omnius 1.0.148 → 1.0.150

package/dist/index.js

@@ -11820,6 +11820,99 @@ async function _ensureHelia() {
 var _natsConn = null;
 var _natsCodec = null;
 var _tokensByRequest = {};
+var _sponsorLimits = null;
+var _sponsorActiveRequests = 0;
+var _sponsorRequestWindow = [];
+var _sponsorDailyTokensUsed = 0;
+var _sponsorDailyResetAt = Date.now() + 86400000;
+var _sponsorBlockedRequests = 0;
+var _sponsorTokenRateSamples = [];
+
+function _sponsorPrune(now) {
+  while (_sponsorRequestWindow.length > 0 && _sponsorRequestWindow[0] < now - 60000) _sponsorRequestWindow.shift();
+  while (_sponsorTokenRateSamples.length > 0 && _sponsorTokenRateSamples[0].at < now - 10000) _sponsorTokenRateSamples.shift();
+  if (_sponsorDailyResetAt <= now) {
+    _sponsorDailyTokensUsed = 0;
+    _sponsorDailyResetAt = now + 86400000;
+  }
+}
+
+function _sponsorTokenRate(now) {
+  _sponsorPrune(now || Date.now());
+  if (_sponsorTokenRateSamples.length === 0) return 0;
+  var tokens = 0;
+  for (var i = 0; i < _sponsorTokenRateSamples.length; i++) tokens += _sponsorTokenRateSamples[i].tokens || 0;
+  var spanMs = Math.max(1000, (now || Date.now()) - _sponsorTokenRateSamples[0].at);
+  return Math.round((tokens / (spanMs / 1000)) * 10) / 10;
+}
+
+function _sponsorRecordTokenRate(tokens) {
+  var n = Number(tokens) || 0;
+  if (n <= 0) return _sponsorTokenRate(Date.now());
+  var now = Date.now();
+  _sponsorTokenRateSamples.push({ at: now, tokens: Math.floor(n) });
+  return _sponsorTokenRate(now);
+}
+
+function _sponsorEstimateTokens(text) {
+  var len = String(text || '').length;
+  return len > 0 ? Math.max(1, Math.ceil(len / 4)) : 0;
+}
+
+function _sponsorAdmit(model) {
+  if (!_sponsorLimits) return { ok: true };
+  var now = Date.now();
+  _sponsorPrune(now);
+  if (_sponsorLimits.maxConcurrent <= 0 || _sponsorLimits.maxRequestsPerMinute <= 0 || _sponsorLimits.maxTokensPerDay <= 0) {
+    _sponsorBlockedRequests++;
+    return { ok: false, reason: 'Sponsored endpoint is paused or has no quota configured.' };
+  }
+  if (_sponsorLimits.allowedModels !== 'all' && _sponsorLimits.allowedModels.indexOf(model) === -1) {
+    _sponsorBlockedRequests++;
+    return { ok: false, reason: 'Model not allowed: ' + model };
+  }
+  if (_sponsorActiveRequests >= _sponsorLimits.maxConcurrent) {
+    _sponsorBlockedRequests++;
+    return { ok: false, reason: 'Too many concurrent requests (' + _sponsorActiveRequests + '/' + _sponsorLimits.maxConcurrent + '). Try again shortly.' };
+  }
+  if (_sponsorRequestWindow.length >= _sponsorLimits.maxRequestsPerMinute) {
+    _sponsorBlockedRequests++;
+    return { ok: false, reason: 'Rate limited (' + _sponsorLimits.maxRequestsPerMinute + ' req/min).' };
+  }
+  if (_sponsorDailyTokensUsed >= _sponsorLimits.maxTokensPerDay) {
+    _sponsorBlockedRequests++;
+    return { ok: false, reason: 'Daily token budget exhausted.' };
+  }
+  _sponsorActiveRequests++;
+  _sponsorRequestWindow.push(now);
+  return { ok: true };
+}
+
+function _sponsorRelease() {
+  if (_sponsorActiveRequests > 0) _sponsorActiveRequests--;
+}
+
+function _sponsorRecordUsage(inputTokens, outputTokens, includeRate) {
+  var input = Math.max(0, Math.floor(Number(inputTokens) || 0));
+  var output = Math.max(0, Math.floor(Number(outputTokens) || 0));
+  _sponsorPrune(Date.now());
+  _sponsorDailyTokensUsed += input + output;
+  if (includeRate !== false) _sponsorRecordTokenRate(output);
+}
+
+function _sponsorGatewaySnapshot() {
+  var now = Date.now();
+  _sponsorPrune(now);
+  return {
+    activeConnections: _sponsorActiveRequests,
+    requestsInWindow: _sponsorRequestWindow.length,
+    dailyTokensUsed: _sponsorDailyTokensUsed,
+    dailyResetAt: _sponsorDailyResetAt,
+    blockedRequests: _sponsorBlockedRequests,
+    tokensPerSecond: _sponsorTokenRate(now),
+    limits: _sponsorLimits,
+  };
+}
 
 // ── Nexus voice subsystem (PCM + ASR) ─────────────────────────────────
 // Subscribes to nexus.rooms.audio, filters by the rooms this daemon has
@@ -12032,10 +12125,22 @@ async function _collectSysMetrics() {
     var totalMem = os.totalmem();
     var freeMem = os.freemem();
     var usedMem = totalMem - freeMem;
-    var cpuModel = '';
-    try { var cpuArr = os.cpus(); if (cpuArr.length > 0) cpuModel = cpuArr[0].model || ''; } catch {}
-    var gpuInfo = { available: false, name: '', utilization: 0, vramUsedMB: 0, vramTotalMB: 0, vramUtilization: 0 };
-    try {
+	    var cpuModel = '';
+	    try { var cpuArr = os.cpus(); if (cpuArr.length > 0) cpuModel = cpuArr[0].model || ''; } catch {}
+	    var gpuInfo = { available: false, name: '', utilization: 0, vramUsedMB: 0, vramTotalMB: 0, vramUtilization: 0 };
+	    var diskInfo = { path: process.cwd(), totalGB: 0, freeGB: 0, usedGB: 0, utilization: -1 };
+	    try {
+	      var fs = await import('node:fs');
+	      var st = fs.statfsSync(process.cwd());
+	      var totalBytes = Number(st.blocks) * Number(st.bsize);
+	      var freeBytes = Number(st.bavail) * Number(st.bsize);
+	      var usedBytes = Math.max(0, totalBytes - freeBytes);
+	      diskInfo.totalGB = Math.round((totalBytes / (1024*1024*1024)) * 10) / 10;
+	      diskInfo.freeGB = Math.round((freeBytes / (1024*1024*1024)) * 10) / 10;
+	      diskInfo.usedGB = Math.round((usedBytes / (1024*1024*1024)) * 10) / 10;
+	      diskInfo.utilization = totalBytes > 0 ? Math.round((usedBytes / totalBytes) * 100) : -1;
+	    } catch {}
+	    try {
       var cp = await import('node:child_process');
       var smiOut = cp.execSync('nvidia-smi --query-gpu=utilization.gpu,memory.used,memory.total,name --format=csv,noheader,nounits 2>/dev/null', { encoding: 'utf8', timeout: 3000 });
       var smiLine = smiOut.trim().split('\\n')[0];
@@ -12050,9 +12155,10 @@ async function _collectSysMetrics() {
       }
     } catch {}
     _sysMetricsCache = {
-      cpu: { utilization: Math.min(100, Math.round((loads[0] / cores) * 100)), cores: cores, model: cpuModel },
-      memory: { utilization: Math.round((usedMem / totalMem) * 100), totalGB: Math.round((totalMem / (1024*1024*1024)) * 10) / 10, usedGB: Math.round((usedMem / (1024*1024*1024)) * 10) / 10 },
-      gpu: gpuInfo,
+	      cpu: { utilization: Math.min(100, Math.round((loads[0] / cores) * 100)), cores: cores, model: cpuModel },
+	      memory: { utilization: Math.round((usedMem / totalMem) * 100), totalGB: Math.round((totalMem / (1024*1024*1024)) * 10) / 10, usedGB: Math.round((usedMem / (1024*1024*1024)) * 10) / 10 },
+	      disk: diskInfo,
+	      gpu: gpuInfo,
       timestamp: new Date().toISOString(),
     };
     _sysMetricsCacheTs = now;
@@ -12235,7 +12341,9 @@ async function handleCmd(cmd) {
             });
           }
         } catch {}
-        var sponsorData = {
+	        var sponsorLimitsArg = {};
+	        try { sponsorLimitsArg = args.limits ? JSON.parse(args.limits) : {}; } catch {}
+	        var sponsorData = {
           type: 'sponsor.announce',
           peerId: (connected ? nexus.peerId : 'unknown') || 'unknown',
           libp2pPeerId: (connected ? nexus.peerId : '') || '',
@@ -12244,10 +12352,11 @@ async function handleCmd(cmd) {
           modelDetails: _saModelDetails, // NX-07: per-model capacity
           tunnelUrl: args.tunnel_url || null,
           authKey: args.auth_key || '',
-          limits: {
-            maxRequestsPerMinute: parseInt(args.rpm || '60', 10),
-            maxTokensPerDay: parseInt(args.tpd || '100000', 10),
-          },
+	          limits: {
+	            maxRequestsPerMinute: parseInt(args.rpm || sponsorLimitsArg.maxRequestsPerMinute || '60', 10),
+	            maxTokensPerDay: parseInt(args.tpd || sponsorLimitsArg.maxTokensPerDay || '100000', 10),
+	            maxConcurrent: parseInt(args.max_concurrent || sponsorLimitsArg.maxConcurrent || '1', 10),
+	          },
           banner: args.banner || null,
           message: args.message || '',
           linkUrl: args.link_url || '',
@@ -12262,13 +12371,14 @@ async function handleCmd(cmd) {
 
         // Persist to KV-backed sponsor directory (omnius.nexus worker)
         try {
-          var kvResp = await fetch('https://omnius.nexus/api/v1/sponsors', {
-            method: 'POST',
-            headers: { 'Content-Type': 'application/json' },
-            body: JSON.stringify(sponsorData),
-          });
-          var kvResult = await kvResp.json();
-          dlog('sponsor_announce: KV persist ' + (kvResult.persisted ? 'OK' : 'skipped: ' + kvResult.reason));
