextBuilder.buildMessages(
           task.prompt,
           this.config.initialMessages
@@ -109421,8 +110523,51 @@ ${this.config.orgChartContext}` : this.config.orgChartContext;
                 }
               ]);
               messages.push(...toolResultMessages);
+              this.stuckDetector.recordToolCall(toolCall.name, toolCall.arguments);
+              this.stuckDetector.recordResult(result.isError ?? false);
+              const stuckCheck = this.stuckDetector.check();
+              if (stuckCheck.isStuck) {
+                this.log.warn("Agent stuck detected (streaming)", {
+                  reason: stuckCheck.reason,
+                  suggestion: stuckCheck.suggestedAction
+                });
+                messages.push({
+                  role: "user",
+                  content: `[System] You appear to be stuck (${stuckCheck.reason}). ${stuckCheck.suggestedAction === "retry_different" ? "Try a completely different approach." : stuckCheck.suggestedAction === "skip" ? "Skip this and move to the next task." : stuckCheck.suggestedAction === "escalate_model" ? "This task may require deeper analysis." : "Consider aborting this approach."}`
+                });
+                if (stuckCheck.reason === "timeout" || consecutiveStucks >= 2) {
+                  exitReason = "error";
+                  error = `Agent stuck: ${stuckCheck.reason} \u2014 ${stuckCheck.details ?? ""}`;
+                  break;
+                }
+                consecutiveStucks++;
+              } else {
+                consecutiveStucks = 0;
+              }
             }
             if (exitReason === "aborted") break;
+            if (exitReason === "error") break;
+            this.contextRotator.recordMessage(response.content);
+            const rotationCheck = this.contextRotator.shouldRotate();
+            if (rotationCheck.rotate) {
+              const summary = this.contextRotator.buildRotationSummary(messages);
+              const systemMsg = messages[0];
+              const recent = messages.slice(-3);
+              messages.length = 0;
+              messages.push(
+                systemMsg,
+                {
+                  role: "user",
+                  content: `[Context rotation \u2014 previous messages summarized]
+${summary}
+
+Continue from where you left off.`
+                },
+                ...recent
+              );
+              this.contextRotator.reset();
+              this.log.info("Context rotated (streaming)", { reason: rotationCheck.reason });
+            }
           }
           if (iterations >= maxIterations && exitReason === "completed") {
             exitReason = "max_iterations";
@@ -110511,8 +111656,8 @@ var init_embeddings = __esm({
 });
 
 // ../agent/src/rag/indexer.ts
-import { readFileSync as readFileSync10, statSync as statSync3, existsSync as existsSync6 } from "node:fs";
-import { join as join11, relative as relative3, resolve as resolve11 } from "node:path";
+import { readFileSync as readFileSync11, statSync as statSync4, existsSync as existsSync7 } from "node:fs";
+import { join as join12, relative as relative4, resolve as resolve11 } from "node:path";
 function matchesGlob(filePath, pattern) {
   const regexStr = pattern.replace(/\./g, "\\.").replace(/\*\*/g, "{{GLOBSTAR}}").replace(/\*/g, "[^/]*").replace(/\{\{GLOBSTAR\}\}/g, ".*");
   return new RegExp(`^${regexStr}$`).test(filePath) || new RegExp(`(^|/)${regexStr}$`).test(filePath);
@@ -110538,14 +111683,14 @@ function walkDirectory2(dir, excludePatterns) {
     const currentDir = stack.pop();
     let entries;
     try {
-      const { readdirSync: readdirSync7 } = __require("node:fs");
-      entries = readdirSync7(currentDir);
+      const { readdirSync: readdirSync8 } = __require("node:fs");
+      entries = readdirSync8(currentDir);
     } catch {
       continue;
     }
     for (const entry of entries) {
-      const fullPath = join11(currentDir, entry);
-      const relFromRoot = relative3(dir, fullPath).replace(/\\/g, "/");
+      const fullPath = join12(currentDir, entry);
+      const relFromRoot = relative4(dir, fullPath).replace(/\\/g, "/");
       let excluded = false;
       for (const pattern of excludePatterns) {
         if (!pattern.includes("*") && !pattern.includes(".")) {
@@ -110557,7 +111702,7 @@ function walkDirectory2(dir, excludePatterns) {
       }
       if (excluded) continue;
       try {
-        const stat = statSync3(fullPath);
+        const stat = statSync4(fullPath);
         if (stat.isDirectory()) {
           stack.push(fullPath);
         } else if (stat.isFile()) {
@@ -110649,13 +111794,13 @@ var init_indexer = __esm({
         const tenantId = opts?.tenantId ?? "default";
         const onProgress = opts?.onProgress;
         const absDir = resolve11(dir);
-        if (!existsSync6(absDir)) {
+        if (!existsSync7(absDir)) {
           throw new Error(`Directory not found: ${absDir}`);
         }
         const allFiles = walkDirectory2(absDir, excludePatterns);
         const matchingFiles = [];
         for (const file of allFiles) {
-          const relPath = relative3(absDir, file).replace(/\\/g, "/");
+          const relPath = relative4(absDir, file).replace(/\\/g, "/");
           if (shouldInclude(relPath, includePatterns, excludePatterns)) {
             matchingFiles.push(file);
           }
@@ -110671,11 +111816,11 @@ var init_indexer = __esm({
         let totalFilesIndexed = 0;
         const allChunks = [];
         for (const filePath of matchingFiles) {
-          const relPath = relative3(absDir, filePath).replace(/\\/g, "/");
+          const relPath = relative4(absDir, filePath).replace(/\\/g, "/");
           progress.currentFile = relPath;
           onProgress?.(progress);
           try {
-            const content = readFileSync10(filePath, "utf-8");
+            const content = readFileSync11(filePath, "utf-8");
             if (content.includes("\0")) {
               progress.processedFiles++;
               continue;
@@ -110684,7 +111829,7 @@ var init_indexer = __esm({
               progress.processedFiles++;
               continue;
             }
-            const mtime = statSync3(filePath).mtimeMs;
+            const mtime = statSync4(filePath).mtimeMs;
             const chunks = this.chunker.chunk(relPath, content);
             for (const chunk of chunks) {
               allChunks.push({ ...chunk, fileMtime: Math.floor(mtime) });
@@ -110746,7 +111891,7 @@ ${c.content}`);
         const tenantId = opts?.tenantId ?? "default";
         const onProgress = opts?.onProgress;
         const absDir = resolve11(dir);
-        if (!existsSync6(absDir)) {
+        if (!existsSync7(absDir)) {
           throw new Error(`Directory not found: ${absDir}`);
         }
         const existingMtimes = this.store.getChunkMtimes(tenantId);
@@ -110757,16 +111902,16 @@ ${c.content}`);
         const allFiles = walkDirectory2(absDir, excludePatterns);
         const matchingFiles = [];
         for (const file of allFiles) {
-          const relPath = relative3(absDir, file).replace(/\\/g, "/");
+          const relPath = relative4(absDir, file).replace(/\\/g, "/");
           if (shouldInclude(relPath, includePatterns, excludePatterns)) {
             matchingFiles.push(file);
           }
         }
         const filesToProcess = [];
         for (const filePath of matchingFiles) {
-          const relPath = relative3(absDir, filePath).replace(/\\/g, "/");
+          const relPath = relative4(absDir, filePath).replace(/\\/g, "/");
           try {
-            const mtime = Math.floor(statSync3(filePath).mtimeMs);
+            const mtime = Math.floor(statSync4(filePath).mtimeMs);
             const existingMtime = mtimeMap.get(relPath);
             if (existingMtime === void 0 || mtime > existingMtime) {
               filesToProcess.push(filePath);
@@ -110788,16 +111933,16 @@ ${c.content}`);
         let totalChunksCreated = 0;
         let totalFilesIndexed = 0;
         for (const filePath of filesToProcess) {
-          const relPath = relative3(absDir, filePath).replace(/\\/g, "/");
+          const relPath = relative4(absDir, filePath).replace(/\\/g, "/");
           progress.currentFile = relPath;
           onProgress?.(progress);
           try {
-            const content = readFileSync10(filePath, "utf-8");
+            const content = readFileSync11(filePath, "utf-8");
             if (content.includes("\0") || content.length > 5e5) {
               progress.processedFiles++;
               continue;
             }
-            const mtime = Math.floor(statSync3(filePath).mtimeMs);
+            const mtime = Math.floor(statSync4(filePath).mtimeMs);
             this.store.clearChunksByFile(relPath, tenantId);
             const chunks = this.chunker.chunk(relPath, content);
             const texts = chunks.map((c) => `${c.name ?? c.type} in ${c.filePath}
@@ -110980,8 +112125,8 @@ var init_search = __esm({
 });
 
 // ../agent/src/rag/mental-model.ts
-import { readFileSync as readFileSync11, statSync as statSync4, readdirSync as readdirSync2, writeFileSync as writeFileSync4, existsSync as existsSync7 } from "node:fs";
-import { join as join12, relative as relative4, resolve as resolve12, extname as extname3, basename as basename3, dirname as dirname6 } from "node:path";
+import { readFileSync as readFileSync12, statSync as statSync5, readdirSync as readdirSync3, writeFileSync as writeFileSync5, existsSync as existsSync8 } from "node:fs";
+import { join as join13, relative as relative5, resolve as resolve12, extname as extname3, basename as basename4, dirname as dirname6 } from "node:path";
 var EXCLUDE_DIRS, SOURCE_EXTENSIONS, MentalModelBuilder;
 var init_mental_model = __esm({
   "../agent/src/rag/mental-model.ts"() {
@@ -111045,10 +112190,10 @@ var init_mental_model = __esm({
         const files = await this.findSourceFiles(absRoot);
         const nodes = /* @__PURE__ */ new Map();
         for (const file of files) {
-          const relPath = relative4(absRoot, file).replace(/\\/g, "/");
+          const relPath = relative5(absRoot, file).replace(/\\/g, "/");
           let content;
           try {
-            content = readFileSync11(file, "utf-8");
+            content = readFileSync12(file, "utf-8");
           } catch {
             continue;
           }
@@ -111056,14 +112201,14 @@ var init_mental_model = __esm({
           const imports = this.extractImports(content, file, absRoot);
           let mtime;
           try {
-            mtime = statSync4(file).mtimeMs;
+            mtime = statSync5(file).mtimeMs;
           } catch {
             mtime = Date.now();
           }
           nodes.set(relPath, {
             path: relPath,
             type: "file",
-            name: basename3(file),
+            name: basename4(file),
             dependencies: imports,
             dependents: [],
             lastModified: mtime,
@@ -111096,7 +112241,7 @@ var init_mental_model = __esm({
         );
         const hubs = [...graph.nodes.values()].sort((a, b) => b.dependents.length - a.dependents.length).slice(0, 5);
         const lines = [];
-        lines.push(`Project: ${basename3(graph.rootDir)}`);
+        lines.push(`Project: ${basename4(graph.rootDir)}`);
         lines.push(`Language: ${graph.language}`);
         if (graph.framework) lines.push(`Framework: ${graph.framework}`);
         lines.push(`Files: ${moduleCount}`);
@@ -111183,15 +112328,15 @@ var init_mental_model = __esm({
        */
       save(graph, filePath) {
         const json = this.toJson(graph);
-        writeFileSync4(filePath, JSON.stringify(json, null, 2), "utf-8");
+        writeFileSync5(filePath, JSON.stringify(json, null, 2), "utf-8");
       }
       /**
        * Load a graph from a JSON file.
        */
       load(filePath) {
-        if (!existsSync7(filePath)) return null;
+        if (!existsSync8(filePath)) return null;
         try {
-          const content = readFileSync11(filePath, "utf-8");
+          const content = readFileSync12(filePath, "utf-8");
           const json = JSON.parse(content);
           return this.fromJson(json);
         } catch {
@@ -111270,7 +112415,7 @@ var init_mental_model = __esm({
         }
         const fromDir = dirname6(fromFile);
         const resolved = resolve12(fromDir, specifier);
-        const relPath = relative4(rootDir, resolved).replace(/\\/g, "/");
+        const relPath = relative5(rootDir, resolved).replace(/\\/g, "/");
         const candidates = [
           relPath,
           relPath + ".ts",
@@ -111291,7 +112436,7 @@ var init_mental_model = __esm({
         for (const candidate of candidates) {
           const fullPath = resolve12(rootDir, candidate);
           try {
-            const stat = statSync4(fullPath);
+            const stat = statSync5(fullPath);
             if (stat.isFile()) {
               return candidate;
             }
@@ -111301,7 +112446,7 @@ var init_mental_model = __esm({
         return relPath;
       }
       resolveRelativePy(modulePath, fromFile, rootDir) {
-        const relPath = relative4(rootDir, resolve12(dirname6(fromFile), modulePath)).replace(/\\/g, "/");
+        const relPath = relative5(rootDir, resolve12(dirname6(fromFile), modulePath)).replace(/\\/g, "/");
         const candidates = [
           relPath + ".py",
           relPath + "/__init__.py"
@@ -111309,7 +112454,7 @@ var init_mental_model = __esm({
         for (const candidate of candidates) {
           const fullPath = resolve12(rootDir, candidate);
           try {
-            if (statSync4(fullPath).isFile()) return candidate;
+            if (statSync5(fullPath).isFile()) return candidate;
           } catch {
           }
         }
@@ -111384,10 +112529,10 @@ var init_mental_model = __esm({
         return "Unknown";
       }
       detectFramework(rootDir) {
-        const pkgPath = join12(rootDir, "package.json");
-        if (existsSync7(pkgPath)) {
+        const pkgPath = join13(rootDir, "package.json");
+        if (existsSync8(pkgPath)) {
           try {
-            const pkg = JSON.parse(readFileSync11(pkgPath, "utf-8"));
+            const pkg = JSON.parse(readFileSync12(pkgPath, "utf-8"));
             const deps = {
               ...pkg.dependencies ?? {},
               ...pkg.devDependencies ?? {}
@@ -111406,10 +112551,10 @@ var init_mental_model = __esm({
           } catch {
           }
         }
-        const cargoPath = join12(rootDir, "Cargo.toml");
-        if (existsSync7(cargoPath)) {
+        const cargoPath = join13(rootDir, "Cargo.toml");
+        if (existsSync8(cargoPath)) {
           try {
-            const cargo = readFileSync11(cargoPath, "utf-8");
+            const cargo = readFileSync12(cargoPath, "utf-8");
             if (cargo.includes("actix-web")) return "Actix";
             if (cargo.includes("axum")) return "Axum";
             if (cargo.includes("rocket")) return "Rocket";
@@ -111417,10 +112562,10 @@ var init_mental_model = __esm({
           } catch {
           }
         }
-        const goModPath = join12(rootDir, "go.mod");
-        if (existsSync7(goModPath)) {
+        const goModPath = join13(rootDir, "go.mod");
+        if (existsSync8(goModPath)) {
           try {
-            const goMod = readFileSync11(goModPath, "utf-8");
+            const goMod = readFileSync12(goModPath, "utf-8");
             if (goMod.includes("gin-gonic")) return "Gin";
             if (goMod.includes("echo")) return "Echo";
             if (goMod.includes("fiber")) return "Fiber";
@@ -111428,10 +112573,10 @@ var init_mental_model = __esm({
           }
         }
         for (const pyFile of ["requirements.txt", "pyproject.toml"]) {
-          const pyPath = join12(rootDir, pyFile);
-          if (existsSync7(pyPath)) {
+          const pyPath = join13(rootDir, pyFile);
+          if (existsSync8(pyPath)) {
             try {
-              const content = readFileSync11(pyPath, "utf-8");
+              const content = readFileSync12(pyPath, "utf-8");
               if (content.includes("django")) return "Django";
               if (content.includes("flask")) return "Flask";
               if (content.includes("fastapi")) return "FastAPI";
@@ -111485,16 +112630,16 @@ var init_mental_model = __esm({
           const currentDir = stack.pop();
           let entries;
           try {
-            entries = readdirSync2(currentDir);
+            entries = readdirSync3(currentDir);
           } catch {
             continue;
           }
           for (const entry of entries) {
             if (EXCLUDE_DIRS.has(entry)) continue;
             if (entry.startsWith(".") && entry !== ".") continue;
-            const fullPath = join12(currentDir, entry);
+            const fullPath = join13(currentDir, entry);
             try {
-              const stat = statSync4(fullPath);
+              const stat = statSync5(fullPath);
               if (stat.isDirectory()) {
                 stack.push(fullPath);
               } else if (stat.isFile()) {
@@ -111527,7 +112672,7 @@ var init_rag = __esm({
 });
 