+	          var kvResp = await fetch('https://omnius.nexus/api/v1/sponsors', {
+	            method: 'POST',
+	            headers: { 'Content-Type': 'application/json' },
+	            body: JSON.stringify(sponsorData),
+	          });
+	          var kvText = await kvResp.text();
+	          var kvResult = kvText.trim() ? JSON.parse(kvText) : { persisted: false, reason: 'empty directory response' };
+	          dlog('sponsor_announce: KV persist ' + (kvResult.persisted ? 'OK' : 'skipped: ' + kvResult.reason));
         } catch (kvErr) {
           dlog('sponsor_announce: KV persist failed: ' + (kvErr.message || kvErr));
         }
@@ -12388,11 +12498,12 @@ async function handleCmd(cmd) {
 
         // ── Source 1: KV-backed persistent directory (MOST RELIABLE) ──
         // Query the omnius.nexus worker for persisted sponsor listings
-        try {
-          var kvResp = await fetch('https://omnius.nexus/api/v1/sponsors', { signal: AbortSignal.timeout(5000) });
-          if (kvResp.ok) {
-            var kvData = await kvResp.json();
-            var kvSponsors = kvData.sponsors || [];
+	        try {
+	          var kvResp = await fetch('https://omnius.nexus/api/v1/sponsors', { signal: AbortSignal.timeout(5000) });
+	          if (kvResp.ok) {
+	            var kvText = await kvResp.text();
+	            var kvData = kvText.trim() ? JSON.parse(kvText) : { sponsors: [] };
+	            var kvSponsors = kvData.sponsors || [];
             for (var ki = 0; ki < kvSponsors.length; ki++) {
               var kvSp = kvSponsors[ki];
               if (kvSp.status === 'active') {
@@ -13433,6 +13544,28 @@ async function handleCmd(cmd) {
           dlog('expose: auth key configured (' + exposeAuthKey.length + ' chars)');
         }
 
+        var sponsorMaxConcurrent = parseInt(args.max_concurrent || '0', 10);
+        var sponsorMaxRequestsPerMinute = parseInt(args.max_requests_per_minute || '0', 10);
+	        var sponsorMaxTokensPerDay = parseInt(args.max_tokens_per_day || '0', 10);
+	        var sponsorAllowedModelsArg = args.allowed_models || '';
+	        if (sponsorMaxConcurrent > 0 || sponsorMaxRequestsPerMinute > 0 || sponsorMaxTokensPerDay > 0) {
+	          var sponsorDailyUsed = parseInt(args.daily_tokens_used || '0', 10);
+	          var sponsorDailyResetAt = parseInt(args.daily_tokens_reset_at || '0', 10);
+	          _sponsorDailyTokensUsed = Number.isFinite(sponsorDailyUsed) && sponsorDailyUsed > 0 ? sponsorDailyUsed : 0;
+	          _sponsorDailyResetAt = Number.isFinite(sponsorDailyResetAt) && sponsorDailyResetAt > Date.now() ? sponsorDailyResetAt : Date.now() + 86400000;
+	          _sponsorLimits = {
+            maxConcurrent: sponsorMaxConcurrent > 0 ? sponsorMaxConcurrent : 1,
+            maxRequestsPerMinute: sponsorMaxRequestsPerMinute > 0 ? sponsorMaxRequestsPerMinute : 1,
+            maxTokensPerDay: sponsorMaxTokensPerDay > 0 ? sponsorMaxTokensPerDay : 1,
+            allowedModels: sponsorAllowedModelsArg && sponsorAllowedModelsArg !== 'all'
+              ? sponsorAllowedModelsArg.split(',').filter(Boolean)
+              : 'all',
+          };
+          dlog('expose: sponsor limits active concurrent=' + _sponsorLimits.maxConcurrent + ' rpm=' + _sponsorLimits.maxRequestsPerMinute + ' tpd=' + _sponsorLimits.maxTokensPerDay);
+        } else {
+          _sponsorLimits = null;
+        }
+
         // Passthrough mode: forward from a remote /endpoint (Chutes, Groq, etc.)
         var isPassthrough = args.passthrough === 'true';
         var endpointAuth = args.endpoint_auth || '';
@@ -13500,6 +13633,11 @@ async function handleCmd(cmd) {
           }
         }
 
+        if (_sponsorLimits && _sponsorLimits.allowedModels !== 'all') {
+          models = models.filter(function(m) { return _sponsorLimits.allowedModels.indexOf(m.name) !== -1; });
+          dlog('expose: sponsor allowlist filtered models to ' + models.length);
+        }
+
         if (models.length === 0) {
           writeResp(id, { ok: false, output: isPassthrough ? 'No models found on upstream endpoint.' : 'No models found on Ollama. Pull a model first.' });
           return;
@@ -13646,12 +13784,46 @@ async function handleCmd(cmd) {
                 dlog('expose: auth OK for ' + capName);
               }
 
-              // Forward to Ollama — supports both flat prompt and structured messages
-              try {
-                var parsedReq = null;
-                try { parsedReq = JSON.parse(prompt); } catch (pe) { dlog('expose: JSON parse error: ' + (pe.message || pe)); }
-
-                var genResp, genData, output, inputTokens, outputTokens, responsePayload;
+	              // Forward to Ollama — supports both flat prompt and structured messages
+	              var sponsorAdmissionOpen = false;
+	              try {
+	                var parsedReq = null;
+	                try { parsedReq = JSON.parse(prompt); } catch (pe) { dlog('expose: JSON parse error: ' + (pe.message || pe)); }
+
+	                var sponsorAdmission = _sponsorAdmit(model.name);
+	                if (!sponsorAdmission.ok) {
+	                  dlog('expose: sponsor limit rejected ' + capName + ' from ' + (request.from || 'unknown') + ': ' + sponsorAdmission.reason);
+	                  await swrite({
+	                    type: 'invoke.event', version: 1,
+	                    requestId: request.requestId, seq: 0,
+	                    event: 'error', data: sponsorAdmission.reason,
+	                  });
+	                  await swrite({
+	                    type: 'invoke.done', version: 1,
+	                    requestId: request.requestId,
+	                    usage: { inputBytes: 0, outputBytes: 0 },
+	                  });
+	                  try {
+	                    appendFileSync(meteringFile, JSON.stringify({
+	                      timestamp: Date.now(),
+	                      peerId: request.from || 'unknown',
+	                      service: capName,
+	                      capability: capName,
+	                      model: model.name,
+	                      direction: 'inbound',
+	                      blocked: true,
+	                      reason: sponsorAdmission.reason,
+	                      inputTokens: 0,
+	                      outputTokens: 0,
+	                      tokens: 0,
+	                    }) + '\\n');
+	                  } catch {}
+	                  try { stream.close(); } catch {}
+	                  return;
+	                }
+	                sponsorAdmissionOpen = true;
+
+	                var genResp, genData, output, inputTokens, outputTokens, responsePayload;
 
                 // Detect if requester wants streaming (outputMode from invoke.open)
                 var wantsStream = request.outputMode === 'stream';
@@ -13708,9 +13880,10 @@ async function handleCmd(cmd) {
                           var sseObj = JSON.parse(sseData);
                           var sseDelta = (sseObj.choices && sseObj.choices[0] && sseObj.choices[0].delta) || {};
                           var sseToken = sseDelta.content || '';
-                          if (sseToken) {
-                            sseContent += sseToken;
-                            await swrite({
+	                          if (sseToken) {
+	                            sseContent += sseToken;
+	                            _sponsorRecordTokenRate(_sponsorEstimateTokens(sseToken));
+	                            await swrite({
                               type: 'invoke.event', version: 1,
                               requestId: request.requestId, seq: sseSeq++,
                               event: 'token', data: sseToken,
@@ -13839,12 +14012,14 @@ async function handleCmd(cmd) {
 
                 // Attach system metrics to response — clients get CPU/GPU/RAM
                 // for free without a separate invoke_capability round-trip
-                try {
-                  var _sm = await _collectSysMetrics();
-                  if (_sm) responsePayload.system = _sm;
-                } catch {}
+	                try {
+	                  var _sm = await _collectSysMetrics();
+	                  if (_sm) responsePayload.system = Object.assign({}, _sm, { gateway: _sponsorGatewaySnapshot() });
+	                } catch {}
+
+	                _sponsorRecordUsage(inputTokens, outputTokens, !wantsStream);
 
-                // Stream result back
+	                // Stream result back
                 await swrite({
                   type: 'invoke.event', version: 1,
                   requestId: request.requestId, seq: 0,
@@ -13882,10 +14057,12 @@ async function handleCmd(cmd) {
                 await swrite({
                   type: 'invoke.done', version: 1,
                   requestId: request.requestId,
-                  usage: { inputBytes: 0, outputBytes: 0 },
-                });
-              }
-              try { stream.close(); } catch {}
+	                  usage: { inputBytes: 0, outputBytes: 0 },
+	                });
+	              } finally {
+	                if (sponsorAdmissionOpen) _sponsorRelease();
+	              }
+	              try { stream.close(); } catch {}
             }, capOpts);
           }
         }
@@ -13948,10 +14125,22 @@ async function handleCmd(cmd) {
               var os = await import('node:os');
               var loads = os.loadavg();
               var cores = os.cpus().length;
-              var totalMem = os.totalmem();
-              var freeMem = os.freemem();
-              var usedMem = totalMem - freeMem;
-              var gpuInfo = { available: false, name: '', utilization: 0, vramUsedMB: 0, vramTotalMB: 0, vramUtilization: 0 };
+	              var totalMem = os.totalmem();
+	              var freeMem = os.freemem();
+	              var usedMem = totalMem - freeMem;
+	              var gpuInfo = { available: false, name: '', utilization: 0, vramUsedMB: 0, vramTotalMB: 0, vramUtilization: 0 };
+	              var diskInfo = { path: process.cwd(), totalGB: 0, freeGB: 0, usedGB: 0, utilization: -1 };
+	              try {
+	                var fs = await import('node:fs');
+	                var st = fs.statfsSync(process.cwd());
+	                var totalBytes = Number(st.blocks) * Number(st.bsize);
+	                var freeBytes = Number(st.bavail) * Number(st.bsize);
+	                var usedBytes = Math.max(0, totalBytes - freeBytes);
+	                diskInfo.totalGB = Math.round((totalBytes / (1024*1024*1024)) * 10) / 10;
+	                diskInfo.freeGB = Math.round((freeBytes / (1024*1024*1024)) * 10) / 10;
+	                diskInfo.usedGB = Math.round((usedBytes / (1024*1024*1024)) * 10) / 10;
+	                diskInfo.utilization = totalBytes > 0 ? Math.round((usedBytes / totalBytes) * 100) : -1;
+	              } catch {}
               try {
                 var cp = await import('node:child_process');
                 var smiOut = cp.execSync('nvidia-smi --query-gpu=utilization.gpu,memory.used,memory.total,name --format=csv,noheader,nounits 2>/dev/null', { encoding: 'utf8', timeout: 3000 });
@@ -13968,12 +14157,14 @@ async function handleCmd(cmd) {
               } catch (ge) { /* no GPU */ }
               var cpuModel = '';
               try { var cpuInfoArr = os.cpus(); if (cpuInfoArr.length > 0) cpuModel = cpuInfoArr[0].model || ''; } catch {}
-              var metricsPayload = {
-                cpu: { utilization: Math.min(100, Math.round((loads[0] / cores) * 100)), cores: cores, model: cpuModel },
-                memory: { utilization: Math.round((usedMem / totalMem) * 100), totalGB: Math.round((totalMem / (1024*1024*1024)) * 10) / 10, usedGB: Math.round((usedMem / (1024*1024*1024)) * 10) / 10 },
-                gpu: gpuInfo,
-                timestamp: new Date().toISOString(),
-              };
+	              var metricsPayload = {
+	                cpu: { utilization: Math.min(100, Math.round((loads[0] / cores) * 100)), cores: cores, model: cpuModel },
+	                memory: { utilization: Math.round((usedMem / totalMem) * 100), totalGB: Math.round((totalMem / (1024*1024*1024)) * 10) / 10, usedGB: Math.round((usedMem / (1024*1024*1024)) * 10) / 10 },
+	                disk: diskInfo,
+	                gpu: gpuInfo,
+	                gateway: _sponsorGatewaySnapshot(),
+	                timestamp: new Date().toISOString(),
+	              };
               await smWrite({ type: 'invoke.event', version: 1, requestId: request.requestId, seq: 0, event: 'result', data: JSON.stringify(metricsPayload) });
               await smWrite({ type: 'invoke.done', version: 1, requestId: request.requestId, usage: { inputBytes: 0, outputBytes: JSON.stringify(metricsPayload).length } });
             } catch (me) {
@@ -18106,7 +18297,8 @@ ${earlyError ? "\n" + earlyError : ""}${earlyOutput ? "\n" + earlyOutput : ""}`;
           model,
           target_peer: args.target_peer,
           temperature: args.temperature,
-          max_tokens: args.max_tokens
+          max_tokens: args.max_tokens,
+          auth_key: args.auth_key
         };
         if (args.messages) {
           daemonArgs.messages = args.messages;
@@ -124372,7 +124564,7 @@ var require_client_h1 = __commonJS({
       kHTTPContext,
       kClosed
     } = require_symbols();
-    var constants = require_constants2();
+    var constants2 = require_constants2();
     var EMPTY_BUF = Buffer.alloc(0);
     var FastBuffer = Buffer[Symbol.species];
     var removeAllListeners = util2.removeAllListeners;
@@ -124498,7 +124690,7 @@ var require_client_h1 = __commonJS({
          */
       constructor(client, socket, { exports: exports2 }) {
         this.llhttp = exports2;
-        this.ptr = this.llhttp.llhttp_alloc(constants.TYPE.RESPONSE);
+        this.ptr = this.llhttp.llhttp_alloc(constants2.TYPE.RESPONSE);
         this.client = client;
         this.socket = socket;
         this.timeout = null;
@@ -124593,11 +124785,11 @@ var require_client_h1 = __commonJS({
             currentParser = null;
             currentBufferRef = null;
           }
-          if (ret !== constants.ERROR.OK) {
+          if (ret !== constants2.ERROR.OK) {
             const data = chunk.subarray(llhttp.llhttp_get_error_pos(this.ptr) - currentBufferPtr);
-            if (ret === constants.ERROR.PAUSED_UPGRADE) {
+            if (ret === constants2.ERROR.PAUSED_UPGRADE) {
               this.onUpgrade(data);
-            } else if (ret === constants.ERROR.PAUSED) {
+            } else if (ret === constants2.ERROR.PAUSED) {
               this.paused = true;
               socket.unshift(data);
             } else {
@@ -124607,7 +124799,7 @@ var require_client_h1 = __commonJS({
                 const len = new Uint8Array(llhttp.memory.buffer, ptr).indexOf(0);
                 message2 = "Response does not match the HTTP/1.1 protocol (" + Buffer.from(llhttp.memory.buffer, ptr, len).toString() + ")";
               }
-              throw new HTTPParserError(message2, constants.ERROR[ret], data);
+              throw new HTTPParserError(message2, constants2.ERROR[ret], data);
             }
           }
         } catch (err) {
@@ -124814,7 +125006,7 @@ var require_client_h1 = __commonJS({
           socket[kBlocking] = false;
           client[kResume]();
         }
-        return pause ? constants.ERROR.PAUSED : 0;
+        return pause ? constants2.ERROR.PAUSED : 0;
       }
       /**
        * @param {Buffer} buf
@@ -124840,7 +125032,7 @@ var require_client_h1 = __commonJS({
         }
         this.bytesRead += buf.length;
         if (request.onData(buf) === false) {
-          return constants.ERROR.PAUSED;
+          return constants2.ERROR.PAUSED;
         }
         return 0;
       }
@@ -124879,13 +125071,13 @@ var require_client_h1 = __commonJS({
         if (socket[kWriting]) {
           assert(client[kRunning] === 0);
           util2.destroy(socket, new InformationalError("reset"));
-          return constants.ERROR.PAUSED;
+          return constants2.ERROR.PAUSED;
         } else if (!shouldKeepAlive) {
           util2.destroy(socket, new InformationalError("reset"));
-          return constants.ERROR.PAUSED;
+          return constants2.ERROR.PAUSED;
         } else if (socket[kReset] && client[kRunning] === 0) {
           util2.destroy(socket, new InformationalError("reset"));
-          return constants.ERROR.PAUSED;
+          return constants2.ERROR.PAUSED;
         } else if (client[kPipelining] == null || client[kPipelining] === 1) {
           setImmediate(client[kResume]);
         } else {
@@ -247747,7 +247939,7 @@ var require_scan = __commonJS({
 var require_parse3 = __commonJS({
   "../node_modules/picomatch/lib/parse.js"(exports, module) {
     "use strict";
-    var constants = require_constants8();