 // ../agent/src/testing/mock-adapter.ts
-import { readFileSync as readFileSync12, writeFileSync as writeFileSync5 } from "node:fs";
+import { readFileSync as readFileSync13, writeFileSync as writeFileSync6 } from "node:fs";
 var MockLlmAdapter, RecordingAdapter;
 var init_mock_adapter = __esm({
   "../agent/src/testing/mock-adapter.ts"() {
@@ -111579,7 +112724,7 @@ var init_mock_adapter = __esm({
       }
       /** Create from a JSON file of recorded responses. */
       static fromFile(filePath) {
-        const data = JSON.parse(readFileSync12(filePath, "utf-8"));
+        const data = JSON.parse(readFileSync13(filePath, "utf-8"));
         return new _MockLlmAdapter2(data);
       }
     };
@@ -111611,11 +112756,11 @@ var init_mock_adapter = __esm({
       /** Save recordings to a JSON file. */
       save(filePath) {
         const responses = this.recordings.map((r) => r.response);
-        writeFileSync5(filePath, JSON.stringify(responses, null, 2), "utf-8");
+        writeFileSync6(filePath, JSON.stringify(responses, null, 2), "utf-8");
       }
       /** Load responses from a JSON file (returns the responses array for MockLlmAdapter). */
       static load(filePath) {
-        return JSON.parse(readFileSync12(filePath, "utf-8"));
+        return JSON.parse(readFileSync13(filePath, "utf-8"));
       }
       /** Get just the response objects for replaying. */
       getResponses() {
@@ -111777,8 +112922,8 @@ var init_assertions = __esm({
 });
 
 // ../agent/src/testing/runner.ts
-import { readFileSync as readFileSync13, mkdirSync as mkdirSync4, writeFileSync as writeFileSync6, rmSync, existsSync as existsSync8 } from "node:fs";
-import { join as join13 } from "node:path";
+import { readFileSync as readFileSync14, mkdirSync as mkdirSync5, writeFileSync as writeFileSync7, rmSync, existsSync as existsSync9 } from "node:fs";
+import { join as join14 } from "node:path";
 import { tmpdir as tmpdir3 } from "node:os";
 import { randomUUID as randomUUID27 } from "node:crypto";
 function parseYaml(content) {
@@ -111880,7 +113025,7 @@ var init_runner = __esm({
     AgentTestRunner = class {
       /** Load test suite from a YAML or JSON file. */
       static loadSuite(filePath) {
-        const content = readFileSync13(filePath, "utf-8");
+        const content = readFileSync14(filePath, "utf-8");
         const parsed = parseYaml(content);
         return {
           name: parsed.name ?? "Unnamed Suite",
@@ -111903,18 +113048,18 @@ var init_runner = __esm({
       async runTest(testCase) {
         const startTime4 = Date.now();
         try {
-          const tempDir = join13(tmpdir3(), `nestor-test-${randomUUID27()}`);
-          mkdirSync4(tempDir, { recursive: true });
+          const tempDir = join14(tmpdir3(), `nestor-test-${randomUUID27()}`);
+          mkdirSync5(tempDir, { recursive: true });
           if (testCase.files) {
             for (const [path30, content] of Object.entries(testCase.files)) {
-              const fullPath = join13(tempDir, path30);
-              mkdirSync4(join13(fullPath, ".."), { recursive: true });
-              writeFileSync6(fullPath, content, "utf-8");
+              const fullPath = join14(tempDir, path30);
+              mkdirSync5(join14(fullPath, ".."), { recursive: true });
+              writeFileSync7(fullPath, content, "utf-8");
             }
           }
           let responses;
-          if (testCase.recordings && existsSync8(testCase.recordings)) {
-            responses = JSON.parse(readFileSync13(testCase.recordings, "utf-8"));
+          if (testCase.recordings && existsSync9(testCase.recordings)) {
+            responses = JSON.parse(readFileSync14(testCase.recordings, "utf-8"));
           } else {
             responses = [{
               content: "Test completed successfully.",
@@ -114276,121 +115421,6 @@ var init_knowledge = __esm({
   }
 });
 
-// ../agent/src/safety/stuck-detector.ts
-var StuckDetector;
-var init_stuck_detector = __esm({
-  "../agent/src/safety/stuck-detector.ts"() {
-    "use strict";
-    StuckDetector = class {
-      cfg;
-      toolCallHistory = [];
-      findingsCount = 0;
-      iterationsWithoutProgress = 0;
-      consecutiveErrors = 0;
-      startTime = Date.now();
-      constructor(config2 = {}) {
-        this.cfg = {
-          maxRepeatedCalls: config2.maxRepeatedCalls ?? 3,
-          maxIterationsWithoutProgress: config2.maxIterationsWithoutProgress ?? 5,
-          maxConsecutiveErrors: config2.maxConsecutiveErrors ?? 3,
-          maxSubObjectiveTimeMs: config2.maxSubObjectiveTimeMs ?? 3e5
-        };
-      }
-      // ── Recording ───────────────────────────────────────────────────────
-      /** Record a tool call for pattern detection. */
-      recordToolCall(name, args2) {
-        this.toolCallHistory.push({
-          name,
-          args: JSON.stringify(args2),
-          timestamp: Date.now()
-        });
-      }
-      /** Record a tool result (success or error). */
-      recordResult(isError) {
-        if (isError) {
-          this.consecutiveErrors++;
-        } else {
-          this.consecutiveErrors = 0;
-        }
-      }
-      /** Update findings count — call after each iteration of the agent loop. */
-      updateProgress(currentFindings) {
-        if (currentFindings > this.findingsCount) {
-          this.findingsCount = currentFindings;
-          this.iterationsWithoutProgress = 0;
-        } else {
-          this.iterationsWithoutProgress++;
-        }
-      }
-      // ── Checking ────────────────────────────────────────────────────────
-      /** Check if the agent appears stuck. */
-      check() {
-        const elapsed = Date.now() - this.startTime;
-        if (elapsed > this.cfg.maxSubObjectiveTimeMs) {
-          return {
-            isStuck: true,
-            reason: "timeout",
-            details: `Sub-objective exceeded ${this.cfg.maxSubObjectiveTimeMs}ms (elapsed: ${elapsed}ms)`,
-            suggestedAction: "skip"
-          };
-        }
-        const windowSize = this.cfg.maxRepeatedCalls;
-        if (this.toolCallHistory.length >= windowSize) {
-          const recent = this.toolCallHistory.slice(-windowSize);
-          const first2 = recent[0];
-          const allSame = recent.every(
-            (c) => c.name === first2.name && c.args === first2.args
-          );
-          if (allSame) {
-            return {
-              isStuck: true,
-              reason: "repeated_calls",
-              details: `Tool "${first2.name}" called ${windowSize}x with identical args`,
-              suggestedAction: "retry_different"
-            };
-          }
-        }
-        if (this.iterationsWithoutProgress >= this.cfg.maxIterationsWithoutProgress) {
-          return {
-            isStuck: true,
-            reason: "no_progress",
-            details: `${this.iterationsWithoutProgress} iterations without new findings`,
-            suggestedAction: "escalate_model"
-          };
-        }
-        if (this.consecutiveErrors >= this.cfg.maxConsecutiveErrors) {
-          return {
-            isStuck: true,
-            reason: "error_loop",
-            details: `${this.consecutiveErrors} consecutive tool errors`,
-            suggestedAction: "retry_different"
-          };
-        }
-        return { isStuck: false };
-      }
-      // ── Lifecycle ───────────────────────────────────────────────────────
-      /** Reset all state for reuse (e.g., new sub-objective). */
-      reset() {
-        this.toolCallHistory = [];
-        this.findingsCount = 0;
-        this.iterationsWithoutProgress = 0;
-        this.consecutiveErrors = 0;
-        this.startTime = Date.now();
-      }
-      /** Get a diagnostic snapshot (useful for logging/telemetry). */
-      getSnapshot() {
-        return {
-          totalCalls: this.toolCallHistory.length,
-          consecutiveErrors: this.consecutiveErrors,
-          iterationsWithoutProgress: this.iterationsWithoutProgress,
-          findingsCount: this.findingsCount,
-          elapsedMs: Date.now() - this.startTime
-        };
-      }
-    };
-  }
-});
-
 // ../agent/src/safety/circuit-breaker.ts
 var CircuitBreaker;
 var init_circuit_breaker = __esm({
@@ -114512,98 +115542,278 @@ var init_circuit_breaker = __esm({
   }
 });
 