+    var constants2 = require_constants8();
     var utils = require_utils4();
     var {
       MAX_LENGTH,
@@ -247755,7 +247947,7 @@ var require_parse3 = __commonJS({
       REGEX_NON_SPECIAL_CHARS,
       REGEX_SPECIAL_CHARS_BACKREF,
       REPLACEMENTS
-    } = constants;
+    } = constants2;
     var expandRange = (args, options2) => {
       if (typeof options2.expandRange === "function") {
         return options2.expandRange(...args, options2);
@@ -247961,7 +248153,7 @@ var require_parse3 = __commonJS({
       if (options2.maxExtglobRecursion === false) {
         return { risky: false };
       }
-      const max = typeof options2.maxExtglobRecursion === "number" ? options2.maxExtglobRecursion : constants.DEFAULT_MAX_EXTGLOB_RECURSION;
+      const max = typeof options2.maxExtglobRecursion === "number" ? options2.maxExtglobRecursion : constants2.DEFAULT_MAX_EXTGLOB_RECURSION;
       const branches = splitTopLevel(body).map((branch) => branch.trim());
       if (branches.length > 1) {
         if (branches.some((branch) => branch === "") || branches.some((branch) => /^[*?]+$/.test(branch)) || hasRepeatedCharPrefixOverlap(branches)) {
@@ -247994,8 +248186,8 @@ var require_parse3 = __commonJS({
       const tokens = [bos];
       const capture = opts.capture ? "" : "?:";
       const win32 = utils.isWindows(options2);
-      const PLATFORM_CHARS = constants.globChars(win32);
-      const EXTGLOB_CHARS = constants.extglobChars(PLATFORM_CHARS);
+      const PLATFORM_CHARS = constants2.globChars(win32);
+      const EXTGLOB_CHARS = constants2.extglobChars(PLATFORM_CHARS);
       const {
         DOT_LITERAL,
         PLUS_LITERAL,
@@ -248694,7 +248886,7 @@ var require_parse3 = __commonJS({
         NO_DOTS_SLASH,
         STAR,
         START_ANCHOR
-      } = constants.globChars(win32);
+      } = constants2.globChars(win32);
       const nodot = opts.dot ? NO_DOTS : NO_DOT;
       const slashDot = opts.dot ? NO_DOTS_SLASH : NO_DOT;
       const capture = opts.capture ? "" : "?:";
@@ -248753,7 +248945,7 @@ var require_picomatch = __commonJS({
     var scan = require_scan();
     var parse3 = require_parse3();
     var utils = require_utils4();
-    var constants = require_constants8();
+    var constants2 = require_constants8();
     var isObject = (val) => val && typeof val === "object" && !Array.isArray(val);
     var picomatch = (glob3, options2, returnState = false) => {
       if (Array.isArray(glob3)) {
@@ -248881,7 +249073,7 @@ var require_picomatch = __commonJS({
         return /$^/;
       }
     };
-    picomatch.constants = constants;
+    picomatch.constants = constants2;
     module.exports = picomatch;
   }
 });
@@ -486496,7 +486688,7 @@ var require_scan2 = __commonJS({
 var require_parse4 = __commonJS({
   "node_modules/.pnpm/picomatch@4.0.4/node_modules/picomatch/lib/parse.js"(exports, module) {
     "use strict";
-    var constants = require_constants10();
+    var constants2 = require_constants10();
     var utils = require_utils7();
     var {
       MAX_LENGTH,
@@ -486504,7 +486696,7 @@ var require_parse4 = __commonJS({
       REGEX_NON_SPECIAL_CHARS,
       REGEX_SPECIAL_CHARS_BACKREF,
       REPLACEMENTS
-    } = constants;
+    } = constants2;
     var expandRange = (args, options2) => {
       if (typeof options2.expandRange === "function") {
         return options2.expandRange(...args, options2);
@@ -486710,7 +486902,7 @@ var require_parse4 = __commonJS({
       if (options2.maxExtglobRecursion === false) {
         return { risky: false };
       }
-      const max = typeof options2.maxExtglobRecursion === "number" ? options2.maxExtglobRecursion : constants.DEFAULT_MAX_EXTGLOB_RECURSION;
+      const max = typeof options2.maxExtglobRecursion === "number" ? options2.maxExtglobRecursion : constants2.DEFAULT_MAX_EXTGLOB_RECURSION;
       const branches = splitTopLevel(body).map((branch) => branch.trim());
       if (branches.length > 1) {
         if (branches.some((branch) => branch === "") || branches.some((branch) => /^[*?]+$/.test(branch)) || hasRepeatedCharPrefixOverlap(branches)) {
@@ -486742,8 +486934,8 @@ var require_parse4 = __commonJS({
       const bos = { type: "bos", value: "", output: opts.prepend || "" };
       const tokens = [bos];
       const capture = opts.capture ? "" : "?:";
-      const PLATFORM_CHARS = constants.globChars(opts.windows);
-      const EXTGLOB_CHARS = constants.extglobChars(PLATFORM_CHARS);
+      const PLATFORM_CHARS = constants2.globChars(opts.windows);
+      const EXTGLOB_CHARS = constants2.extglobChars(PLATFORM_CHARS);
       const {
         DOT_LITERAL,
         PLUS_LITERAL,
@@ -487438,7 +487630,7 @@ var require_parse4 = __commonJS({
         NO_DOTS_SLASH,
         STAR,
         START_ANCHOR
-      } = constants.globChars(opts.windows);
+      } = constants2.globChars(opts.windows);
       const nodot = opts.dot ? NO_DOTS : NO_DOT;
       const slashDot = opts.dot ? NO_DOTS_SLASH : NO_DOT;
       const capture = opts.capture ? "" : "?:";
@@ -487496,7 +487688,7 @@ var require_picomatch3 = __commonJS({
     var scan = require_scan2();
     var parse3 = require_parse4();
     var utils = require_utils7();
-    var constants = require_constants10();
+    var constants2 = require_constants10();
     var isObject = (val) => val && typeof val === "object" && !Array.isArray(val);
     var picomatch = (glob3, options2, returnState = false) => {
       if (Array.isArray(glob3)) {
@@ -487624,7 +487816,7 @@ var require_picomatch3 = __commonJS({
         return /$^/;
       }
     };
-    picomatch.constants = constants;
+    picomatch.constants = constants2;
     module.exports = picomatch;
   }
 });
@@ -515946,7 +516138,7 @@ Saved to: ${tempFile}`,
 
 // packages/execution/dist/tools/audio-playback.js
 import { execFileSync as execFileSync5, execSync as execSync30, spawn as spawn16 } from "node:child_process";
-import { copyFileSync as copyFileSync3, existsSync as existsSync44, statSync as statSync22, writeFileSync as writeFileSync18, mkdirSync as mkdirSync19, readdirSync as readdirSync17 } from "node:fs";
+import { copyFileSync as copyFileSync3, existsSync as existsSync44, statSync as statSync22, writeFileSync as writeFileSync18, mkdirSync as mkdirSync19, readdirSync as readdirSync17, writeSync } from "node:fs";
 import { basename as basename14, extname as extname10, isAbsolute as isAbsolute2, join as join61 } from "node:path";
 import { homedir as homedir16, tmpdir as tmpdir11 } from "node:os";
 function hasCommand3(command) {
@@ -516208,6 +516400,12 @@ function pythonCanImportLuxTts(venvPy) {
     return false;
   }
 }
+function commandErrorText(err) {
+  const anyErr = err;
+  const stdout = anyErr?.stdout ? String(anyErr.stdout).trim() : "";
+  const stderr = anyErr?.stderr ? String(anyErr.stderr).trim() : "";
+  return [anyErr?.message ?? String(err), stderr, stdout].filter(Boolean).join("\n").slice(0, 1800);
+}
 function pipInstall(venvPy, packages, timeout2 = 9e5) {
   execFileSync5(venvPy, ["-m", "pip", "install", "--prefer-binary", ...packages], {
     stdio: "pipe",
@@ -516215,9 +516413,133 @@ function pipInstall(venvPy, packages, timeout2 = 9e5) {
     env: process.env
   });
 }
+function withVisibleElevationPrompt(reason, run2) {
+  const hasInteractiveTty = Boolean(process.stdin.isTTY && process.stdout.isTTY);
+  if (!hasInteractiveTty)
+    return run2();
+  const stdinAny = process.stdin;
+  const hadRaw = Boolean(stdinAny.isTTY && stdinAny.isRaw);
+  try {
+    stdinAny.setRawMode?.(false);
+  } catch {
+  }
+  writeSync(1, "\x1B[?2026l\x1B[?25h\x1B[?1000l\x1B[?1002l\x1B[?1003l\x1B[?1006l\x1B[r\x1B[0m\x1B[2J\x1B[H");
+  writeSync(1, `Omnius needs administrator privileges
+${reason}
+
+`);
+  try {
+    return run2();
+  } finally {
+    try {
+      stdinAny.setRawMode?.(hadRaw);
+    } catch {
+    }
+    writeSync(1, "\x1B[?2026l\x1B[?25h\x1B[r\x1B[0m\x1B[2J\x1B[H");
+  }
+}
+function runPrivilegedInstall(command, args) {
+  const isRoot = typeof process.getuid === "function" && process.getuid() === 0;
+  if (isRoot) {
+    execFileSync5(command, args, { stdio: "pipe", timeout: 6e5 });
+    return;
+  }
+  if (!hasCommand3("sudo")) {
+    throw new Error("sudo is not installed and this process is not running as root");
+  }
+  const hasInteractiveTty = Boolean(process.stdin.isTTY && process.stdout.isTTY);
+  if (hasInteractiveTty) {
+    withVisibleElevationPrompt(`Installing LuxTTS system build dependencies with ${command}.`, () => {
+      execFileSync5("sudo", ["-v"], { stdio: "inherit", timeout: 12e4 });
+      execFileSync5("sudo", [command, ...args], { stdio: "inherit", timeout: 6e5 });
+    });
+    return;
+  }
+  execFileSync5("sudo", ["-n", command, ...args], { stdio: "pipe", timeout: 6e5 });
+}
+function installLuxttsSystemDepsBestEffort() {
+  if (process.env["OMNIUS_VOICE_AUTO_SYSTEM_DEPS"] === "0") {
+    return "system dependency install disabled by OMNIUS_VOICE_AUTO_SYSTEM_DEPS=0";
+  }
+  try {
+    if (process.platform === "darwin") {
+      if (!hasCommand3("brew"))
+        return "Homebrew not found; cannot install macOS LuxTTS build dependencies automatically";
+      execFileSync5("brew", ["install", "llvm", "gcc", "openblas", "libsndfile"], { stdio: "inherit", timeout: 6e5 });
+      return "installed macOS LuxTTS build dependencies with brew";
+    }
+    if (process.platform !== "linux") {
+      return `automatic system dependency install is unsupported on ${process.platform}`;
+    }
+    if (hasCommand3("apt-get")) {
+      runPrivilegedInstall("apt-get", ["install", "-y", "--no-install-recommends", "git", "build-essential", "llvm-dev", "gcc", "g++", "gfortran", "libopenblas-dev", "libsndfile1-dev", "python3-dev"]);
+      return "installed Linux LuxTTS build dependencies with apt-get";
+    }
+    if (hasCommand3("dnf")) {
+      runPrivilegedInstall("dnf", ["install", "-y", "git", "gcc", "gcc-c++", "gcc-gfortran", "llvm-devel", "openblas-devel", "libsndfile-devel", "python3-devel"]);
+      return "installed Linux LuxTTS build dependencies with dnf";
+    }
+    if (hasCommand3("yum")) {
+      runPrivilegedInstall("yum", ["install", "-y", "git", "gcc", "gcc-c++", "gcc-gfortran", "llvm-devel", "openblas-devel", "libsndfile-devel", "python3-devel"]);
+      return "installed Linux LuxTTS build dependencies with yum";
+    }
+    if (hasCommand3("pacman")) {
+      runPrivilegedInstall("pacman", ["-S", "--needed", "--noconfirm", "git", "base-devel", "llvm", "openblas", "libsndfile", "python"]);
+      return "installed Linux LuxTTS build dependencies with pacman";
+    }
+    if (hasCommand3("zypper")) {
+      runPrivilegedInstall("zypper", ["--non-interactive", "install", "git", "gcc", "gcc-c++", "gcc-fortran", "llvm-devel", "openblas-devel", "libsndfile-devel", "python3-devel"]);
+      return "installed Linux LuxTTS build dependencies with zypper";
+    }
+    return "no supported Linux package manager found for automatic LuxTTS system dependency install";
+  } catch (err) {
+    return `system dependency install skipped/failed: ${commandErrorText(err)}`;
+  }
+}
+function runLuxttsInstallStep(venvPy, step, notes2) {
+  try {
+    pipInstall(venvPy, step.args, step.timeout ?? 9e5);
+    return;
+  } catch (firstErr) {
+    if (step.retryWithSystemDeps) {
+      notes2.push(`${step.label}: pip failed; attempting system dependency triage`);
+      notes2.push(installLuxttsSystemDepsBestEffort());
+      try {
+        pipInstall(venvPy, step.args, step.timeout ?? 9e5);
+        return;
+      } catch (retryErr) {
+        notes2.push(`${step.label}: retry failed: ${commandErrorText(retryErr)}`);
+      }
+    }
+    if (!step.fatal) {
+      notes2.push(`${step.label}: optional install skipped: ${commandErrorText(firstErr)}`);
+      return;
+    }
+    throw new Error(`Failed to install LuxTTS dependency step '${step.label}': ${commandErrorText(firstErr)}${notes2.length ? `
+Triage:
+- ${notes2.join("\n- ")}` : ""}`);
+  }
+}
+function collectLuxttsDiagnostics(venvPy, repoDir) {
+  const lines = [];
+  try {
+    lines.push(execFileSync5(venvPy, ["-V"], { encoding: "utf8", timeout: 5e3 }).trim());
+  } catch {
+  }
+  try {
+    lines.push(execFileSync5(venvPy, ["-m", "pip", "--version"], { encoding: "utf8", timeout: 5e3 }).trim());
+  } catch {
+  }
+  try {
+    lines.push(`platform=${process.platform} arch=${process.arch} repo=${repoDir}`);
+  } catch {
+  }
+  return lines.join("\n");
+}
 function ensureLuxttsInstalled() {
   const venvPy = luxttsVenvPy();
   const repoDir = luxttsRepoDir();
+  const notes2 = [];
   mkdirSync19(voiceDir(), { recursive: true });
   if (existsSync44(venvPy) && existsSync44(join61(repoDir, "zipvoice", "luxvoice.py")) && pythonCanImportLuxTts(venvPy)) {
     writeFileSync18(luxttsInferScript(), LUXTTS_DAEMON_PY, "utf-8");
@@ -516233,7 +516555,6 @@ function ensureLuxttsInstalled() {
     stdio: "pipe",
     timeout: 3e5
   });
-  pipInstall(venvPy, ["torch", "torchaudio"], 12e5);
   if (!existsSync44(join61(repoDir, "zipvoice", "luxvoice.py"))) {
     if (!hasCommand3("git"))
       throw new Error("git is required to set up LuxTTS voice cloning.");
@@ -516242,29 +516563,50 @@ function ensureLuxttsInstalled() {
       timeout: 3e5
     });
   }
-  pipInstall(venvPy, [
-    "lhotse",
-    "huggingface_hub",
-    "safetensors",
-    "pydub",
-    "onnxruntime",
-    "librosa",
-    "transformers<=4.57.6",
-    "inflect",
-    "numpy",
-    "vocos",
-    "jieba",
-    "pypinyin",
-    "cn2an"
-  ], 12e5);
-  try {
-    pipInstall(venvPy, ["git+https://github.com/ysharma3501/LinaCodec.git"], 12e5);
-  } catch {
+  const isArm = process.arch === "arm64" || process.arch === "arm";
+  const installSteps = isArm ? [
+    { label: "PyTorch", args: ["torch", "torchaudio"], fatal: true, timeout: 12e5 },
+    { label: "numpy", args: ["numpy"], fatal: true },
+    { label: "huggingface_hub + safetensors", args: ["huggingface_hub", "safetensors"], fatal: true },
+    { label: "transformers", args: ["transformers<=4.57.6"], fatal: true },
+    { label: "pydub + inflect", args: ["pydub", "inflect"], fatal: true },
+    { label: "llvmlite", args: ["llvmlite"], fatal: false, retryWithSystemDeps: true },
+    { label: "numba", args: ["numba"], fatal: false, retryWithSystemDeps: true },
+    { label: "librosa", args: ["librosa"], fatal: true, retryWithSystemDeps: true },
+    { label: "lhotse", args: ["lhotse"], fatal: true, retryWithSystemDeps: true },
+    { label: "vocos", args: ["vocos"], fatal: true, retryWithSystemDeps: true },
+    { label: "LinaCodec", args: ["git+https://github.com/ysharma3501/LinaCodec.git"], fatal: true, retryWithSystemDeps: true, timeout: 12e5 },
+    { label: "piper-phonemize (optional)", args: ["piper-phonemize", "--find-links", "https://k2-fsa.github.io/icefall/piper_phonemize.html"], fatal: false, timeout: 6e5 },
+    { label: "Chinese text processing", args: ["jieba", "pypinyin", "cn2an"], fatal: true },
+    { label: "LuxTTS editable install", args: ["--no-deps", "-e", repoDir], fatal: true, timeout: 6e5 }
+  ] : [
+    { label: "PyTorch", args: ["torch", "torchaudio"], fatal: true, timeout: 12e5 },
+    { label: "core LuxTTS deps", args: ["lhotse", "huggingface_hub", "safetensors", "pydub", "onnxruntime", "librosa", "transformers<=4.57.6", "inflect", "numpy", "vocos", "setuptools<81"], fatal: true, retryWithSystemDeps: true, timeout: 12e5 },
+    { label: "piper-phonemize (optional)", args: ["piper-phonemize", "--find-links", "https://k2-fsa.github.io/icefall/piper_phonemize.html"], fatal: false, timeout: 6e5 },
+    { label: "Chinese text processing", args: ["jieba", "pypinyin", "cn2an"], fatal: true },
+    { label: "LinaCodec", args: ["git+https://github.com/ysharma3501/LinaCodec.git"], fatal: false, retryWithSystemDeps: true, timeout: 12e5 },
+    { label: "LuxTTS editable install", args: ["--no-deps", "-e", repoDir], fatal: true, timeout: 6e5 }
+  ];
+  for (const step of installSteps) {
+    runLuxttsInstallStep(venvPy, step, notes2);
   }
-  pipInstall(venvPy, ["-e", repoDir], 6e5);
   writeFileSync18(luxttsInferScript(), LUXTTS_DAEMON_PY, "utf-8");
   if (!pythonCanImportLuxTts(venvPy)) {
-    throw new Error(`LuxTTS setup completed but import still fails in ${luxttsVenvDir()}.`);
+    notes2.push("LuxTTS import failed after dependency install; retrying source/build dependencies once");
+    notes2.push(installLuxttsSystemDepsBestEffort());
+    try {
+      pipInstall(venvPy, ["git+https://github.com/ysharma3501/LinaCodec.git"], 12e5);
+      pipInstall(venvPy, ["--no-deps", "-e", repoDir], 6e5);
+    } catch (err) {
+      notes2.push(`final repair install failed: ${commandErrorText(err)}`);
+    }
+  }
+  if (!pythonCanImportLuxTts(venvPy)) {
+    throw new Error(`LuxTTS setup completed but import still fails in ${luxttsVenvDir()}.