-// ../agent/src/safety/context-rotator.ts
-var ContextRotator;
-var init_context_rotator = __esm({
-  "../agent/src/safety/context-rotator.ts"() {
+// ../agent/src/safety/question-detector.ts
+var QuestionDetector;
+var init_question_detector = __esm({
+  "../agent/src/safety/question-detector.ts"() {
     "use strict";
-    ContextRotator = class {
-      cfg;
-      messageCount = 0;
-      estimatedTokens = 0;
-      constructor(config2 = {}) {
-        this.cfg = {
-          maxMessages: config2.maxMessages ?? 50,
-          maxTokensEstimate: config2.maxTokensEstimate ?? 1e5,
-          charsPerToken: config2.charsPerToken ?? 4,
-          recentToKeep: config2.recentToKeep ?? 10
-        };
-      }
-      // ── Recording ───────────────────────────────────────────────────────
-      /** Record a message added to context. */
-      recordMessage(content) {
-        this.messageCount++;
-        this.estimatedTokens += Math.ceil(content.length / this.cfg.charsPerToken);
+    QuestionDetector = class {
+      questionCount = 0;
+      maxQuestionsBeforeCorrection;
+      constructor(opts) {
+        this.maxQuestionsBeforeCorrection = opts?.maxQuestions ?? 2;
       }
-      // ── Checking ────────────────────────────────────────────────────────
-      /** Check if context should be rotated. */
-      shouldRotate() {
-        if (this.messageCount >= this.cfg.maxMessages) {
-          return {
-            rotate: true,
-            reason: `${this.messageCount} messages (limit: ${this.cfg.maxMessages})`
-          };
+      /**
+       * Analyze an assistant message for question patterns.
+       * Returns detection result with optional correction prompt.
+       */
+      detect(assistantMessage) {
+        const questions = this.extractQuestions(assistantMessage);
+        if (questions.length === 0) {
+          this.questionCount = 0;
+          return { isQuestion: false, questions: [] };
         }
-        if (this.estimatedTokens >= this.cfg.maxTokensEstimate) {
+        this.questionCount++;
+        if (this.questionCount >= this.maxQuestionsBeforeCorrection) {
           return {
-            rotate: true,
-            reason: `~${this.estimatedTokens} tokens (limit: ${this.cfg.maxTokensEstimate})`
+            isQuestion: true,
+            questions,
+            correctionPrompt: this.buildCorrectionPrompt(questions)
           };
         }
-        return { rotate: false };
+        return { isQuestion: true, questions };
+      }
+      extractQuestions(text7) {
+        const questions = [];
+        const questionLines = text7.split("\n").filter((line) => {
+          const trimmed = line.trim();
+          return trimmed.endsWith("?") && trimmed.length > 10;
+        });
+        questions.push(...questionLines.map((q) => q.trim()));
+        const indirectPatterns = [
+          /(?:could you|would you|can you|do you want|should I|shall I|do you prefer|which (?:one|option)|please (?:confirm|specify|clarify|tell me|let me know))/gi,
+          /(?:voulez-vous|souhaitez-vous|préférez-vous|dois-je|faut-il|quel(?:le)? (?:est|sont)|pouvez-vous (?:me dire|confirmer|préciser))/gi
+        ];
+        for (const pattern of indirectPatterns) {
+          const matches = text7.match(pattern);
+          if (matches) {
+            questions.push(...matches.map((m) => m.trim()));
+          }
+        }
+        return questions;
+      }
+      buildCorrectionPrompt(questions) {
+        return `[System \u2014 Autonomous Mode Correction]
+You are in AUTONOMOUS mode. Do NOT ask questions \u2014 take action instead.
+
+You asked: ${questions.slice(0, 3).map((q) => `"${q}"`).join(", ")}
+
+Instead of asking:
+- Make a reasonable decision based on available information
+- If multiple options exist, choose the most common/safe one
+- If information is missing, use your tools to find it (web_search, file_read, etc.)
+- If truly blocked, document what you need and move on to the next task
+
+DO NOT ask any more questions. Take action now.`;
+      }
+      /** Reset counter */
+      reset() {
+        this.questionCount = 0;
+      }
+    };
+  }
+});
+
+// ../agent/src/safety/completion-detector.ts
+var CompletionDetector;
+var init_completion_detector = __esm({
+  "../agent/src/safety/completion-detector.ts"() {
+    "use strict";
+    CompletionDetector = class {
+      noToolCallStreak = 0;
+      minNoToolStreak;
+      constructor(opts) {
+        this.minNoToolStreak = opts?.minNoToolStreak ?? 2;
       }
-      // ── Rotation helpers ────────────────────────────────────────────────
       /**
-       * Build a compact summary for context rotation.
-       *
-       * Strategy:
-       * - Preserve the system message verbatim
-       * - Summarize the middle messages into a compact block
-       * - Keep the last N recent messages verbatim
-       *
-       * Returns the summary text to inject as a single assistant message
-       * between the system prompt and the recent messages.
+       * Check if the agent has truly completed its task.
+       * Requires both heuristic indicators and an explicit signal.
        */
-      buildRotationSummary(messages) {
-        const keepCount = this.cfg.recentToKeep;
-        const system = messages.find((m) => m.role === "system");
-        const nonSystem = messages.filter((m) => m.role !== "system");
-        const recent = nonSystem.slice(-keepCount);
-        const middle = nonSystem.slice(0, Math.max(0, nonSystem.length - keepCount));
-        const parts = [];
-        if (system) {
-          parts.push("[System prompt preserved]");
-        }
-        if (middle.length > 0) {
-          const toolCalls = middle.filter(
-            (m) => m.content.includes("tool_use") || m.content.includes("function_call") || m.content.includes("tool_result")
-          ).length;
-          const findings = middle.filter(
-            (m) => m.content.includes("finding") || m.content.includes("result") || m.content.includes("discovered")
-          ).length;
-          const errors = middle.filter(
-            (m) => m.content.includes("error") || m.content.includes("failed")
-          ).length;
-          parts.push(
-            `[${middle.length} earlier messages summarized: ${toolCalls} tool interactions, ${findings} results/findings, ${errors} errors]`
-          );
+      check(assistantMessage, hadToolCalls) {
+        if (hadToolCalls) {
+          this.noToolCallStreak = 0;
+        } else {
+          this.noToolCallStreak++;
         }
-        parts.push(`[${recent.length} recent messages preserved below]`);
-        return parts.join("\n");
+        const heuristicScore = this.computeHeuristic(assistantMessage, hadToolCalls);
+        const hasExplicitSignal = this.hasExplicitCompletionSignal(assistantMessage);
+        const isComplete = heuristicScore >= 0.7 && hasExplicitSignal;
+        return {
+          isComplete,
+          heuristicScore,
+          hasExplicitSignal,
+          reason: isComplete ? "Both heuristic and explicit signals indicate completion" : !hasExplicitSignal ? "No explicit completion signal found" : `Heuristic score too low (${heuristicScore.toFixed(2)})`
+        };
+      }
+      computeHeuristic(message, hadToolCalls) {
+        let score = 0;
+        if (!hadToolCalls) score += 0.3;
+        if (this.noToolCallStreak >= this.minNoToolStreak) score += 0.3;
+        const conclusionPatterns = [
+          /(?:in summary|en résumé|to summarize|pour résumer|in conclusion|en conclusion)/i,
+          /(?:here are the (?:results|findings)|voici les (?:résultats|conclusions))/i,
+          /(?:the (?:task|mission|objective|work) is (?:complete|done|finished))/i,
+          /(?:la (?:tâche|mission) est (?:terminée|complète|finie))/i,
+          /(?:I have (?:completed|finished|done)|j'ai (?:terminé|fini|complété))/i
+        ];
+        const conclusionMatches = conclusionPatterns.filter((p8) => p8.test(message)).length;
+        score += Math.min(conclusionMatches * 0.15, 0.4);
+        return Math.min(score, 1);
+      }
+      hasExplicitCompletionSignal(message) {
+        const explicitSignals = [
+          /\[COMPLETE\]/i,
+          /\[DONE\]/i,
+          /\[TASK_COMPLETE\]/i,
+          /\[MISSION_COMPLETE\]/i,
+          /EXIT_SIGNAL:\s*COMPLETE/i,
+          // JSON output with findings (structured output = done)
+          /^\s*\[[\s\S]*"type"[\s\S]*"title"[\s\S]*"confidence"[\s\S]*\]\s*$/m,
+          // Markdown report header (report = done)
+          /^#\s+.*(?:Report|Rapport|Results|Résultats)/m
+        ];
+        return explicitSignals.some((p8) => p8.test(message));
       }
-      // ── Lifecycle ───────────────────────────────────────────────────────
-      /** Reset counters after rotation. */
+      /** Reset state */
       reset() {
-        this.messageCount = 0;
-        this.estimatedTokens = 0;
+        this.noToolCallStreak = 0;
       }
-      /** Get current stats (useful for logging/telemetry). */
-      getStats() {
+    };
+  }
+});
+
+// ../agent/src/safety/handoff-generator.ts
+var HandoffGenerator;
+var init_handoff_generator = __esm({
+  "../agent/src/safety/handoff-generator.ts"() {
+    "use strict";
+    HandoffGenerator = class {
+      /**
+       * Generate a handoff document from the agent's message history.
+       * This is a heuristic extraction — no LLM call needed.
+       */
+      generate(opts) {
+        const { objective, messages, toolCalls, exitReason, costUsd } = opts;
+        const accomplished = this.extractAccomplished(messages);
+        const remaining = this.extractRemaining(messages, exitReason);
+        const currentState = this.buildCurrentState(toolCalls);
+        const decisions = this.extractDecisions(messages);
+        const errors = toolCalls.filter((tc) => tc.isError).map((tc) => ({ error: `${tc.name}: ${tc.result.substring(0, 200)}`, resolution: "Attempted" }));
+        const toolUsage = {};
+        for (const tc of toolCalls) {
+          toolUsage[tc.name] = (toolUsage[tc.name] || 0) + 1;
+        }
+        const nextSteps = this.suggestNextSteps(remaining, errors, exitReason);
         return {
-          messageCount: this.messageCount,
-          estimatedTokens: this.estimatedTokens
+          objective,
+          accomplished,
+          remaining,
+          currentState,
+          decisions,
+          errors,
+          nextSteps,
+          toolUsage,
+          costUsd,
+          timestamp: Date.now()
         };
       }
+      /** Convert handoff to Markdown for storage/display */
+      toMarkdown(handoff) {
+        const sections = [
+          `# Session Handoff`,
+          ``,
+          `**Objective:** ${handoff.objective}`,
+          `**Cost:** $${handoff.costUsd.toFixed(4)}`,
+          `**Date:** ${new Date(handoff.timestamp).toISOString()}`,
+          ``,
+          `## Accomplished`,
+          ...handoff.accomplished.map((a) => `- ${a}`),
+          ``,
+          `## Remaining`,
+          ...handoff.remaining.map((r) => `- ${r}`),
+          ``,
+          `## Current State`,
+          handoff.currentState,
+          ``,
+          `## Decisions`,
+          ...handoff.decisions.map((d) => `- **${d.decision}**: ${d.reason}`),
+          ``,
+          `## Errors (${handoff.errors.length})`,
+          ...handoff.errors.map((e) => `- ${e.error}`),
+          ``,
+          `## Next Steps`,
+          ...handoff.nextSteps.map((s) => `- ${s}`),
+          ``,
+          `## Tool Usage`,
+          ...Object.entries(handoff.toolUsage).map(([name, count]) => `- ${name}: ${count}x`)
+        ];
+        return sections.join("\n");
+      }
+      extractAccomplished(messages) {
+        const accomplished = [];
+        for (const msg of messages) {
+          if (msg.role !== "assistant") continue;
+          const lines = msg.content.split("\n");
+          for (const line of lines) {
+            if (/(?:✅|done|completed|finished|created|wrote|found|discovered|built|implemented)/i.test(line) && line.length > 10 && line.length < 200) {
+              accomplished.push(line.replace(/^[-*•]\s*/, "").trim());
+            }
+          }
+        }
+        return accomplished.slice(0, 10);
+      }
+      extractRemaining(messages, exitReason) {
+        const remaining = [];
+        if (exitReason === "max_iterations") remaining.push("Max iterations reached \u2014 work may be incomplete");
+        if (exitReason === "budget_exceeded") remaining.push("Budget exhausted \u2014 work may be incomplete");
+        if (exitReason === "aborted") remaining.push("Execution was aborted");
+        const lastAssistant = [...messages].reverse().find((m) => m.role === "assistant");
+        if (lastAssistant) {
+          const todoPattern = /(?:todo|remaining|still need|next|à faire|reste)/i;
+          const lines = lastAssistant.content.split("\n");
+          for (const line of lines) {
+            if (todoPattern.test(line) && line.length > 10 && line.length < 200) {
+              remaining.push(line.replace(/^[-*•]\s*/, "").trim());
+            }
+          }
+        }
+        return remaining.slice(0, 10);
+      }
+      buildCurrentState(toolCalls) {
+        const filesWritten = toolCalls.filter((tc) => tc.name === "file_write").map((tc) => String(tc.args.path || "")).filter(Boolean);
+        const commandsRun = toolCalls.filter((tc) => tc.name === "shell_exec").map((tc) => String(tc.args.command || "").substring(0, 100)).filter(Boolean);
+        let state = "";
+        if (filesWritten.length > 0) state += `Files modified: ${filesWritten.join(", ")}
+`;
+        if (commandsRun.length > 0) state += `Commands run: ${commandsRun.slice(-5).join("; ")}`;
+        return state || "No filesystem changes detected.";
+      }
+      extractDecisions(messages) {
+        const decisions = [];
+        for (const msg of messages) {
+          if (msg.role !== "assistant") continue;
+          const patterns = [
+            /I (?:chose|decided|selected|went with|picked) (.{10,80}) (?:because|since|as|due to) (.{10,120})/gi,
+            /(?:j'ai choisi|j'ai décidé|j'ai opté pour) (.{10,80}) (?:car|parce que|puisque) (.{10,120})/gi
+          ];
+          for (const pattern of patterns) {
+            let match;
+            while ((match = pattern.exec(msg.content)) !== null && decisions.length < 5) {
+              decisions.push({ decision: match[1].trim(), reason: match[2].trim() });
+            }
+          }
+        }
+        return decisions;
+      }
+      suggestNextSteps(remaining, errors, exitReason) {
+        const steps = [];
+        if (remaining.length > 0) steps.push(`Continue with: ${remaining[0]}`);
+        if (errors.length > 0) steps.push(`Investigate ${errors.length} error(s) from previous session`);
+        if (exitReason === "budget_exceeded") steps.push("Consider increasing budget for next run");
+        if (exitReason === "max_iterations") steps.push("Consider increasing max iterations or simplifying the objective");
+        if (steps.length === 0) steps.push("Review results and plan next action");
+        return steps;
+      }
     };
   }
 });
@@ -114615,16 +115825,19 @@ var init_safety = __esm({
     init_stuck_detector();
     init_circuit_breaker();
     init_context_rotator();
+    init_question_detector();
+    init_completion_detector();
+    init_handoff_generator();
   }
 });
 
 // ../agent/src/mission/tool-factory.ts
 import { randomUUID as randomUUID33 } from "node:crypto";
-import { writeFileSync as writeFileSync7, mkdirSync as mkdirSync5, existsSync as existsSync10 } from "node:fs";
+import { writeFileSync as writeFileSync8, mkdirSync as mkdirSync6, existsSync as existsSync11 } from "node:fs";
 import { homedir as homedir4 } from "node:os";
-import { join as join16 } from "node:path";
+import { join as join17 } from "node:path";
 function getDefaultToolsDir() {
-  return join16(homedir4(), ".nestor", "tools");
+  return join17(homedir4(), ".nestor", "tools");
 }
 function createDefaultToolFactory(adapter, toolsDir) {
   return new ToolFactory(adapter, toolsDir ?? getDefaultToolsDir());
@@ -114637,7 +115850,7 @@ var init_tool_factory = __esm({
       constructor(adapter, toolsDir) {
         this.adapter = adapter;
         this.toolsDir = toolsDir;
-        if (!existsSync10(toolsDir)) mkdirSync5(toolsDir, { recursive: true });
+        if (!existsSync11(toolsDir)) mkdirSync6(toolsDir, { recursive: true });
       }
       /**
        * Generate a new tool from a natural language description.
@@ -114814,13 +116027,13 @@ Fix the tool code so it passes its test. Respond ONLY with valid JSON:
        * Save tool to disk: source, compiled JS, test, and manifest.
        */
       saveTool(tool) {
-        const toolDir = join16(this.toolsDir, tool.name);
-        if (!existsSync10(toolDir)) mkdirSync5(toolDir, { recursive: true });
-        writeFileSync7(join16(toolDir, "tool.ts"), tool.code);
-        writeFileSync7(join16(toolDir, "tool.js"), tool.compiledCode);
-        writeFileSync7(join16(toolDir, "test.js"), tool.testCode);
-        writeFileSync7(
-          join16(toolDir, "manifest.json"),
+        const toolDir = join17(this.toolsDir, tool.name);
+        if (!existsSync11(toolDir)) mkdirSync6(toolDir, { recursive: true });
+        writeFileSync8(join17(toolDir, "tool.ts"), tool.code);
+        writeFileSync8(join17(toolDir, "tool.js"), tool.compiledCode);
+        writeFileSync8(join17(toolDir, "test.js"), tool.testCode);
+        writeFileSync8(
+          join17(toolDir, "manifest.json"),
           JSON.stringify(
             {
               id: tool.id,
@@ -115395,13 +116608,172 @@ Analyze and return the JSON structure described in the system prompt.`;
   }
 });
 
+// ../agent/src/mission/capability-research.ts
+var capability_research_exports = {};
+__export(capability_research_exports, {
+  CapabilityResearchEngine: () => CapabilityResearchEngine
+});
+var CapabilityResearchEngine;
+var init_capability_research = __esm({
+  "../agent/src/mission/capability-research.ts"() {
+    "use strict";
+    CapabilityResearchEngine = class {
+      constructor(adapter, orchestratorStore) {
+        this.adapter = adapter;
+        this.orchestratorStore = orchestratorStore;
+      }
+      cache = /* @__PURE__ */ new Map();
+      /**
+       * Research capabilities for a mission type.
+       * Returns cached results if still valid, otherwise does fresh research.
+       */
+      async research(type, objective) {
+        const cached = this.cache.get(type);
+        if (cached && Date.now() - cached.timestamp < cached.ttlMs) {
+          return cached;
+        }
+        if (this.orchestratorStore) {
+          const orch = this.orchestratorStore.get(type);
+          if (orch.toolRecommendations.length > 0 && orch.missionCount > 3) {
+            const fromOrch = {
+              domain: type,
+              recommendedTools: orch.toolRecommendations.map((t) => ({
+                name: t,
+                description: "",
+                source: "builtin",
+                priority: "recommended"
+              })),
+              methodologies: [],
+              pitfalls: orch.knowledgeBase.failedPatterns.map(
+                (p8) => `Previously failed pattern: ${p8.subObjectiveNames.join(" \u2192 ")} (used ${p8.usageCount} time${p8.usageCount > 1 ? "s" : ""}, score: ${p8.score.toFixed(2)})`
+              ),
+              resources: [],
+              timestamp: Date.now(),
+              ttlMs: 7 * 24 * 60 * 60 * 1e3
+            };
+            this.cache.set(type, fromOrch);
+            return fromOrch;
+          }
+        }
+        const result = await this.doResearch(type, objective);
+        this.cache.set(type, result);
+        return result;
+      }
+      async doResearch(type, objective) {
+        const domainHints = this.getDomainHints(type);
+        const prompt = `You are a capability researcher for an AI agent platform.
+Given a mission type and objective, recommend the best tools, methodologies, and resources.
+
+Mission type: ${type}
+Objective: ${objective}
+
+Based on your knowledge of ${type} best practices, respond with JSON:
+{
+  "recommendedTools": [
+    { "name": "tool_name", "description": "what it does", "source": "builtin|npm|github|api", "url": "optional", "priority": "essential|recommended|optional" }
+  ],
+  "methodologies": [
+    { "name": "method name", "description": "brief description", "steps": ["step1", "step2"] }
+  ],
+  "pitfalls": ["common mistake 1", "common mistake 2"],
+  "resources": [
+    { "title": "resource title", "url": "https://...", "type": "article|repo|docs|tutorial" }
+  ]
+}
+
+${domainHints}
+
+Focus on tools that work locally (no cloud-only services) and can be used by an AI agent.
+Respond ONLY with JSON.`;
+        try {
+          const response = await this.adapter.chat([
+            {
+              role: "system",
+              content: "You are a capability researcher. Respond only with JSON."
+            },
+            { role: "user", content: prompt }
+          ]);
+          let jsonStr = response.content;
+          const codeBlockMatch = jsonStr.match(/```(?:json)?\s*([\s\S]*?)```/);
+          if (codeBlockMatch) jsonStr = codeBlockMatch[1].trim();
+          const match = jsonStr.match(/\{[\s\S]*\}/);
+          if (match) jsonStr = match[0];
+          const parsed = JSON.parse(jsonStr);
+          return {
+            domain: type,
+            recommendedTools: Array.isArray(parsed.recommendedTools) ? parsed.recommendedTools : [],
+            methodologies: Array.isArray(parsed.methodologies) ? parsed.methodologies : [],
+            pitfalls: Array.isArray(parsed.pitfalls) ? parsed.pitfalls : [],
+            resources: Array.isArray(parsed.resources) ? parsed.resources : [],
+            timestamp: Date.now(),
+            ttlMs: 7 * 24 * 60 * 60 * 1e3
+            // 7 days
+          };
+        } catch {
+          return {
+            domain: type,
+            recommendedTools: [],
+            methodologies: [],
+            pitfalls: [],
+            resources: [],
+            timestamp: Date.now(),
+            ttlMs: 24 * 60 * 60 * 1e3
+            // retry after 1 day on failure
+          };
+        }
+      }
+      /**
+       * Inject research results into the mission planning context.
+       * Returns a context block to prepend to the decomposition prompt.
+       */
+      toContextBlock(result) {
+        if (result.recommendedTools.length === 0 && result.methodologies.length === 0) {
+          return "";
+        }
+        const sections = ["CAPABILITY RESEARCH (pre-mission analysis):"];
+        if (result.recommendedTools.length > 0) {
+          sections.push("Recommended tools:");
+          for (const t of result.recommendedTools.slice(0, 8)) {
+            sections.push(`  - ${t.name} (${t.priority}): ${t.description}`);
+          }
+        }
+        if (result.methodologies.length > 0) {
+          sections.push("Recommended methodology:");
+          const best = result.methodologies[0];
+          sections.push(`  ${best.name}: ${best.steps.join(" \u2192 ")}`);
+        }
+        if (result.pitfalls.length > 0) {
+          sections.push("Known pitfalls to avoid:");
+          for (const p8 of result.pitfalls.slice(0, 5)) {
+            sections.push(`  - ${p8}`);
+          }
+        }
+        return sections.join("\n");
+      }
+      // ─── Private Helpers ────────────────────────────────────────────────
+      getDomainHints(type) {
+        const hints = {
+          osint: "For osint missions, consider: OSINT tools like Maltego alternatives, Wayback Machine, WHOIS, social media scrapers, SIRENE, public records databases",
+          research: "For research missions, consider: Google Scholar, arxiv, Semantic Scholar, news aggregators, RSS feeds, citation graphs",
+          code: "For code missions, consider: linters, formatters, test frameworks, build tools, CI/CD, static analysis",
+          audit: "For audit missions, consider: static analyzers, dependency checkers, fuzzing tools, CVE databases, SAST/DAST",
+          creation: "For creation missions, consider: writing assistants, image generators, template engines, CMS tools, Markdown processors",
+          analysis: "For analysis missions, consider: data processing libraries, visualization tools, statistical frameworks, ML frameworks",
+          custom: "Consider what specialized tools and methods would best serve this specific objective."
+        };
+        return hints[type] || hints.custom;
+      }
+    };
+  }
+});
+
 // ../agent/src/mission/orchestrator-store.ts
 var orchestrator_store_exports = {};
 __export(orchestrator_store_exports, {
   OrchestratorStore: () => OrchestratorStore
 });
-import { existsSync as existsSync11, mkdirSync as mkdirSync6, readFileSync as readFileSync15, writeFileSync as writeFileSync8 } from "node:fs";
-import { join as join17 } from "node:path";
+import { existsSync as existsSync12, mkdirSync as mkdirSync7, readFileSync as readFileSync16, writeFileSync as writeFileSync9 } from "node:fs";
+import { join as join18 } from "node:path";
 import { homedir as homedir5 } from "node:os";
 function arraysEqual(a, b) {
   if (a.length !== b.length) return false;
@@ -115411,11 +116783,11 @@ var ORCHESTRATORS_DIR, OrchestratorStore;
 var init_orchestrator_store = __esm({
   "../agent/src/mission/orchestrator-store.ts"() {
     "use strict";
-    ORCHESTRATORS_DIR = join17(homedir5(), ".nestor", "orchestrators");
+    ORCHESTRATORS_DIR = join18(homedir5(), ".nestor", "orchestrators");
     OrchestratorStore = class {
       constructor(baseDir = ORCHESTRATORS_DIR) {
         this.baseDir = baseDir;
-        if (!existsSync11(baseDir)) mkdirSync6(baseDir, { recursive: true });
+        if (!existsSync12(baseDir)) mkdirSync7(baseDir, { recursive: true });
       }
       cache = /* @__PURE__ */ new Map();
       /**
@@ -115425,9 +116797,9 @@ var init_orchestrator_store = __esm({
       get(type) {
         if (this.cache.has(type)) return this.cache.get(type);
         const filePath = this.filePath(type);
-        if (existsSync11(filePath)) {
+        if (existsSync12(filePath)) {
           try {
-            const data = JSON.parse(readFileSync15(filePath, "utf-8"));
+            const data = JSON.parse(readFileSync16(filePath, "utf-8"));
             this.cache.set(type, data);
             return data;
           } catch {
@@ -115525,7 +116897,7 @@ var init_orchestrator_store = __esm({
         ];
         return types.map((type) => {
           const filePath = this.filePath(type);
-          if (!existsSync11(filePath)) return null;
+          if (!existsSync12(filePath)) return null;
           const orch = this.get(type);
           return {
             type: orch.type,
@@ -115562,12 +116934,12 @@ var init_orchestrator_store = __esm({
       }
       // ─── Private ──────────────────────────────────────────────────────────
       filePath(type) {
-        return join17(this.baseDir, type, "orchestrator.json");
+        return join18(this.baseDir, type, "orchestrator.json");
       }
       save(orch) {
-        const dir = join17(this.baseDir, orch.type);
-        if (!existsSync11(dir)) mkdirSync6(dir, { recursive: true });
-        writeFileSync8(this.filePath(orch.type), JSON.stringify(orch, null, 2));
+        const dir = join18(this.baseDir, orch.type);
+        if (!existsSync12(dir)) mkdirSync7(dir, { recursive: true });
+        writeFileSync9(this.filePath(orch.type), JSON.stringify(orch, null, 2));
         this.cache.set(orch.type, orch);
       }
       createDefault(type) {
@@ -115782,8 +117154,19 @@ var init_controller = __esm({
       async plan(input, options) {
         const tenantId = options?.tenantId ?? "default";
         const type = this.detectMissionType(input);
+        let capabilityContext = "";
+        try {
+          const { CapabilityResearchEngine: CapabilityResearchEngine2 } = await Promise.resolve().then(() => (init_capability_research(), capability_research_exports));
+          const researcher = new CapabilityResearchEngine2(
+            this.agentFactory.getDefaultAdapter()
+            // orchestratorStore could be wired here if available on the controller
+          );
+          const research = await researcher.research(type, input);
+          capabilityContext = researcher.toContextBlock(research);
+        } catch {
+        }
         const similar = await this.inventory.findSimilarMissions(input);
-        const decomposition = await this.decompose(input, type, similar);
+        const decomposition = await this.decompose(input, type, similar, capabilityContext);
         const defaultMaxIterations = (() => {
           switch (type) {
             case "osint":
@@ -116151,7 +117534,7 @@ Report generation failed. Mission completed with ${mission.findings.length} find
         return "custom";
       }
       // ─── Decompose ─────────────────────────────────────────────────────
-      async decompose(input, type, similar) {
+      async decompose(input, type, similar, capabilityContext) {
         const methodGuide = {
           osint: `For OSINT missions, structure sub-objectives by METHOD, not by category:
   1. Entity disambiguation \u2014 multi-engine search to find the correct subject among homonyms
@@ -116214,7 +117597,8 @@ ${methodGuide[type] || methodGuide.custom}
 ${similar.length > 0 ? `Similar past missions found (learn from their structure):
 ${similar.map((m) => `- ${m.title} (${m.subObjectives.length} sub-objectives, score: ${m.evaluation?.overall ?? "N/A"})`).join("\n")}` : "No similar past missions found."}
 
-The "type" field of each sub-objective should be one of:
+${capabilityContext ? `${capabilityContext}
+` : ""}The "type" field of each sub-objective should be one of:
   search   \u2014 broad web search with multiple engines
   scrape   \u2014 detailed scrape of specific page(s)
   analyze  \u2014 analysis of data already collected (no external fetch)
@@ -116951,7 +118335,7 @@ var init_inventory = __esm({
       /** Find similar past missions for planning. */
       async findSimilarMissions(objective) {
         try {
-          return this.store.searchMissions(objective, 3);
+          return this.store.searchMissions(objective, { limit: 3 });
         } catch {
           return [];
         }
@@ -117029,8 +118413,8 @@ var init_inventory = __esm({
 });
 
 // ../agent/src/mission/mcp-factory.ts
-import { writeFileSync as writeFileSync9, mkdirSync as mkdirSync7, existsSync as existsSync12 } from "node:fs";
-import { join as join18 } from "node:path";
+import { writeFileSync as writeFileSync10, mkdirSync as mkdirSync8, existsSync as existsSync13 } from "node:fs";
+import { join as join19 } from "node:path";
 var McpFactory;
 var init_mcp_factory = __esm({
   "../agent/src/mission/mcp-factory.ts"() {
@@ -117038,7 +118422,7 @@ var init_mcp_factory = __esm({
     McpFactory = class {
       constructor(mcpDir) {
         this.mcpDir = mcpDir;
-        if (!existsSync12(mcpDir)) mkdirSync7(mcpDir, { recursive: true });
+        if (!existsSync13(mcpDir)) mkdirSync8(mcpDir, { recursive: true });
       }
       /**
        * Generate an MCP server that exposes one or more custom tools.
@@ -117046,13 +118430,13 @@ var init_mcp_factory = __esm({
        */
       generate(tools, serverName) {
         const safeName = this.sanitizeName(serverName);
-        const serverDir = join18(this.mcpDir, safeName);
-        if (!existsSync12(serverDir)) mkdirSync7(serverDir, { recursive: true });
+        const serverDir = join19(this.mcpDir, safeName);
+        if (!existsSync13(serverDir)) mkdirSync8(serverDir, { recursive: true });
         const serverCode = this.generateServerCode(tools, safeName);
-        const entrypoint = join18(serverDir, "server.mjs");
-        writeFileSync9(entrypoint, serverCode);
-        writeFileSync9(
-          join18(serverDir, "package.json"),
+        const entrypoint = join19(serverDir, "server.mjs");
+        writeFileSync10(entrypoint, serverCode);
+        writeFileSync10(
+          join19(serverDir, "package.json"),
           JSON.stringify(
             {
               name: `@nestor/mcp-${safeName}`,
@@ -117066,11 +118450,11 @@ var init_mcp_factory = __esm({
             2
           )
         );
-        writeFileSync9(join18(serverDir, "Dockerfile"), this.generateDockerfile(safeName));
-        writeFileSync9(join18(serverDir, "README.md"), this.generateReadme(tools, safeName));
+        writeFileSync10(join19(serverDir, "Dockerfile"), this.generateDockerfile(safeName));
+        writeFileSync10(join19(serverDir, "README.md"), this.generateReadme(tools, safeName));
         for (const tool of tools) {
           const toolModuleCode = this.wrapToolAsModule(tool);
-          writeFileSync9(join18(serverDir, `${tool.name}.js`), toolModuleCode);
+          writeFileSync10(join19(serverDir, `${tool.name}.js`), toolModuleCode);
         }
         return {
           id: safeName,
@@ -117304,8 +118688,8 @@ npx nestor-sh mcp add ${serverName} --command "node ${serverName}/server.mjs"
 // ../agent/src/mission/docker-deployer.ts
 import { execFile as execFile7 } from "node:child_process";
 import { promisify as promisify5 } from "node:util";
-import { existsSync as existsSync13 } from "node:fs";
-import { join as join19 } from "node:path";
+import { existsSync as existsSync14 } from "node:fs";
+import { join as join20 } from "node:path";
 var execFileAsync4, DockerDeployer;
 var init_docker_deployer = __esm({
   "../agent/src/mission/docker-deployer.ts"() {
@@ -117342,9 +118726,9 @@ var init_docker_deployer = __esm({
        * Returns the image name (tag).
        */
       async build(server) {
-        const serverDir = join19(server.entrypoint, "..");
+        const serverDir = join20(server.entrypoint, "..");
         const imageName = `nestor-mcp-${server.name}:latest`;
-        if (!existsSync13(join19(serverDir, "Dockerfile"))) {
+        if (!existsSync14(join20(serverDir, "Dockerfile"))) {
           throw new Error(`No Dockerfile found in ${serverDir}`);
         }
         const container = {
@@ -117567,6 +118951,7 @@ var init_mission = __esm({
     init_mcp_factory();
     init_docker_deployer();
     init_orchestrator_store();
+    init_capability_research();
   }
 });
 
@@ -117817,6 +119202,15 @@ var init_intent = __esm({
   }
 });
 
+// ../agent/src/integrations/index.ts
+var init_integrations = __esm({
+  "../agent/src/integrations/index.ts"() {
+    "use strict";
+    init_obsidian();
+    init_n8n();
+  }
+});
+
 // ../agent/src/index.ts
 var src_exports3 = {};
 __export(src_exports3, {
@@ -117831,9 +119225,11 @@ __export(src_exports3, {
   AutoDowngradeAdapter: () => AutoDowngradeAdapter,
   AutoDowngradeMonitor: () => AutoDowngradeMonitor,
   BrowserManager: () => BrowserManager,
+  CapabilityResearchEngine: () => CapabilityResearchEngine,
   CircuitBreaker: () => CircuitBreaker,
   ClaudeAdapter: () => ClaudeAdapter,
   CodeChunker: () => CodeChunker,
+  CompletionDetector: () => CompletionDetector,
   ContextBuilder: () => ContextBuilder,
   ContextRotator: () => ContextRotator,
   DockerDeployer: () => DockerDeployer,
@@ -117847,11 +119243,13 @@ __export(src_exports3, {
   GeminiAdapter: () => GeminiAdapter,
   GeminiEmbeddingProvider: () => GeminiEmbeddingProvider,
   GrokAdapter: () => GrokAdapter,
+  HandoffGenerator: () => HandoffGenerator,
   HotSwapAdapter: () => HotSwapAdapter,
   IntentAnalyzer: () => IntentAnalyzer,
   InventoryManager: () => InventoryManager,
   K8sExecutor: () => K8sExecutor,
   KnowledgeGraph: () => KnowledgeGraph,
+  LayeredMemory: () => LayeredMemory,
   LocalEmbeddings: () => LocalEmbeddings,
   LocalSandbox: () => LocalSandbox,
   McpFactory: () => McpFactory,
@@ -117863,6 +119261,8 @@ __export(src_exports3, {
   MistralAdapter: () => MistralAdapter,
   MockLlmAdapter: () => MockLlmAdapter,
   ModelRouter: () => ModelRouter,
+  N8nIntegration: () => N8nIntegration,
+  ObsidianIntegration: () => ObsidianIntegration,
   OllamaAdapter: () => OllamaAdapter,
   OllamaEmbeddingProvider: () => OllamaEmbeddingProvider,
   OllamaEmbeddings: () => OllamaEmbeddings,
@@ -117874,6 +119274,7 @@ __export(src_exports3, {
   PluginManifestSchema: () => PluginManifestSchema,
   PluginSandbox: () => PluginSandbox,
   ProcessSandbox: () => ProcessSandbox,
+  QuestionDetector: () => QuestionDetector,
   RagIndexer: () => RagIndexer,
   RagSearch: () => RagSearch,
   ReasonLogger: () => ReasonLogger,
@@ -118017,6 +119418,7 @@ var init_src5 = __esm({
     init_mission();
     init_meta_tool_factory();
     init_intent();
+    init_integrations();
   }
 });
 