+Diagnostics:
+${collectLuxttsDiagnostics(venvPy, repoDir)}
+Triage:
+- ${notes2.join("\n- ")}`);
   }
   return venvPy;
 }
@@ -561535,7 +561877,7 @@ __export(listen_exports, {
   waitForTranscribeCli: () => waitForTranscribeCli
 });
 import { spawn as spawn24, execSync as execSync47 } from "node:child_process";
-import { existsSync as existsSync87, mkdirSync as mkdirSync48, writeFileSync as writeFileSync43, readdirSync as readdirSync28 } from "node:fs";
+import { accessSync, constants, existsSync as existsSync87, mkdirSync as mkdirSync48, writeFileSync as writeFileSync43, readdirSync as readdirSync28 } from "node:fs";
 import { join as join102, dirname as dirname27 } from "node:path";
 import { homedir as homedir32 } from "node:os";
 import { fileURLToPath as fileURLToPath11 } from "node:url";
@@ -561778,10 +562120,40 @@ function ensureTranscribeCliBackground() {
     } catch {
     }
     try {
-      const { exec: exec6 } = await import("node:child_process");
+      let needsSudo = false;
+      try {
+        const prefix = execSync47("npm prefix -g", {
+          encoding: "utf-8",
+          timeout: 5e3,
+          stdio: ["pipe", "pipe", "pipe"]
+        }).trim();
+        accessSync(prefix, constants.W_OK);
+      } catch {
+        needsSudo = process.platform !== "win32";
+      }
+      const terminalElevation = process.env["OMNIUS_ELEVATION_MODE"] === "terminal" && process.stdin.isTTY && process.stdout.isTTY;
+      const command = terminalElevation && needsSudo ? "sudo" : "npm";
+      const args = terminalElevation && needsSudo ? ["npm", "i", "-g", "transcribe-cli"] : ["i", "-g", "transcribe-cli"];
       return new Promise((resolve56) => {
-        exec6("npm i -g transcribe-cli", { timeout: 18e4 }, (err) => {
-          resolve56(!err);
+        const child = spawn24(command, args, {
+          stdio: terminalElevation ? "inherit" : "ignore",
+          timeout: 18e4
+        });
+        const timeout2 = setTimeout(() => {
+          try {
+            child.kill("SIGTERM");
+          } catch {
+          }
+          resolve56(false);
+        }, 18e4);
+        timeout2.unref?.();
+        onChildClose(child, (code8) => {
+          clearTimeout(timeout2);
+          resolve56(code8 === 0);
+        });
+        onChildError(child, () => {
+          clearTimeout(timeout2);
+          resolve56(false);
         });
       });
     } catch {
@@ -571611,6 +571983,95 @@ function safeNonNegativeInt(value2) {
   const n2 = Number(value2);
   return Number.isFinite(n2) && n2 > 0 ? Math.floor(n2) : 0;
 }
+function currentTokenRate(samples, now = Date.now()) {
+  while (samples.length > 0 && samples[0].at < now - 1e4) samples.shift();
+  if (samples.length === 0) return 0;
+  const tokens = samples.reduce((sum, sample) => sum + sample.tokens, 0);
+  const spanMs = Math.max(1e3, now - samples[0].at);
+  return Math.round(tokens / (spanMs / 1e3) * 10) / 10;
+}
+function recordTokenRate(samples, tokens, now = Date.now()) {
+  const count = safeNonNegativeInt(tokens);
+  if (count > 0) samples.push({ at: now, tokens: count });
+  return currentTokenRate(samples, now);
+}
+function estimateTextTokens(text) {
+  const visible = Array.from(text).length;
+  return visible > 0 ? Math.max(1, Math.ceil(visible / 4)) : 0;
+}
+function estimateStreamingOutputTokens(chunkText) {
+  let contentChars = 0;
+  for (const line of chunkText.split("\n")) {
+    const trimmed = line.trim();
+    if (!trimmed.startsWith("data:")) continue;
+    const payload = trimmed.slice(5).trim();
+    if (!payload || payload === "[DONE]") continue;
+    try {
+      const parsed = JSON.parse(payload);
+      const choice = Array.isArray(parsed?.choices) ? parsed.choices[0] : null;
+      const deltaContent = choice?.delta?.content;
+      const messageContent = choice?.message?.content;
+      const responseContent = parsed?.response;
+      const text = typeof deltaContent === "string" ? deltaContent : typeof messageContent === "string" ? messageContent : typeof responseContent === "string" ? responseContent : "";
+      contentChars += Array.from(text).length;
+    } catch {
+      contentChars += Array.from(payload).length;
+    }
+  }
+  if (contentChars > 0) return Math.max(1, Math.ceil(contentChars / 4));
+  return estimateTextTokens(chunkText.trim());
+}
+function serializeSponsorModels(stats) {
+  const byModel = /* @__PURE__ */ new Map();
+  for (const [model, requests] of stats.modelUsage.entries()) {
+    if (INTERNAL_CAPABILITIES.has(model)) continue;
+    byModel.set(model, {
+      model,
+      requests,
+      tokensIn: 0,
+      tokensOut: 0,
+      lastUsed: 0
+    });
+  }
+  for (const user of stats.users.values()) {
+    for (const [model, meter] of user.models.entries()) {
+      if (INTERNAL_CAPABILITIES.has(model)) continue;
+      const existing = byModel.get(model) ?? {
+        model,
+        requests: 0,
+        tokensIn: 0,
+        tokensOut: 0,
+        lastUsed: 0
+      };
+      if (!stats.modelUsage.has(model)) existing.requests += meter.requests;
+      existing.tokensIn += meter.tokensIn;
+      existing.tokensOut += meter.tokensOut;
+      existing.lastUsed = Math.max(existing.lastUsed, meter.lastUsed);
+      byModel.set(model, existing);
+    }
+  }
+  return Array.from(byModel.values()).sort(
+    (a2, b) => (b.tokensIn + b.tokensOut || b.requests) - (a2.tokensIn + a2.tokensOut || a2.requests)
+  );
+}
+function serializeSponsorPeers(stats) {
+  return Array.from(stats.users.values()).map((user) => ({
+    peer: user.ip,
+    firstSeen: user.firstSeen,
+    lastSeen: user.lastSeen,
+    requests: user.requests,
+    activeRequests: user.activeRequests,
+    tokensIn: user.tokensIn,
+    tokensOut: user.tokensOut,
+    models: Array.from(user.models.entries()).filter(([model]) => !INTERNAL_CAPABILITIES.has(model)).map(([model, meter]) => ({
+      model,
+      requests: meter.requests,
+      tokensIn: meter.tokensIn,
+      tokensOut: meter.tokensOut,
+      lastUsed: meter.lastUsed
+    })).sort((a2, b) => b.tokensIn + b.tokensOut - (a2.tokensIn + a2.tokensOut))
+  })).sort((a2, b) => (b.tokensIn + b.tokensOut || b.requests) - (a2.tokensIn + a2.tokensOut || a2.requests));
+}
 function nextSponsorDailyReset(now = Date.now()) {
   return now + SPONSOR_DAILY_WINDOW_MS;
 }
@@ -571874,6 +572335,7 @@ var init_expose = __esm({
       /** Sponsor rate limits (set via setSponsorLimits) */
       _sponsorLimits = null;
       _sponsorBlockedRequests = 0;
+      _tokenRateSamples = [];
       _authKey;
       _targetUrl;
       _kind;
@@ -571887,6 +572349,7 @@ var init_expose = __esm({
         errors: 0,
         totalTokensIn: 0,
         totalTokensOut: 0,
+        tokensPerSecond: 0,
         startedAt: Date.now(),
         modelUsage: /* @__PURE__ */ new Map(),
         users: /* @__PURE__ */ new Map(),
@@ -571977,6 +572440,7 @@ var init_expose = __esm({
         };
       }
       refreshSponsorUsageStats(now = Date.now()) {
+        this._stats.tokensPerSecond = currentTokenRate(this._tokenRateSamples, now);
         if (!this._sponsorLimits) {
           this._stats.sponsorUsage = null;
           return;
@@ -571986,6 +572450,10 @@ var init_expose = __esm({
         this._stats.sponsorUsage = {
           enabled: true,
           transport: "tunnel",
+          totalRequests: this._stats.totalRequests,
+          totalTokensIn: this._stats.totalTokensIn,
+          totalTokensOut: this._stats.totalTokensOut,
+          tokensPerSecond: this._stats.tokensPerSecond,
           dailyTokensUsed: this._dailyTokensUsed,
           dailyTokensLimit: this._sponsorLimits.maxTokensPerDay,
           dailyResetAt: this._dailyTokensResetAt,
@@ -571995,9 +572463,15 @@ var init_expose = __esm({
           activeConnections: this._stats.activeConnections,
           maxConcurrent: this._sponsorLimits.maxConcurrent,
           blockedRequests: this._sponsorBlockedRequests,
-          allowedModels: this._sponsorLimits.allowedModels === "all" ? "all" : [...this._sponsorLimits.allowedModels]
+          allowedModels: this._sponsorLimits.allowedModels === "all" ? "all" : [...this._sponsorLimits.allowedModels],
+          peers: serializeSponsorPeers(this._stats),
+          models: serializeSponsorModels(this._stats)
         };
       }
+      recordServedTokens(tokens, now = Date.now()) {
+        this._stats.tokensPerSecond = recordTokenRate(this._tokenRateSamples, tokens, now);
+        this.refreshSponsorUsageStats(now);
+      }
       markSponsorBlocked() {
         this._sponsorBlockedRequests++;
         this.refreshSponsorUsageStats();
@@ -572211,8 +572685,11 @@ var init_expose = __esm({
                 errors: this._stats.errors,
                 totalTokensIn: this._stats.totalTokensIn,
                 totalTokensOut: this._stats.totalTokensOut,
+                tokensPerSecond: currentTokenRate(this._tokenRateSamples),
                 uptimeSeconds: Math.floor((Date.now() - this._stats.startedAt) / 1e3),
                 modelUsage: Object.fromEntries(this._stats.modelUsage),
+                models: serializeSponsorModels(this._stats),
+                peers: serializeSponsorPeers(this._stats),
                 users: Array.from(this._stats.users.values()).map((u) => ({
                   ip: u.ip,
                   requests: u.requests,
@@ -572235,6 +572712,7 @@ var init_expose = __esm({
             return;
           }