@@ -119286,8 +120688,8 @@ var init_experiments = __esm({
 
 // ../server/src/services/telemetry-anon.ts
 import { randomUUID as randomUUID38 } from "node:crypto";
-import { existsSync as existsSync14, readFileSync as readFileSync16, writeFileSync as writeFileSync10, mkdirSync as mkdirSync8 } from "node:fs";
-import { join as join20 } from "node:path";
+import { existsSync as existsSync15, readFileSync as readFileSync17, writeFileSync as writeFileSync11, mkdirSync as mkdirSync9 } from "node:fs";
+import { join as join21 } from "node:path";
 import { homedir as homedir6 } from "node:os";
 function getAnonTelemetry(config2) {
   if (!_anonInstance) {
@@ -119303,8 +120705,8 @@ var init_telemetry_anon = __esm({
   "../server/src/services/telemetry-anon.ts"() {
     "use strict";
     NESTOR_VERSION = "0.4.1";
-    DATA_DIR2 = join20(homedir6(), ".nestor");
-    ANON_ID_FILE = join20(DATA_DIR2, "anon-telemetry-id");
+    DATA_DIR2 = join21(homedir6(), ".nestor");
+    ANON_ID_FILE = join21(DATA_DIR2, "anon-telemetry-id");
     DEFAULT_ENDPOINT = "https://telemetry.nestor.sh/v1/events";
     FLUSH_BATCH_SIZE = 25;
     AnonTelemetryService = class {
@@ -119408,18 +120810,18 @@ var init_telemetry_anon = __esm({
       // ─── Private ──────────────────────────────────────────────────────────
       getOrCreateInstallId() {
         try {
-          if (existsSync14(ANON_ID_FILE)) {
-            const id = readFileSync16(ANON_ID_FILE, "utf-8").trim();
+          if (existsSync15(ANON_ID_FILE)) {
+            const id = readFileSync17(ANON_ID_FILE, "utf-8").trim();
             if (id.length > 0) return id;
           }
         } catch {
         }
         const newId = randomUUID38();
         try {
-          if (!existsSync14(DATA_DIR2)) {
-            mkdirSync8(DATA_DIR2, { recursive: true });
+          if (!existsSync15(DATA_DIR2)) {
+            mkdirSync9(DATA_DIR2, { recursive: true });
           }
-          writeFileSync10(ANON_ID_FILE, newId + "\n", "utf-8");
+          writeFileSync11(ANON_ID_FILE, newId + "\n", "utf-8");
         } catch {
         }
         return newId;
@@ -149749,7 +151151,7 @@ var init_admin2 = __esm({
   "../server/src/routes/admin.ts"() {
     "use strict";
     init_rate_limit();
-    SERVER_VERSION3 = "2.7.1";
+    SERVER_VERSION3 = "3.0.0";
     startTime3 = Date.now();
   }
 });
@@ -151437,19 +152839,19 @@ var init_providers = __esm({
 
 // ../server/src/services/key-vault.ts
 import { createCipheriv as createCipheriv2, createDecipheriv as createDecipheriv2, randomBytes as randomBytes7, scryptSync as scryptSync2 } from "node:crypto";
-import { readFileSync as readFileSync17, writeFileSync as writeFileSync11, existsSync as existsSync15, mkdirSync as mkdirSync9 } from "node:fs";
-import { join as join21, dirname as dirname8 } from "node:path";
+import { readFileSync as readFileSync18, writeFileSync as writeFileSync12, existsSync as existsSync16, mkdirSync as mkdirSync10 } from "node:fs";
+import { join as join22, dirname as dirname8 } from "node:path";
 import { homedir as homedir7 } from "node:os";
 function getVaultKey() {
-  if (!existsSync15(KEY_FILE)) {
+  if (!existsSync16(KEY_FILE)) {
     const dir = dirname8(KEY_FILE);
-    if (!existsSync15(dir)) {
-      mkdirSync9(dir, { recursive: true });
+    if (!existsSync16(dir)) {
+      mkdirSync10(dir, { recursive: true });
     }
     const masterSecret = randomBytes7(32).toString("hex");
-    writeFileSync11(KEY_FILE, masterSecret, { mode: 384 });
+    writeFileSync12(KEY_FILE, masterSecret, { mode: 384 });
   }
-  const secret = readFileSync17(KEY_FILE, "utf-8").trim();
+  const secret = readFileSync18(KEY_FILE, "utf-8").trim();
   return scryptSync2(secret, "nestor-vault-salt", 32);
 }
 function encryptApiKey(plainKey) {
@@ -151501,7 +152903,7 @@ var init_key_vault = __esm({
   "../server/src/services/key-vault.ts"() {
     "use strict";
     ALGORITHM2 = "aes-256-gcm";
-    KEY_FILE = join21(homedir7(), ".nestor", ".vault-key");
+    KEY_FILE = join22(homedir7(), ".nestor", ".vault-key");
     PROVIDER_ENV_MAP = {
       claude: "ANTHROPIC_API_KEY",
       openai: "OPENAI_API_KEY",
@@ -151886,6 +153288,36 @@ function missionRoutes(store, logger) {
       next(err);
     }
   });
+  router.get("/search", async (req, res, next) => {
+    try {
+      const q = req.query.q || "";
+      const type = req.query.type;
+      const status = req.query.status;
+      const from2 = req.query.from;
+      const to = req.query.to;
+      const limit = req.query.limit ? parseInt(req.query.limit, 10) : 20;
+      const results = store.searchMissions(q, { type, status, from: from2, to, limit });
+      res.json({
+        data: results,
+        meta: {
+          count: results.length,
+          query: q,
+          filters: { type, status, from: from2, to }
+        }
+      });
+    } catch (err) {
+      next(err);
+    }
+  });
+  router.get("/stats", async (req, res, next) => {
+    try {
+      const tenantId = req.tenantId || "default";
+      const stats = store.getMissionStats(tenantId);
+      res.json({ data: stats });
+    } catch (err) {
+      next(err);
+    }
+  });
   router.get("/:id", async (req, res, next) => {
     try {
       const mission = store.getMission(req.params.id);
@@ -152456,8 +153888,8 @@ var init_seed_defaults = __esm({
 
 // ../server/src/app.ts
 import express from "express";
-import { resolve as resolve13, join as join22 } from "node:path";
-import { existsSync as existsSync16 } from "node:fs";
+import { resolve as resolve13, join as join23 } from "node:path";
+import { existsSync as existsSync17 } from "node:fs";
 import compression from "compression";
 import cors from "cors";
 function getStudioState() {
@@ -152787,7 +154219,7 @@ function createApp(config2) {
   }
   for (const dir of candidateDirs) {
     try {
-      if (existsSync16(join22(dir, "index.html"))) {
+      if (existsSync17(join23(dir, "index.html"))) {
         studioDistDir = dir;
         break;
       }
@@ -152811,7 +154243,7 @@ function createApp(config2) {
       if (!studioState.enabled) {
         return res.status(403).json({ error: { code: "STUDIO_DISABLED", message: "Studio is disabled." } });
       }
-      res.sendFile(join22(studioDistDir, "index.html"));
+      res.sendFile(join23(studioDistDir, "index.html"));
     });
     app.use("/studio", express.static(studioDistDir, { index: false }));
     app.use(express.static(studioDistDir, { index: false }));
@@ -152819,7 +154251,7 @@ function createApp(config2) {
       if (!studioState.enabled) {
         return res.status(403).json({ error: { code: "STUDIO_DISABLED", message: "Studio is disabled." } });
       }
-      res.sendFile(join22(studioDistDir, "index.html"));
+      res.sendFile(join23(studioDistDir, "index.html"));
     });
   } else {
     app.get("/studio", (_req, res) => {
@@ -152847,7 +154279,7 @@ function createApp(config2) {
       if (!studioState.enabled) {
         return res.status(403).json({ error: { code: "STUDIO_DISABLED", message: "Studio is disabled." } });
       }
-      res.sendFile(join22(studioDistDir, "index.html"));
+      res.sendFile(join23(studioDistDir, "index.html"));
     });
   }
   app.use(errorHandler());
@@ -152926,7 +154358,7 @@ var init_app = __esm({
 });
 
 // ../server/src/services/config-watcher.ts
-import { watch, existsSync as existsSync17 } from "node:fs";
+import { watch, existsSync as existsSync18 } from "node:fs";
 import { readFile as readFile2 } from "node:fs/promises";
 var ConfigWatcher;
 var init_config_watcher = __esm({
@@ -152950,7 +154382,7 @@ var init_config_watcher = __esm({
        */
       async start() {
         await this.reload();
-        if (existsSync17(this.configPath)) {
+        if (existsSync18(this.configPath)) {
           this.watcher = watch(this.configPath, { persistent: false }, (eventType) => {
             if (eventType === "change") {
               if (this.debounceTimer) clearTimeout(this.debounceTimer);
@@ -152986,7 +154418,7 @@ var init_config_watcher = __esm({
       // ─── Internal ───────────────────────────────────────────────────────
       async reload() {
         try {
-          if (!existsSync17(this.configPath)) {
+          if (!existsSync18(this.configPath)) {
             console.warn("[config-watcher] Config file not found, keeping current config.");
             return;
           }
@@ -153030,8 +154462,8 @@ __export(telemetry_exports, {
   resetTelemetry: () => resetTelemetry
 });
 import { randomUUID as randomUUID42 } from "node:crypto";
-import { existsSync as existsSync18, readFileSync as readFileSync18, writeFileSync as writeFileSync12, appendFileSync as appendFileSync2, mkdirSync as mkdirSync10 } from "node:fs";
-import { join as join23 } from "node:path";
+import { existsSync as existsSync19, readFileSync as readFileSync19, writeFileSync as writeFileSync13, appendFileSync as appendFileSync2, mkdirSync as mkdirSync11 } from "node:fs";
+import { join as join24 } from "node:path";
 import { homedir as homedir8 } from "node:os";
 function getTelemetry(config2) {
   if (!_instance2) {
@@ -153046,10 +154478,10 @@ var VERSION2, DATA_DIR3, TELEMETRY_ID_FILE, TELEMETRY_LOG_FILE, DEFAULT_FLUSH_TH
 var init_telemetry2 = __esm({
   "../server/src/services/telemetry.ts"() {
     "use strict";
-    VERSION2 = "2.7.1";
-    DATA_DIR3 = join23(homedir8(), ".nestor");
-    TELEMETRY_ID_FILE = join23(DATA_DIR3, "telemetry-id");
-    TELEMETRY_LOG_FILE = join23(DATA_DIR3, "telemetry.jsonl");
+    VERSION2 = "3.0.0";
+    DATA_DIR3 = join24(homedir8(), ".nestor");
+    TELEMETRY_ID_FILE = join24(DATA_DIR3, "telemetry-id");
+    TELEMETRY_LOG_FILE = join24(DATA_DIR3, "telemetry.jsonl");
     DEFAULT_FLUSH_THRESHOLD = 10;
     TelemetryService = class {
       enabled;
@@ -153142,8 +154574,8 @@ var init_telemetry2 = __esm({
       // ─── Private ─────────────────────────────────────────────────────────
       getOrCreateInstallId() {
         try {
-          if (existsSync18(TELEMETRY_ID_FILE)) {
-            const id = readFileSync18(TELEMETRY_ID_FILE, "utf-8").trim();
+          if (existsSync19(TELEMETRY_ID_FILE)) {
+            const id = readFileSync19(TELEMETRY_ID_FILE, "utf-8").trim();
             if (id.length > 0) return id;
           }
         } catch {
@@ -153151,14 +154583,14 @@ var init_telemetry2 = __esm({
         const newId = randomUUID42();
         try {
           this.ensureDataDir();
-          writeFileSync12(TELEMETRY_ID_FILE, newId + "\n", "utf-8");
+          writeFileSync13(TELEMETRY_ID_FILE, newId + "\n", "utf-8");
         } catch {
         }
         return newId;
       }
       ensureDataDir() {
-        if (!existsSync18(DATA_DIR3)) {
-          mkdirSync10(DATA_DIR3, { recursive: true });
+        if (!existsSync19(DATA_DIR3)) {
+          mkdirSync11(DATA_DIR3, { recursive: true });
         }
       }
       startFlushTimer() {
@@ -157365,7 +158797,7 @@ var init_src6 = __esm({
         await this._handle.listen();
         const authMode = config2.apiKey ? "API key" : "open (no auth)";
         console.log(`
-  Nestor Server v2.7.1`);
+  Nestor Server v3.0.0`);
         console.log(`  \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500`);
         console.log(`  HTTP    : http://${this._host}:${this._port}`);
         console.log(`  WS      : ws://${this._host}:${this._port}/ws`);
@@ -164744,7 +166176,7 @@ var require_dist12 = __commonJS({
 });
 
 // ../skill-tester/src/yaml-loader.ts
-import { readFileSync as readFileSync19 } from "node:fs";
+import { readFileSync as readFileSync20 } from "node:fs";
 function parseYamlContent(content) {
   try {
     return JSON.parse(content);
@@ -164860,7 +166292,7 @@ var init_yaml_loader = __esm({
        * Load a YAML test suite from a file path.
        */
       static loadFile(filePath) {
-        const content = readFileSync19(filePath, "utf-8");
+        const content = readFileSync20(filePath, "utf-8");
         return _YamlTestLoader.parse(content);
       }
       /**
@@ -164939,8 +166371,8 @@ var init_yaml_loader = __esm({
 });
 
 // ../skill-tester/src/runner.ts
-import { readFileSync as readFileSync20, readdirSync as readdirSync4, statSync as statSync5, existsSync as existsSync20, mkdirSync as mkdirSync12, rmSync as rmSync2 } from "node:fs";
-import { join as join25, resolve as resolve14 } from "node:path";
+import { readFileSync as readFileSync21, readdirSync as readdirSync5, statSync as statSync6, existsSync as existsSync21, mkdirSync as mkdirSync13, rmSync as rmSync2 } from "node:fs";
+import { join as join26, resolve as resolve14 } from "node:path";
 import { tmpdir as tmpdir4 } from "node:os";
 import { randomUUID as randomUUID44 } from "node:crypto";
 var SequentialMockAdapter, SkillTestRunner;
@@ -165015,25 +166447,25 @@ var init_runner2 = __esm({
         try {
           const mockResponses = test.mockResponses.length > 0 ? test.mockResponses : [{ content: "Test completed." }];
           const adapter = new SequentialMockAdapter(mockResponses);
-          const tempDir = join25(tmpdir4(), `nestor-skill-test-${randomUUID44()}`);
-          mkdirSync12(tempDir, { recursive: true });
+          const tempDir = join26(tmpdir4(), `nestor-skill-test-${randomUUID44()}`);
+          mkdirSync13(tempDir, { recursive: true });
           try {
             const agentModule = await Promise.resolve().then(() => (init_src5(), src_exports3));
             const events = new agentModule.RuntimeEventBus();
             const tools = new agentModule.ToolRegistry();
             const toolExecutor = new agentModule.ToolExecutor();
             let instructions = "You are a helpful AI assistant.";
-            if (test.skill && existsSync20(test.skill)) {
-              instructions = readFileSync20(test.skill, "utf-8");
+            if (test.skill && existsSync21(test.skill)) {
+              instructions = readFileSync21(test.skill, "utf-8");
             } else if (test.skill) {
               const skillPaths = [
-                join25(process.cwd(), ".nestor", "skills", test.skill, "SKILL.md"),
-                join25(process.cwd(), "skills", test.skill, "SKILL.md"),
-                join25(process.cwd(), "skills-registry", test.skill, "SKILL.md")
+                join26(process.cwd(), ".nestor", "skills", test.skill, "SKILL.md"),
+                join26(process.cwd(), "skills", test.skill, "SKILL.md"),
+                join26(process.cwd(), "skills-registry", test.skill, "SKILL.md")
               ];
               for (const p8 of skillPaths) {
-                if (existsSync20(p8)) {
-                  instructions = readFileSync20(p8, "utf-8");
+                if (existsSync21(p8)) {
+                  instructions = readFileSync21(p8, "utf-8");
                   break;
                 }
               }
@@ -165243,23 +166675,23 @@ var init_runner2 = __esm({
       discoverTestFiles(dir) {
         const files = [];
         const resolvedDir = resolve14(dir);
-        if (!existsSync20(resolvedDir)) return files;
-        const stat = statSync5(resolvedDir);
+        if (!existsSync21(resolvedDir)) return files;
+        const stat = statSync6(resolvedDir);
         if (!stat.isDirectory()) {
           return [resolvedDir];
         }
         function walk(current) {
           let entries;
           try {
-            entries = readdirSync4(current);
+            entries = readdirSync5(current);
           } catch {
             return;
           }
           for (const entry of entries) {
             if (entry === "node_modules" || entry === ".git" || entry === "dist") continue;
-            const fullPath = join25(current, entry);
+            const fullPath = join26(current, entry);
             try {
-              const s = statSync5(fullPath);
+              const s = statSync6(fullPath);
               if (s.isDirectory()) {
                 walk(fullPath);
               } else if (s.isFile() && entry.endsWith(".test.yaml")) {
@@ -167127,7 +168559,7 @@ var init_server = __esm({
     MCP_PROTOCOL_VERSION = "2024-11-05";
     SERVER_INFO = {
       name: "nestor",
-      version: "2.7.1"
+      version: "3.0.0"
     };
     SERVER_CAPABILITIES = {
       tools: { listChanged: false },
@@ -167313,10 +168745,10 @@ __export(shell_exports, {
   registerShellCommand: () => registerShellCommand
 });
 import * as readline3 from "node:readline";
-import { existsSync as existsSync21, readFileSync as readFileSync21, writeFileSync as writeFileSync14, mkdirSync as mkdirSync13, appendFileSync as appendFileSync3 } from "node:fs";
-import { join as join26, resolve as resolve15, dirname as dirname10, basename as basename4 } from "node:path";
+import { existsSync as existsSync22, readFileSync as readFileSync22, writeFileSync as writeFileSync15, mkdirSync as mkdirSync14, appendFileSync as appendFileSync3 } from "node:fs";
+import { join as join27, resolve as resolve15, dirname as dirname10, basename as basename5 } from "node:path";
 import { homedir as homedir9 } from "node:os";
-import { readdirSync as readdirSync5 } from "node:fs";
+import { readdirSync as readdirSync6 } from "node:fs";
 import { randomUUID as randomUUID50 } from "node:crypto";
 import chalk11 from "chalk";
 import * as p5 from "@clack/prompts";
@@ -167347,8 +168779,8 @@ async function startShell() {
     currentRouter: null,
     verbose: false
   };
-  if (!existsSync21(NESTOR_DIR)) {
-    mkdirSync13(NESTOR_DIR, { recursive: true });
+  if (!existsSync22(NESTOR_DIR)) {
+    mkdirSync14(NESTOR_DIR, { recursive: true });
   }
   refreshAgentNameCache(session);
   const history = loadHistory();
@@ -167571,7 +169003,7 @@ function printWelcome() {
   console.log(chalk11.cyan(` | .\` | | _|  \\__ \\   | |   | (_) | |   /  _  \\__ \\ | __ |`));
   console.log(chalk11.cyan(` |_|\\_| |___| |___/   |_|    \\___/  |_|_\\ (_) |___/ |_||_|`));
   console.log("");
-  console.log(chalk11.dim("  Interactive Shell \u2014 v2.7.1"));
+  console.log(chalk11.dim("  Interactive Shell \u2014 v3.0.0"));
   console.log(chalk11.dim("  Type /help for commands, /exit to quit."));
   console.log(chalk11.dim("  Multiline: end a line with \\ or use ``` code blocks."));
   console.log("");
@@ -168068,8 +169500,8 @@ function cmdExport(args2, session) {
         timestamp: new Date(e.timestamp).toISOString()
       }))
     };
-    const filename = join26(NESTOR_DIR, `conversation-${timestamp}.json`);
-    writeFileSync14(filename, JSON.stringify(data, null, 2), "utf-8");
+    const filename = join27(NESTOR_DIR, `conversation-${timestamp}.json`);
+    writeFileSync15(filename, JSON.stringify(data, null, 2), "utf-8");
     console.log(chalk11.green(`Exported to: ${filename}`));
     return;
   }
@@ -168093,8 +169525,8 @@ function cmdExport(args2, session) {
       lines.push(entry.content);
       lines.push("");
     }
-    const filename = join26(NESTOR_DIR, `conversation-${timestamp}.md`);
-    writeFileSync14(filename, lines.join("\n"), "utf-8");
+    const filename = join27(NESTOR_DIR, `conversation-${timestamp}.md`);
+    writeFileSync15(filename, lines.join("\n"), "utf-8");
     console.log(chalk11.green(`Exported to: ${filename}`));
     return;
   }
@@ -168130,8 +169562,8 @@ ${rows}
 <div class="stats">Tokens: ${fmtNum(session.totalTokensIn)} in / ${fmtNum(session.totalTokensOut)} out | Cost: $${session.totalCostUsd.toFixed(4)} | Tool calls: ${session.totalToolCalls}</div>
 </body>
 </html>`;
-    const filename = join26(NESTOR_DIR, `conversation-${timestamp}.html`);
-    writeFileSync14(filename, html, "utf-8");
+    const filename = join27(NESTOR_DIR, `conversation-${timestamp}.html`);
+    writeFileSync15(filename, html, "utf-8");
     console.log(chalk11.green(`Exported to: ${filename}`));
   }
 }
@@ -168638,7 +170070,7 @@ function createUnifiedDiff(oldText, newText, fileName) {
 function showDiffForStep(filePath, newContent) {
   try {
     const absolutePath = resolve15(process.cwd(), filePath);
-    const oldContent = readFileSync21(absolutePath, "utf-8");
+    const oldContent = readFileSync22(absolutePath, "utf-8");
     const diff = createUnifiedDiff(oldContent, newContent, filePath);
     for (const line of diff.split("\n")) {
       if (line.startsWith("+") && !line.startsWith("+++")) {
@@ -169051,8 +170483,8 @@ function completeFilePath(partial) {
       dir = dirname10(resolved);
       prefix = partial.substring(0, Math.max(partial.lastIndexOf("/"), partial.lastIndexOf("\\")) + 1);
     }
-    const entries = readdirSync5(dir, { withFileTypes: true });
-    const base = basename4(partial);
+    const entries = readdirSync6(dir, { withFileTypes: true });
+    const base = basename5(partial);
     const matches = [];
     for (const entry of entries) {
       if (entry.name.startsWith(".")) continue;
@@ -169082,8 +170514,8 @@ function refreshAgentNameCache(session) {
 }
 function loadHistory() {
   try {
-    if (existsSync21(HISTORY_FILE)) {
-      const raw = readFileSync21(HISTORY_FILE, "utf-8");
+    if (existsSync22(HISTORY_FILE)) {
+      const raw = readFileSync22(HISTORY_FILE, "utf-8");
       return raw.split("\n").filter((l) => l.trim().length > 0).slice(-MAX_HISTORY);
     }
   } catch {
@@ -169094,8 +170526,8 @@ function saveHistory(rl) {
 }
 function appendToHistoryFile(line) {
   try {
-    if (!existsSync21(NESTOR_DIR)) {
-      mkdirSync13(NESTOR_DIR, { recursive: true });
+    if (!existsSync22(NESTOR_DIR)) {
+      mkdirSync14(NESTOR_DIR, { recursive: true });
     }
     appendFileSync3(HISTORY_FILE, line + "\n", "utf-8");
   } catch {
@@ -169437,8 +170869,8 @@ var init_shell = __esm({
     init_config2();
     init_spinner();
     init_table();
-    NESTOR_DIR = join26(homedir9(), ".nestor");
-    HISTORY_FILE = join26(NESTOR_DIR, "shell_history");
+    NESTOR_DIR = join27(homedir9(), ".nestor");
+    HISTORY_FILE = join27(NESTOR_DIR, "shell_history");
     MAX_HISTORY = 1e3;
     SLASH_COMMANDS = {
       "/help": { description: "Show all commands", usage: "/help" },
@@ -169490,8 +170922,8 @@ var init_shell = __esm({
 
 // src/index.ts
 import { Command } from "commander";
-import { existsSync as existsSync25, readFileSync as readFileSync25 } from "node:fs";
-import { join as join29 } from "node:path";
+import { existsSync as existsSync27, readFileSync as readFileSync27 } from "node:fs";
+import { join as join30 } from "node:path";
 import { homedir as homedir12 } from "node:os";
 