           const userIp = req2.headers["cf-connecting-ip"] ?? req2.headers["x-forwarded-for"]?.split(",")[0]?.trim() ?? req2.socket.remoteAddress ?? "unknown";
+          const requestStartedAt = Date.now();
           let user = this._stats.users.get(userIp);
           if (!user) {
             user = {
@@ -572384,6 +572862,9 @@ var init_expose = __esm({
               }
             };
             let responseTail = "";
+            let requestTokensIn = 0;
+            let requestTokensOut = 0;
+            let sawStreamTokenEstimate = false;
             const finalizeRequest = () => {
               user.activeRequests = Math.max(0, user.activeRequests - 1);
               this._stats.activeConnections = Math.max(0, this._stats.activeConnections - 1);
@@ -572393,9 +572874,12 @@ var init_expose = __esm({
                 if (promptEval || evalCount) {
                   const tIn2 = parseInt(promptEval?.[1] ?? "0", 10);
                   const tOut2 = parseInt(evalCount?.[1] ?? "0", 10);
+                  requestTokensIn = tIn2;
+                  requestTokensOut = tOut2;
                   this._stats.totalTokensIn += tIn2;
                   this._stats.totalTokensOut += tOut2;
                   this.trackTokenUsage(tIn2, tOut2);
+                  if (!isStreaming || !sawStreamTokenEstimate) this.recordServedTokens(tOut2);
                   user.tokensIn += tIn2;
                   user.tokensOut += tOut2;
                   if (requestModel) {
@@ -572411,9 +572895,12 @@ var init_expose = __esm({
                   if (promptTokens || completionTokens) {
                     const tIn2 = parseInt(promptTokens?.[1] ?? "0", 10);
                     const tOut2 = parseInt(completionTokens?.[1] ?? "0", 10);
+                    requestTokensIn = tIn2;
+                    requestTokensOut = tOut2;
                     this._stats.totalTokensIn += tIn2;
                     this._stats.totalTokensOut += tOut2;
                     this.trackTokenUsage(tIn2, tOut2);
+                    if (!isStreaming || !sawStreamTokenEstimate) this.recordServedTokens(tOut2);
                     user.tokensIn += tIn2;
                     user.tokensOut += tOut2;
                     if (requestModel) {
@@ -572427,8 +572914,8 @@ var init_expose = __esm({
                 }
               } catch {
               }
-              const tIn = user.tokensIn;
-              const tOut = user.tokensOut;
+              const tIn = requestTokensIn;
+              const tOut = requestTokensOut;
               if (tIn > 0 || tOut > 0) {
                 const receipt = {
                   job_id: `job-${Date.now().toString(36)}`,
@@ -572436,7 +572923,7 @@ var init_expose = __esm({
                   consumer_ip: userIp,
                   model: requestModel,
                   usage_final: { input_tokens: tIn, output_tokens: tOut },
-                  latency_ms: Date.now() - (user.lastSeen || Date.now()),
+                  latency_ms: Date.now() - requestStartedAt,
                   quality_flags: [],
                   // COHERE revenue split: 70% provider, 10% commons, 8% memory, 7% relay, 5% reserve
                   provider_reward: (tIn + tOut) * 1e-7 * 0.7,
@@ -572476,6 +572963,11 @@ var init_expose = __esm({
                   }
                   if (isStreaming) {
                     this.emit("token_flash");
+                    const estimatedTokens = estimateStreamingOutputTokens(text);
+                    if (estimatedTokens > 0) {
+                      sawStreamTokenEstimate = true;
+                      this.recordServedTokens(estimatedTokens);
+                    }
                     this.emit("stream_data", { content: text, model: requestModel, peer: userIp });
                   }
                 });
@@ -572773,6 +573265,7 @@ ${this.formatConnectionInfo()}`);
         lines.push(`  ${c3.cyan("Errors".padEnd(18))} ${s2.errors}`);
         lines.push(`  ${c3.cyan("Tokens in".padEnd(18))} ${fmtTokens(s2.totalTokensIn)}`);
         lines.push(`  ${c3.cyan("Tokens out".padEnd(18))} ${fmtTokens(s2.totalTokensOut)}`);
+        lines.push(`  ${c3.cyan("Tokens/sec".padEnd(18))} ${s2.tokensPerSecond.toFixed(s2.tokensPerSecond >= 10 ? 0 : 1)} t/s`);
         if (s2.budgetTokensTotal > 0) {
           const pct = Math.round(s2.budgetTokensRemaining / s2.budgetTokensTotal * 100);
           const budgetColor = pct > 50 ? c3.green : pct > 20 ? c3.yellow : c3.red;
@@ -572862,8 +573355,10 @@ ${this.formatConnectionInfo()}`);
       _loadbalance = false;
       _endpointAuth;
       _sponsorLimits = null;
+      _lastPushedSponsorLimitsKey = "";
       _sponsorBlockedRequests = 0;
       _sponsorRequestWindow = [];
+      _tokenRateSamples = [];
       _dailyTokensUsed = 0;
       _dailyTokensResetAt = 0;
       _pollTimer = null;
@@ -572879,6 +573374,7 @@ ${this.formatConnectionInfo()}`);
         errors: 0,
         totalTokensIn: 0,
         totalTokensOut: 0,
+        tokensPerSecond: 0,
         startedAt: Date.now(),
         modelUsage: /* @__PURE__ */ new Map(),
         users: /* @__PURE__ */ new Map(),
@@ -572935,6 +573431,7 @@ ${this.formatConnectionInfo()}`);
         this.ensureSponsorDailyWindow();
         this.refreshSponsorUsageStats();
         this.emitStats();
+        if (this._stats.status === "active") this.pushSponsorLimitsToDaemon();
       }
       getSponsorUsageSnapshot() {
         this.refreshSponsorUsageStats();
@@ -572994,6 +573491,7 @@ ${this.formatConnectionInfo()}`);
         this.refreshSponsorUsageStats();
       }
       refreshSponsorUsageStats(now = Date.now()) {
+        this._stats.tokensPerSecond = currentTokenRate(this._tokenRateSamples, now);
         if (!this._sponsorLimits) {
           this._stats.sponsorUsage = null;
           return;
@@ -573003,6 +573501,10 @@ ${this.formatConnectionInfo()}`);
         this._stats.sponsorUsage = {
           enabled: true,
           transport: "libp2p",
+          totalRequests: this._stats.totalRequests,
+          totalTokensIn: this._stats.totalTokensIn,
+          totalTokensOut: this._stats.totalTokensOut,
+          tokensPerSecond: this._stats.tokensPerSecond,
           dailyTokensUsed: this._dailyTokensUsed,
           dailyTokensLimit: this._sponsorLimits.maxTokensPerDay,
           dailyResetAt: this._dailyTokensResetAt,
@@ -573012,9 +573514,47 @@ ${this.formatConnectionInfo()}`);
           activeConnections: this._stats.activeConnections,
           maxConcurrent: this._sponsorLimits.maxConcurrent,
           blockedRequests: this._sponsorBlockedRequests,
-          allowedModels: this._sponsorLimits.allowedModels === "all" ? "all" : [...this._sponsorLimits.allowedModels]
+          allowedModels: this._sponsorLimits.allowedModels === "all" ? "all" : [...this._sponsorLimits.allowedModels],
+          peers: serializeSponsorPeers(this._stats),
+          models: serializeSponsorModels(this._stats)
         };
       }
+      recordServedTokens(tokens, now = Date.now()) {
+        this._stats.tokensPerSecond = recordTokenRate(this._tokenRateSamples, tokens, now);
+        this.refreshSponsorUsageStats(now);
+      }
+      buildExposeArgs() {
+        const exposeArgs = {
+          action: "expose",
+          ollama_url: this._targetUrl,
+          margin: String(this._margin),
+          auth_key: this._authKey
+        };
+        if (this._passthrough) {
+          exposeArgs.passthrough = "true";
+          if (this._endpointAuth) exposeArgs.endpoint_auth = this._endpointAuth;
+        }
+        if (this._sponsorLimits) {
+          exposeArgs.max_concurrent = String(this._sponsorLimits.maxConcurrent);
+          exposeArgs.max_requests_per_minute = String(this._sponsorLimits.maxRequestsPerMinute);
+          exposeArgs.max_tokens_per_day = String(this._sponsorLimits.maxTokensPerDay);
+          exposeArgs.daily_tokens_used = String(this._dailyTokensUsed);
+          exposeArgs.daily_tokens_reset_at = String(this._dailyTokensResetAt);
+          exposeArgs.allowed_models = this._sponsorLimits.allowedModels === "all" ? "all" : this._sponsorLimits.allowedModels.join(",");
+        }
+        return exposeArgs;
+      }
+      pushSponsorLimitsToDaemon() {
+        if (!this._nexusTool || this._stats.status !== "active") return;
+        const exposeArgs = this.buildExposeArgs();
+        const key = JSON.stringify(exposeArgs);
+        if (key === this._lastPushedSponsorLimitsKey) return;
+        this._lastPushedSponsorLimitsKey = key;
+        void this._nexusTool.execute(exposeArgs).catch((err) => {
+          this._lastPushedSponsorLimitsKey = "";
+          this._onError?.(`P2P sponsor limit update failed: ${err instanceof Error ? err.message : String(err)}`);
+        });
+      }
       async start() {
         this._onInfo?.("Connecting to nexus P2P network...");
         const connectResult = await this._nexusTool.execute({
@@ -573027,18 +573567,7 @@ ${this.formatConnectionInfo()}`);
         }
         await new Promise((r2) => setTimeout(r2, 500));
         this._onInfo?.(this._passthrough ? `Registering passthrough capabilities (→ ${this._targetUrl})...` : "Registering inference capabilities...");
-        const exposeArgs = {
-          action: "expose",
-          ollama_url: this._targetUrl,
-          margin: String(this._margin),
-          auth_key: this._authKey
-        };
-        if (this._passthrough) {
-          exposeArgs.passthrough = "true";