 // src/commands/start.ts
@@ -169511,7 +170943,7 @@ var BANNER = `
 function registerStartCommand(program2) {
   program2.command("start").description("Start the Nestor server").option("-p, --port <port>", "Server port").option("-H, --host <host>", "Server host").option("--no-studio", "Disable the Studio web UI").action(async (options) => {
     console.log(chalk.cyan(BANNER));
-    console.log(chalk.dim(`  v2.7.1
+    console.log(chalk.dim(`  v3.0.0
 `));
     let config2 = readConfigFile();
     if (!config2) {
@@ -169636,8 +171068,8 @@ init_config();
 init_config2();
 import * as p from "@clack/prompts";
 import chalk2 from "chalk";
-import { mkdirSync as mkdirSync11, existsSync as existsSync19 } from "node:fs";
-import { join as join24 } from "node:path";
+import { mkdirSync as mkdirSync12, existsSync as existsSync20 } from "node:fs";
+import { join as join25 } from "node:path";
 import { randomBytes as randomBytes8 } from "node:crypto";
 function generateApiKey() {
   return `nst_${randomBytes8(32).toString("hex")}`;
@@ -169656,7 +171088,7 @@ function generateBetaKey() {
 }
 async function initializeDatabase(dataDir) {
   const { NestorStore: NestorStore2 } = await Promise.resolve().then(() => (init_src2(), src_exports));
-  const dbPath = join24(dataDir, "nestor.db");
+  const dbPath = join25(dataDir, "nestor.db");
   const store = await NestorStore2.open(dbPath);
   store.close();
 }
@@ -169704,31 +171136,31 @@ async function runNonInteractiveInstall() {
   console.log();
   const config2 = buildConfigFromDefaults();
   const dataDir = expandPath(config2.server.dataDir);
-  if (!existsSync19(dataDir)) {
-    mkdirSync11(dataDir, { recursive: true });
+  if (!existsSync20(dataDir)) {
+    mkdirSync12(dataDir, { recursive: true });
     console.log(chalk2.green("  Created data directory:"), dataDir);
   }
   for (const sub of ["adapters", "skills", "plugins", "logs"]) {
-    const subDir = join24(dataDir, sub);
-    if (!existsSync19(subDir)) {
-      mkdirSync11(subDir, { recursive: true });
+    const subDir = join25(dataDir, sub);
+    if (!existsSync20(subDir)) {
+      mkdirSync12(subDir, { recursive: true });
     }
   }
   writeConfigFile(config2);
   console.log(chalk2.green("  Configuration saved:"), getConfigPath());
   try {
     await initializeDatabase(dataDir);
-    console.log(chalk2.green("  Database initialized:"), join24(dataDir, "nestor.db"));
+    console.log(chalk2.green("  Database initialized:"), join25(dataDir, "nestor.db"));
   } catch (err) {
     console.log(chalk2.yellow("  Database initialization skipped (install @nestor/db first)"));
   }
   const apiKey = generateApiKey();
-  const apiKeyPath = join24(dataDir, ".api-keys");
-  const { writeFileSync: writeFileSync17 } = await import("node:fs");
-  writeFileSync17(apiKeyPath, JSON.stringify({ admin: apiKey }, null, 2) + "\n", "utf-8");
+  const apiKeyPath = join25(dataDir, ".api-keys");
+  const { writeFileSync: writeFileSync18 } = await import("node:fs");
+  writeFileSync18(apiKeyPath, JSON.stringify({ admin: apiKey }, null, 2) + "\n", "utf-8");
   console.log(chalk2.green("  Admin API key created"));
   const betaKey = generateBetaKey();
-  writeFileSync17(join24(dataDir, "license.key"), betaKey, "utf-8");
+  writeFileSync18(join25(dataDir, "license.key"), betaKey, "utf-8");
   console.log(chalk2.green("  Beta key created"));
   console.log();
   console.log(chalk2.bold("Admin API Key:"), chalk2.yellow(apiKey));
@@ -169824,9 +171256,9 @@ async function runInteractiveInstall() {
   const dataDir = expandPath(config2.server.dataDir);
   const spinner3 = p.spinner();
   spinner3.start("Creating directories...");
-  for (const dir of [dataDir, join24(dataDir, "adapters"), join24(dataDir, "skills"), join24(dataDir, "plugins"), join24(dataDir, "logs")]) {
-    if (!existsSync19(dir)) {
-      mkdirSync11(dir, { recursive: true });
+  for (const dir of [dataDir, join25(dataDir, "adapters"), join25(dataDir, "skills"), join25(dataDir, "plugins"), join25(dataDir, "logs")]) {
+    if (!existsSync20(dir)) {
+      mkdirSync12(dir, { recursive: true });
     }
   }
   spinner3.stop("Directories created");
@@ -169851,14 +171283,14 @@ async function runInteractiveInstall() {
   const spinner4 = p.spinner();
   spinner4.start("Generating admin API key...");
   const apiKey = generateApiKey();
-  const apiKeyPath = join24(dataDir, ".api-keys");
-  const { writeFileSync: writeFileSync17 } = await import("node:fs");
-  writeFileSync17(apiKeyPath, JSON.stringify({ admin: apiKey }, null, 2) + "\n", "utf-8");
+  const apiKeyPath = join25(dataDir, ".api-keys");
+  const { writeFileSync: writeFileSync18 } = await import("node:fs");
+  writeFileSync18(apiKeyPath, JSON.stringify({ admin: apiKey }, null, 2) + "\n", "utf-8");
   spinner4.stop("Admin API key created!");
   const spinner5 = p.spinner();
   spinner5.start("Generating beta key...");
   const betaKey = generateBetaKey();
-  writeFileSync17(join24(dataDir, "license.key"), betaKey, "utf-8");
+  writeFileSync18(join25(dataDir, "license.key"), betaKey, "utf-8");
   spinner5.stop("Beta key created!");
   p.note(
     `Config file:     ${getConfigPath()}
@@ -171151,23 +172583,23 @@ init_db();
 init_spinner();
 init_table();
 import {
-  existsSync as existsSync22,
-  readFileSync as readFileSync22,
-  writeFileSync as writeFileSync15,
-  mkdirSync as mkdirSync14,
+  existsSync as existsSync23,
+  readFileSync as readFileSync23,
+  writeFileSync as writeFileSync16,
+  mkdirSync as mkdirSync15,
   unlinkSync,
   appendFileSync as appendFileSync4
 } from "node:fs";
-import { join as join27 } from "node:path";
+import { join as join28 } from "node:path";
 import { homedir as homedir10 } from "node:os";
 import { fork as fork2 } from "node:child_process";
 import "node:readline";
 import chalk12 from "chalk";
-var NESTOR_DIR2 = join27(homedir10(), ".nestor");
-var PID_FILE = join27(NESTOR_DIR2, "daemon.pid");
-var LOG_DIR = join27(NESTOR_DIR2, "logs");
-var LOG_FILE = join27(LOG_DIR, "daemon.log");
-var HEARTBEAT_FILE = join27(NESTOR_DIR2, "daemon.heartbeat");
+var NESTOR_DIR2 = join28(homedir10(), ".nestor");
+var PID_FILE = join28(NESTOR_DIR2, "daemon.pid");
+var LOG_DIR = join28(NESTOR_DIR2, "logs");
+var LOG_FILE = join28(LOG_DIR, "daemon.log");
+var HEARTBEAT_FILE = join28(NESTOR_DIR2, "daemon.heartbeat");
 var HEARTBEAT_INTERVAL_MS2 = 3e4;
 function registerDaemonCommand(program2) {
   const daemon = program2.command("daemon").description("Manage the Nestor background daemon");
@@ -171203,7 +172635,7 @@ async function startForeground() {
   console.log(chalk12.cyan(` | .\` | | _|  \\__ \\   | |   | (_) | |   /  _  \\__ \\ | __ |`));
   console.log(chalk12.cyan(` |_|\\_| |___| |___/   |_|    \\___/  |_|_\\ (_) |___/ |_||_|`));
   console.log("");
-  console.log(chalk12.dim("  Daemon Mode \u2014 v2.7.1"));
+  console.log(chalk12.dim("  Daemon Mode \u2014 v3.0.0"));
   console.log(chalk12.dim(`  PID: ${process.pid}`));
   console.log(chalk12.dim(`  Log: ${LOG_FILE}`));
   console.log("");
@@ -171335,13 +172767,13 @@ async function showStatus() {
   console.log("");
 }
 async function showLogs(follow, lineCount) {
-  if (!existsSync22(LOG_FILE)) {
+  if (!existsSync23(LOG_FILE)) {
     console.log(chalk12.yellow("No daemon log file found."));
     console.log(chalk12.dim(`Expected at: ${LOG_FILE}`));
     return;
   }
   if (!follow) {
-    const content = readFileSync22(LOG_FILE, "utf-8");
+    const content = readFileSync23(LOG_FILE, "utf-8");
     const lines = content.split("\n").filter((l) => l.length > 0);
     const lastLines = lines.slice(-lineCount);
     if (lastLines.length === 0) {
@@ -171355,19 +172787,19 @@ async function showLogs(follow, lineCount) {
   }
   console.log(chalk12.dim(`Following ${LOG_FILE}... (Ctrl+C to stop)`));
   console.log("");
-  if (existsSync22(LOG_FILE)) {
-    const content = readFileSync22(LOG_FILE, "utf-8");
+  if (existsSync23(LOG_FILE)) {
+    const content = readFileSync23(LOG_FILE, "utf-8");
     const lines = content.split("\n").filter((l) => l.length > 0);
     const lastLines = lines.slice(-10);
     for (const line of lastLines) {
       console.log(colorizeLogLine(line));
     }
   }
-  let lastSize = existsSync22(LOG_FILE) ? readFileSync22(LOG_FILE).length : 0;
+  let lastSize = existsSync23(LOG_FILE) ? readFileSync23(LOG_FILE).length : 0;
   const watcher = setInterval(() => {
     try {
-      if (!existsSync22(LOG_FILE)) return;
-      const content = readFileSync22(LOG_FILE, "utf-8");
+      if (!existsSync23(LOG_FILE)) return;
+      const content = readFileSync23(LOG_FILE, "utf-8");
       if (content.length > lastSize) {
         const newContent = content.substring(lastSize);
         const newLines = newContent.split("\n").filter((l) => l.length > 0);
@@ -171566,9 +172998,9 @@ var DaemonRunner = class {
     try {
       const store = await getStore();
       try {
-        const { randomUUID: randomUUID51 } = await import("node:crypto");
+        const { randomUUID: randomUUID52 } = await import("node:crypto");
         store.createRun({
-          id: randomUUID51(),
+          id: randomUUID52(),
           workflowId: `agent:${agentId}`,
           workflowVersion: 1,
           status: result.exitReason === "completed" ? "completed" : "failed",
@@ -171604,9 +173036,9 @@ var DaemonRunner = class {
     try {
       const store = await getStore();
       try {
-        const { randomUUID: randomUUID51 } = await import("node:crypto");
+        const { randomUUID: randomUUID52 } = await import("node:crypto");
         store.createRun({
-          id: randomUUID51(),
+          id: randomUUID52(),
           workflowId: `agent:${agentId}`,
           workflowVersion: 1,
           status: "failed",
@@ -171679,7 +173111,7 @@ var DaemonRunner = class {
         activeAgents: this.runningAgents.size,
         nextScheduledRun: void 0
       };
-      writeFileSync15(HEARTBEAT_FILE, JSON.stringify(data), "utf-8");
+      writeFileSync16(HEARTBEAT_FILE, JSON.stringify(data), "utf-8");
     } catch {
     }
   }
@@ -171697,8 +173129,8 @@ async function importDaemonAgentModule() {
 }
 function readHeartbeat() {
   try {
-    if (existsSync22(HEARTBEAT_FILE)) {
-      const raw = readFileSync22(HEARTBEAT_FILE, "utf-8");
+    if (existsSync23(HEARTBEAT_FILE)) {
+      const raw = readFileSync23(HEARTBEAT_FILE, "utf-8");
       return JSON.parse(raw);
     }
   } catch {
@@ -171707,8 +173139,8 @@ function readHeartbeat() {
 }
 function readPid() {
   try {
-    if (existsSync22(PID_FILE)) {
-      const raw = readFileSync22(PID_FILE, "utf-8").trim();
+    if (existsSync23(PID_FILE)) {
+      const raw = readFileSync23(PID_FILE, "utf-8").trim();
       const pid = parseInt(raw, 10);
       return isNaN(pid) ? null : pid;
     }
@@ -171718,11 +173150,11 @@ function readPid() {
 }
 function writePid(pid) {
   ensureDirs();
-  writeFileSync15(PID_FILE, String(pid), "utf-8");
+  writeFileSync16(PID_FILE, String(pid), "utf-8");
 }
 function cleanupPid() {
   try {
-    if (existsSync22(PID_FILE)) {
+    if (existsSync23(PID_FILE)) {
       unlinkSync(PID_FILE);
     }
   } catch {
@@ -171762,11 +173194,11 @@ function colorizeLogLine(line) {
   return line;
 }
 function ensureDirs() {
-  if (!existsSync22(NESTOR_DIR2)) {
-    mkdirSync14(NESTOR_DIR2, { recursive: true });
+  if (!existsSync23(NESTOR_DIR2)) {
+    mkdirSync15(NESTOR_DIR2, { recursive: true });
   }
-  if (!existsSync22(LOG_DIR)) {
-    mkdirSync14(LOG_DIR, { recursive: true });
+  if (!existsSync23(LOG_DIR)) {
+    mkdirSync15(LOG_DIR, { recursive: true });
   }
 }
 function delay(ms) {
@@ -171807,13 +173239,13 @@ if (process.argv[2] === "__daemon_child__" || process.env.NESTOR_DAEMON_MODE ===
 
 // src/commands/watch.ts
 init_db();
-import { existsSync as existsSync23, readFileSync as readFileSync23 } from "node:fs";
-import { join as join28 } from "node:path";
+import { existsSync as existsSync24, readFileSync as readFileSync24 } from "node:fs";
+import { join as join29 } from "node:path";
 import { homedir as homedir11 } from "node:os";
 import chalk13 from "chalk";
-var NESTOR_DIR3 = join28(homedir11(), ".nestor");
-var HEARTBEAT_FILE2 = join28(NESTOR_DIR3, "daemon.heartbeat");
-var LOG_FILE2 = join28(NESTOR_DIR3, "logs", "daemon.log");
+var NESTOR_DIR3 = join29(homedir11(), ".nestor");
+var HEARTBEAT_FILE2 = join29(NESTOR_DIR3, "daemon.heartbeat");
+var LOG_FILE2 = join29(NESTOR_DIR3, "logs", "daemon.log");
 var REFRESH_INTERVAL_MS = 1e3;
 var MAX_EVENTS = 12;
 function registerWatchCommand(program2) {
@@ -171881,8 +173313,8 @@ async function refreshData(state) {
   } catch {
   }
   try {
-    if (existsSync23(HEARTBEAT_FILE2)) {
-      const raw = readFileSync23(HEARTBEAT_FILE2, "utf-8");
+    if (existsSync24(HEARTBEAT_FILE2)) {
+      const raw = readFileSync24(HEARTBEAT_FILE2, "utf-8");
       const heartbeat = JSON.parse(raw);
       state.daemonRunning = isDaemonAlive(heartbeat.pid);
       state.daemonPid = heartbeat.pid;
@@ -171899,8 +173331,8 @@ async function refreshData(state) {
 }
 function loadRecentEvents(state) {
   try {
-    if (!existsSync23(LOG_FILE2)) return;
-    const content = readFileSync23(LOG_FILE2, "utf-8");
+    if (!existsSync24(LOG_FILE2)) return;
+    const content = readFileSync24(LOG_FILE2, "utf-8");
     const lines = content.split("\n").filter((l) => l.length > 0);
     const recent = lines.slice(-MAX_EVENTS);
     state.recentEvents = recent.map((line) => {
@@ -172226,10 +173658,10 @@ function registerTelemetryCommand(program2) {
       }
       console.log(`  ${chalk15.dim("Flush:")}     every ${(config2.telemetry?.flushIntervalMs ?? 6e4) / 1e3}s`);
     }
-    const { join: join30 } = __require("node:path");
+    const { join: join31 } = __require("node:path");
     const { homedir: homedir13 } = __require("node:os");
-    const telemetryFile = join30(homedir13(), ".nestor", "telemetry.jsonl");
-    const idFile = join30(homedir13(), ".nestor", "telemetry-id");
+    const telemetryFile = join31(homedir13(), ".nestor", "telemetry.jsonl");
+    const idFile = join31(homedir13(), ".nestor", "telemetry-id");
     if (fs28.existsSync(idFile)) {
       const installId = fs28.readFileSync(idFile, "utf-8").trim();
       console.log(`  ${chalk15.dim("Install ID:")} ${installId.slice(0, 8)}...`);
@@ -172270,7 +173702,7 @@ function setTelemetryEnabled(enabled) {
 init_db();
 init_table();
 import chalk16 from "chalk";
-import { readFileSync as readFileSync24, writeFileSync as writeFileSync16 } from "node:fs";
+import { readFileSync as readFileSync25, writeFileSync as writeFileSync17 } from "node:fs";
 function registerMemoryCommand(program2) {
   const memory = program2.command("memory").description("Manage agent persistent memories");
   memory.command("list").description("List memories for an agent").option("-a, --agent <id>", "Agent ID to filter by").option("-t, --type <type>", "Memory type filter (observation, fact, instruction, reflection)").option("-l, --limit <n>", "Maximum results", "20").action(async (options) => {
@@ -172474,13 +173906,13 @@ Memory Statistics for ${agentId}`));
       }
     }
     const json = JSON.stringify(allMemories, null, 2);
-    writeFileSync16(outputFile, json, "utf-8");
+    writeFileSync17(outputFile, json, "utf-8");
     console.log(chalk16.green(`Exported ${allMemories.length} memories to ${outputFile}`));
   });
   memory.command("import <file>").description("Import memories from JSON").action(async (file) => {
     const store = await getStore();
     try {
-      const raw = readFileSync24(file, "utf-8");
+      const raw = readFileSync25(file, "utf-8");
       const entries = JSON.parse(raw);
       if (!Array.isArray(entries)) {
         console.error(chalk16.red("Invalid format: expected a JSON array of memory entries."));
@@ -173000,8 +174432,8 @@ ${results.length} results for "${query}":
 }
 
 // src/commands/test.ts
-import { resolve as resolve17, relative as relative5 } from "node:path";
-import { readdirSync as readdirSync6, statSync as statSync6, existsSync as existsSync24 } from "node:fs";
+import { resolve as resolve17, relative as relative6 } from "node:path";
+import { readdirSync as readdirSync7, statSync as statSync7, existsSync as existsSync25 } from "node:fs";
 import chalk20 from "chalk";
 var TEST_FILE_PATTERNS = [
   ".nestor-test.yaml",
@@ -173014,7 +174446,7 @@ function registerTestCommand(program2) {
   program2.command("test [path]").description("Run skill and agent test suites").option("-l, --list", "List discovered test files", false).option("-f, --file <file>", "Run a specific test file").option("-r, --record <file>", "Record LLM responses to a fixture file").option("-p, --prompt <prompt>", "Prompt for recording mode").option("-v, --verbose", "Show detailed test output", false).option("-j, --json", "Output results as JSON (for CI)", false).action(async (path30, opts) => {
     if (opts.file) {
       const filePath = resolve17(opts.file);
-      if (!existsSync24(filePath)) {
+      if (!existsSync25(filePath)) {
         console.error(chalk20.red(`File not found: ${opts.file}`));
         process.exit(1);
       }
@@ -173045,7 +174477,7 @@ function registerTestCommand(program2) {
     ];
     const allFiles = [];
     for (const testDir of defaultTestDirs) {
-      if (existsSync24(testDir)) {
+      if (existsSync25(testDir)) {
         allFiles.push(...discoverTestFiles(testDir));
       }
     }
@@ -173064,7 +174496,7 @@ function discoverTestFiles(dir) {
   function walk(current) {
     let entries;
     try {
-      entries = readdirSync6(current);
+      entries = readdirSync7(current);
     } catch {
       return;
     }
@@ -173072,7 +174504,7 @@ function discoverTestFiles(dir) {
       if (entry === "node_modules" || entry === ".git" || entry === "dist") continue;
       const fullPath = resolve17(current, entry);
       try {
-        const stat = statSync6(fullPath);
+        const stat = statSync7(fullPath);
         if (stat.isDirectory()) {
           walk(fullPath);
         } else if (stat.isFile()) {
@@ -173088,7 +174520,7 @@ function discoverTestFiles(dir) {
       }
     }
   }
-  if (existsSync24(dir) && !statSync6(dir).isDirectory()) {
+  if (existsSync25(dir) && !statSync7(dir).isDirectory()) {
     return [dir];
   }
   walk(dir);
@@ -173097,7 +174529,7 @@ function discoverTestFiles(dir) {
 async function listTestFiles(dir) {
   const files = discoverTestFiles(dir);
   const nestorTestDir = resolve17(dir, ".nestor", "tests");
-  if (existsSync24(nestorTestDir)) {
+  if (existsSync25(nestorTestDir)) {
     files.push(...discoverTestFiles(nestorTestDir));
   }
   const unique = [...new Set(files)];
@@ -173109,7 +174541,7 @@ async function listTestFiles(dir) {
 Discovered ${unique.length} test file(s):
 `));
   for (const file of unique) {
-    console.log(chalk20.dim("  ") + chalk20.cyan(relative5(dir, file)));
+    console.log(chalk20.dim("  ") + chalk20.cyan(relative6(dir, file)));
   }
   console.log("");
 }
@@ -173153,7 +174585,7 @@ async function runSkillTestsByName(skillName, verbose, json) {
   ];
   const matchingFiles = [];
   for (const dir of searchDirs) {
-    if (!existsSync24(dir)) continue;
+    if (!existsSync25(dir)) continue;
     const files = discoverTestFiles(dir);
     for (const file of files) {
       if (file.includes(skillName)) {
@@ -173179,7 +174611,7 @@ Running ${files.length} test suite(s) (legacy runner)...
   let totalFailed = 0;
   const startTime4 = Date.now();
   for (const file of files) {
-    const relPath = relative5(process.cwd(), file);
+    const relPath = relative6(process.cwd(), file);
     let suite;
     try {
       suite = agentModule.AgentTestRunner.loadSuite(file);
@@ -173349,11 +174781,289 @@ function registerGuardrailCommand(program2) {
   });
 }
 
+// src/commands/loop.ts
+init_db();
+init_config2();
+import chalk22 from "chalk";
+import { randomUUID as randomUUID51 } from "node:crypto";
+import { readFileSync as readFileSync26, existsSync as existsSync26 } from "node:fs";
+import { execSync as execSync3 } from "node:child_process";
+function runShellCommand(cmd, cwd) {
+  try {
+    const stdout = execSync3(cmd, {
+      cwd,
+      encoding: "utf-8",
+      timeout: 6e4,
+      stdio: ["pipe", "pipe", "pipe"]
+    });
+    return { stdout: stdout.trim(), exitCode: 0 };
+  } catch (err) {
+    const execErr = err;
+    return {
+      stdout: (execErr.stdout ?? "").toString().trim(),
+      exitCode: execErr.status ?? 1
+    };
+  }
+}
+function getGitDiff(cwd) {
+  try {
+    const diff = execSync3("git diff --stat", { cwd, encoding: "utf-8", timeout: 1e4 });
+    return diff.trim() || "(no changes)";
+  } catch {
+    return "(git not available)";
+  }
+}
+function getTestOutput(verifyCmd, cwd) {
+  const result = runShellCommand(verifyCmd, cwd);
+  const maxLen = 2e3;
+  const output = result.stdout.length > maxLen ? result.stdout.slice(-maxLen) : result.stdout;
+  return output;
+}
+function buildIterationPrompt(opts) {
+  const parts = [];
+  parts.push(`# Objective (iteration ${opts.iteration}/${opts.maxIterations})`);
+  parts.push("");
+  parts.push(opts.spec);
+  parts.push("");
+  if (opts.previousResults.length > 0) {
+    parts.push("## Previous iterations summary");
+    for (const r of opts.previousResults) {
+      const status = r.specMet ? "PASSED" : "FAILED";
+      parts.push(`- Iteration ${r.iteration}: ${status} (${r.exitReason}) \u2014 ${r.output.slice(0, 200)}`);
+    }
+    parts.push("");
+  }
+  if (opts.gitDiff !== "(no changes)" && opts.gitDiff !== "(git not available)") {
+    parts.push("## Current state (git diff --stat)");
+    parts.push("```");
+    parts.push(opts.gitDiff);
+    parts.push("```");
+    parts.push("");
+  }
+  if (opts.verifyOutput) {
+    parts.push("## Verification output (from last check)");
+    parts.push("```");
+    parts.push(opts.verifyOutput);
+    parts.push("```");
+    parts.push("");
+  }
+  parts.push("## Instructions");
+  parts.push("Analyze the current state and work towards achieving the objective.");
+  parts.push("If previous iterations failed, try a DIFFERENT approach.");
+  parts.push("When done, commit your changes with a descriptive message.");
+  return parts.join("\n");
+}
+function registerLoopCommand(program2) {
+  program2.command("loop").description("Run an agent in a fresh-context loop until a specification is met (Ralph pattern)").option("--agent <name>", "Agent name to use", "default").option("--spec <text>", "Specification to achieve").option("--spec-file <path>", "File containing the specification").option("--verify <command>", "Shell command to verify spec (exit 0 = done)").option("--max-iterations <n>", "Max loop iterations", "10").option("--budget <usd>", "Max total budget in USD", "5").option("--cwd <path>", "Working directory", process.cwd()).action(async (opts) => {
+    let spec = opts.spec;
+    if (!spec && opts.specFile) {
+      if (!existsSync26(opts.specFile)) {
+        console.error(chalk22.red(`Spec file not found: ${opts.specFile}`));
+        process.exit(1);
+      }
+      spec = readFileSync26(opts.specFile, "utf-8").trim();
+    }
+    if (!spec) {
+      console.error(chalk22.red("Must provide --spec or --spec-file"));
+      process.exit(1);
+    }
+    const maxIterations = parseInt(opts.maxIterations, 10);
+    const totalBudget = parseFloat(opts.budget);
+    const cwd = opts.cwd;
+    console.log(chalk22.cyan("\n  Ralph Fresh-Context Loop"));
+    console.log(chalk22.dim("  \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500"));
+    console.log(chalk22.white("  Spec:"), spec.slice(0, 100) + (spec.length > 100 ? "..." : ""));
+    console.log(chalk22.white("  Agent:"), opts.agent);
+    console.log(chalk22.white("  Max iterations:"), maxIterations);
+    console.log(chalk22.white("  Budget:"), `$${totalBudget}`);
+    if (opts.verify) {
+      console.log(chalk22.white("  Verify cmd:"), opts.verify);
+    }
+    console.log("");
+    let agentModule;
+    try {
+      agentModule = await Promise.resolve().then(() => (init_src5(), src_exports3));
+    } catch {
+      console.error(chalk22.red("Failed to import @nestor/agent. Is it installed?"));
+      process.exit(1);
+    }
+    const store = await getStore();
+    let resolvedAgent;
+    try {
+      const agents = store.listAgents();
+      resolvedAgent = agents.find((a) => a.name === opts.agent);
+    } catch {
+    }
+    const agent = resolvedAgent ?? {
+      id: randomUUID51(),
+      name: opts.agent,
+      adapterType: "claude",
+      adapterConfig: {
+        model: "claude-sonnet-4-20250514",
+        instructions: "You are an expert software engineer. Complete the given specification precisely."
+      },
+      trustLevel: "community",
+      createdAt: (/* @__PURE__ */ new Date()).toISOString(),
+      updatedAt: (/* @__PURE__ */ new Date()).toISOString()
+    };
+    let router;
+    try {
+      router = await agentModule.createDefaultRouter();
+    } catch {
+      console.error(chalk22.red("Could not initialize LLM adapter. Is the API key configured?"));
+      process.exit(1);
+    }
+    const summary = {
+      totalIterations: 0,
+      totalCostUsd: 0,
+      totalTokens: 0,
+      totalDurationMs: 0,
+      specMet: false,
+      iterationResults: []
+    };
+    for (let i = 1; i <= maxIterations; i++) {
+      if (summary.totalCostUsd >= totalBudget) {
+        console.log(chalk22.yellow(`
+  Budget exhausted ($${summary.totalCostUsd.toFixed(4)} / $${totalBudget}). Stopping.`));
+        break;
+      }
+      const remainingBudget = totalBudget - summary.totalCostUsd;
+      console.log(chalk22.cyan(`
+  \u2500\u2500 Iteration ${i}/${maxIterations} `) + chalk22.dim(`(budget remaining: $${remainingBudget.toFixed(4)}) \u2500\u2500`));
+      if (opts.verify && i > 1) {
+        const verifyResult = runShellCommand(opts.verify, cwd);
+        if (verifyResult.exitCode === 0) {
+          console.log(chalk22.green("  Specification met! Verify command exited 0."));
+          summary.specMet = true;
+          break;
+        }
+      }
+      const gitDiff = getGitDiff(cwd);
+      const verifyOutput = opts.verify ? getTestOutput(opts.verify, cwd) : "";
+      const prompt = buildIterationPrompt({
+        spec,
+        iteration: i,
+        maxIterations,
+        previousResults: summary.iterationResults,
+        gitDiff,
+        verifyOutput
+      });
+      const modelId = agent.adapterConfig.model ?? "claude-sonnet-4-20250514";
+      const adapter = router.resolve(modelId);
+      const events = new agentModule.RuntimeEventBus();
+      const tools = new agentModule.ToolRegistry();
+      agentModule.registerBuiltinTools(tools);
+      const runtime = new agentModule.AgentRuntime({
+        adapter,
+        tools,
+        toolExecutor: new agentModule.ToolExecutor(),
+        role: {
+          name: agent.name,
+          description: agent.description ?? "Loop agent",
+          instructions: agent.adapterConfig.instructions ?? "You are an expert software engineer.",
+          constraints: []
+        },
+        workingDir: cwd,
+        events,
+        maxCostUsd: remainingBudget,
+        maxIterations: 50,
+        db: store,
+        modelRouter: router,
+        // Enable context rotation within each iteration too
+        contextRotation: { maxMessages: 40, maxTokensEstimate: 8e4 },
+        stuckDetection: { maxRepeatedCalls: 3, maxConsecutiveErrors: 3 }
+      });
+      const taskId = randomUUID51();
+      let iterOutput = "";
+      try {
+        for await (const event of runtime.runStreaming({
+          prompt,
+          agentId: agent.id,
+          taskId
+        })) {
+          switch (event.type) {
+            case "token":
+              process.stdout.write(event.text);
+              iterOutput += event.text;
+              break;
+            case "tool_start":
+              console.log(chalk22.dim(`
+    [tool] ${event.name}`));
+              break;
+            case "tool_result":
+              if (!event.success) {
+                console.log(chalk22.red(`    [tool error] ${event.name}: ${event.result.slice(0, 100)}`));
+              }
+              break;
+            case "error":
+              console.log(chalk22.red(`
+    [error] ${event.message}`));
+              break;
+            case "done": {
+              const r = event.result;
+              const iterResult = {
+                iteration: i,
+                output: r.output || iterOutput,
+                exitReason: r.exitReason,
+                costUsd: r.usage.estimatedCostUsd,
+                tokens: r.usage.totalTokens,
+                durationMs: r.durationMs,
+                specMet: false
+              };
+              summary.totalCostUsd += r.usage.estimatedCostUsd;
+              summary.totalTokens += r.usage.totalTokens;
+              summary.totalDurationMs += r.durationMs;
+              summary.totalIterations = i;
+              if (opts.verify) {
+                const postVerify = runShellCommand(opts.verify, cwd);
+                iterResult.specMet = postVerify.exitCode === 0;
+              }
+              summary.iterationResults.push(iterResult);
+              console.log("");
+              console.log(chalk22.dim(`    [${r.exitReason}] ${r.usage.totalTokens} tokens, $${r.usage.estimatedCostUsd.toFixed(4)}, ${(r.durationMs / 1e3).toFixed(1)}s`));
+              if (iterResult.specMet) {
+                console.log(chalk22.green("    Specification met!"));
+                summary.specMet = true;
+              }
+              break;
+            }
+          }
+        }
+      } catch (err) {
+        console.error(chalk22.red(`
+    Iteration ${i} crashed: ${err instanceof Error ? err.message : String(err)}`));
+        summary.iterationResults.push({
+          iteration: i,
+          output: `Error: ${err instanceof Error ? err.message : String(err)}`,
+          exitReason: "error",
+          costUsd: 0,
+          tokens: 0,
+          durationMs: 0,
+          specMet: false
+        });
+      }
+      if (summary.specMet) break;
+    }
+    console.log(chalk22.cyan("\n  \u2500\u2500 Loop Summary \u2500\u2500"));
+    console.log(chalk22.white("  Iterations:"), summary.totalIterations);
+    console.log(chalk22.white("  Total cost:"), `$${summary.totalCostUsd.toFixed(4)}`);
+    console.log(chalk22.white("  Total tokens:"), summary.totalTokens.toLocaleString());
+    console.log(chalk22.white("  Total time:"), `${(summary.totalDurationMs / 1e3).toFixed(1)}s`);
+    console.log(
+      chalk22.white("  Spec met:"),
+      summary.specMet ? chalk22.green("YES") : chalk22.red("NO")
+    );
+    console.log("");
+    await store.close();
+    process.exit(summary.specMet ? 0 : 1);
+  });
+}
+
 // src/index.ts
 function checkBetaAccess() {
-  const licenseFile = join29(homedir12(), ".nestor", "license.key");
-  if (!existsSync25(licenseFile)) return false;
-  const key = readFileSync25(licenseFile, "utf-8").trim();
+  const licenseFile = join30(homedir12(), ".nestor", "license.key");
+  if (!existsSync27(licenseFile)) return false;
+  const key = readFileSync27(licenseFile, "utf-8").trim();
   return /^NESTOR-BETA-[A-Z0-9]{4}-[A-Z0-9]{4}-[A-Z0-9]{4}$/.test(key);
 }
 var command2 = process.argv[2];
@@ -173373,7 +175083,7 @@ if (command2 && !["--help", "-h", "--version", "-V", "install"].includes(command
   }
 }
 var program = new Command();
-program.name("nestor-sh").description("Nestor AI Agent Platform \u2014 orchestrate, secure and monitor AI agents").version("2.7.1");
+program.name("nestor-sh").description("Nestor AI Agent Platform \u2014 orchestrate, secure and monitor AI agents").version("3.0.0");
 registerStartCommand(program);
 registerInstallCommand(program);
 registerAgentCommand(program);
@@ -173393,6 +175103,7 @@ registerTemplateCommand(program);
 registerRagCommand(program);
 registerTestCommand(program);
 registerGuardrailCommand(program);
+registerLoopCommand(program);
 var args = process.argv.slice(2);
 if (args.length === 0) {
   Promise.resolve().then(() => (init_shell(), shell_exports)).then(({ registerShellCommand: _ }) => {