-          if (this._endpointAuth) {
-            exposeArgs.endpoint_auth = this._endpointAuth;
-          }
-        }
+        const exposeArgs = this.buildExposeArgs();
         let exposeResult = await this._nexusTool.execute(exposeArgs);
         if (!exposeResult.success && exposeResult.error?.includes("not running")) {
           await new Promise((r2) => setTimeout(r2, 1500));
@@ -573175,7 +573704,8 @@ ${this.formatConnectionInfo()}`);
             const invocCount = files.length;
             const newRequests = invocCount - this._prevInvocCount;
             if (newRequests > 0) {
-              this._stats.activeConnections = Math.max(1, newRequests);
+              const activeLimit2 = this._sponsorLimits?.maxConcurrent ?? 10;
+              this._stats.activeConnections = Math.min(Math.max(1, newRequests), activeLimit2);
               this._stats.totalRequests = invocCount;
               this._prevInvocCount = invocCount;
               this.emitStats();
@@ -573200,7 +573730,9 @@ ${this.formatConnectionInfo()}`);
             }
             const inFlightEstimate = Math.max(0, invocCount - meteringLines);
             const prevActive = this._stats.activeConnections;
-            this._stats.activeConnections = Math.max(recentActive, Math.min(inFlightEstimate, 10));
+            const activeEstimate = Math.max(recentActive, Math.min(inFlightEstimate, 10));
+            const activeLimit = this._sponsorLimits?.maxConcurrent ?? 10;
+            this._stats.activeConnections = Math.min(activeEstimate, activeLimit);
             if (this._stats.activeConnections !== prevActive) this.emitStats();
             if (this._stats.activeConnections > 0 && !this._tokenFlashTimer) {
               this.emit("token_flash");
@@ -573252,6 +573784,13 @@ ${this.formatConnectionInfo()}`);
                   if (!line.trim()) continue;
                   try {
                     const record = JSON.parse(line);
+                    if (record.blocked) {
+                      this._sponsorBlockedRequests++;
+                      this._stats.errors++;
+                      this.recordSponsorRequest();
+                      this.refreshSponsorUsageStats();
+                      continue;
+                    }
                     let tokIn = 0;
                     let tokOut = 0;
                     if (typeof record.inputTokens === "number" && typeof record.outputTokens === "number") {
@@ -573272,6 +573811,7 @@ ${this.formatConnectionInfo()}`);
                     }
                     this._stats.totalTokensIn += tokIn;
                     this._stats.totalTokensOut += tokOut;
+                    this.recordServedTokens(tokOut);
                     this.recordSponsorRequest();
                     this.trackTokenUsage(tokIn, tokOut);
                     const peerId = record.from || record.peerId || "unknown";
@@ -573385,6 +573925,7 @@ ${this.formatConnectionInfo()}`);
         lines.push(`  ${c3.cyan("Errors".padEnd(18))} ${s2.errors}`);
         lines.push(`  ${c3.cyan("Tokens in".padEnd(18))} ${fmtTokens(s2.totalTokensIn)}`);
         lines.push(`  ${c3.cyan("Tokens out".padEnd(18))} ${fmtTokens(s2.totalTokensOut)}`);
+        lines.push(`  ${c3.cyan("Tokens/sec".padEnd(18))} ${s2.tokensPerSecond.toFixed(s2.tokensPerSecond >= 10 ? 0 : 1)} t/s`);
         if (s2.budgetTokensTotal > 0) {
           const pct = Math.round(s2.budgetTokensRemaining / s2.budgetTokensTotal * 100);
           const budgetColor = pct > 50 ? c3.green : pct > 20 ? c3.yellow : c3.red;
@@ -578793,6 +579334,7 @@ var init_status_bar = __esm({
       setExposeStatus(status) {
         this._expose = status;
         this._exposePeerCount = status.activeConnections;
+        this.setRemoteTokensPerSecond(status.tokensPerSecond);
         if (this.active) this.renderFooterPreserveCursor();
       }
       /** Clear expose gateway status */
@@ -578828,27 +579370,41 @@ var init_status_bar = __esm({
       }
       /** Unified system metrics collector (local or remote) */
       _metricsCollector = new SystemMetricsCollector();
-      /** Cached unified metrics snapshot — updated by collector callback */
+      /** Cached local metrics snapshot — updated by collector callback */
       _unifiedMetrics = null;
+      _localUnifiedMetrics = null;
+      _remoteUnifiedMetrics = null;
+      _remoteMetricsUpdatedAt = 0;
       /** Legacy remote metrics polling timer (for peer/HTTP polling) */
       _remoteMetricsTimer = null;
+      setRemoteTokensPerSecond(rate) {
+        const n2 = typeof rate === "number" ? rate : Number(rate);
+        if (!Number.isFinite(n2) || n2 < 0) return;
+        this._tokensPerSecond = n2;
+        if (n2 > this._peakTokensPerSecond) this._peakTokensPerSecond = n2;
+      }
+      getDisplayMetrics() {
+        const local = this._localUnifiedMetrics ?? (this._unifiedMetrics?.source === "local" ? this._unifiedMetrics : null) ?? getInstantSnapshot();
+        const remote = this._remoteUnifiedMetrics;
+        const remoteFresh = remote && Date.now() - this._remoteMetricsUpdatedAt < 6e4;
+        if (!remoteFresh) return local;
+        const showRemote = Math.floor(Date.now() / 5e3) % 2 === 1;
+        if (!showRemote) return local;
+        return {
+          ...remote,
+          network: local.network
+        };
+      }
       /** Update remote host system metrics (from polling /v1/system/metrics) */
       setRemoteMetrics(metrics2) {
-        if (!this._metricsCollector.isActive || this._metricsCollector.source !== "remote") {
-          this._metricsCollector.startRemote((m2) => {
-            this._unifiedMetrics = m2;
-            this._gpuName = m2.gpuName || "";
-            this._vramTotal = m2.vramTotalMB || 0;
-            this._vramUsed = m2.vramUsedMB || 0;
-            if (this.active) this.renderFooterPreserveCursor();
-          });
-        }
-        this._metricsCollector.pushRemoteMetrics({
+        const hardware = {
           cpuUtil: metrics2.cpuUtil,
           cpuCores: metrics2.cpuCores ?? 0,
           cpuModel: metrics2.cpuModel ?? "",
           gpuUtil: metrics2.gpuUtil,
+          gpuCount: metrics2.gpuUtil >= 0 || metrics2.gpuName ? 1 : 0,
           gpuName: metrics2.gpuName,
+          gpuDevices: [],
           vramUtil: metrics2.vramUtil,
           vramUsedMB: metrics2.vramUsedMB ?? 0,
           vramTotalMB: metrics2.vramTotalMB ?? 0,
@@ -578859,17 +579415,30 @@ var init_status_bar = __esm({
           diskUsedGB: metrics2.diskUsedGB ?? 0,
           diskTotalGB: metrics2.diskTotalGB ?? 0,
           diskFreeGB: metrics2.diskFreeGB ?? 0,
-          diskPath: metrics2.diskPath ?? ""
-        });
+          diskPath: metrics2.diskPath ?? "",
+          ollamaPool: null
+        };
+        const local = this._localUnifiedMetrics ?? this._unifiedMetrics ?? getInstantSnapshot();
+        this._remoteUnifiedMetrics = {
+          source: "remote",
+          hardware,
+          network: local.network
+        };
+        this._remoteMetricsUpdatedAt = Date.now();
+        this.setRemoteTokensPerSecond(metrics2.tokensPerSecond);
+        if (this.active) this.renderFooterPreserveCursor();
       }
       /** Clear remote metrics and switch back to local collection */
       clearRemoteMetrics() {
-        this._unifiedMetrics = null;
+        this._remoteUnifiedMetrics = null;
+        this._remoteMetricsUpdatedAt = 0;
         if (this._remoteMetricsTimer) {
           clearInterval(this._remoteMetricsTimer);
           this._remoteMetricsTimer = null;
         }
-        this.startLocalMetrics();
+        if (!this._metricsCollector.isActive || this._metricsCollector.source !== "local") {
+          this.startLocalMetrics();
+        }
         if (this.active) this.renderFooterPreserveCursor();
       }
       /**
@@ -578878,7 +579447,14 @@ var init_status_bar = __esm({
        */
       startLocalMetrics(intervalMs = 2e3) {
         this._metricsCollector.startLocal((m2) => {
+          this._localUnifiedMetrics = m2;
           this._unifiedMetrics = m2;
+          if (this._remoteUnifiedMetrics) {
+            this._remoteUnifiedMetrics = {
+              ...this._remoteUnifiedMetrics,
+              network: m2.network
+            };
+          }
           if (this.active) this.renderFooterPreserveCursor();
         }, intervalMs);
         try {
@@ -578915,6 +579491,9 @@ var init_status_bar = __esm({
       stopAllMetrics() {
         this._metricsCollector.stop();
         this._unifiedMetrics = null;
+        this._localUnifiedMetrics = null;
+        this._remoteUnifiedMetrics = null;
+        this._remoteMetricsUpdatedAt = 0;
         if (this._remoteMetricsTimer) {
           clearInterval(this._remoteMetricsTimer);
           this._remoteMetricsTimer = null;
@@ -578926,10 +579505,6 @@ var init_status_bar = __esm({
        */
       startRemoteMetricsPolling(endpointUrl, authKey) {
         this.stopRemoteMetricsPolling();
-        this._metricsCollector.startRemote((m2) => {
-          this._unifiedMetrics = m2;
-          if (this.active) this.renderFooterPreserveCursor();
-        });
         const poll = async () => {
           try {
             const url = new URL("/v1/system/metrics", endpointUrl);
@@ -578951,7 +579526,8 @@ var init_status_bar = __esm({
                 diskUsedGB: data.disk?.usedGB ?? 0,
                 diskTotalGB: data.disk?.totalGB ?? 0,
                 diskFreeGB: data.disk?.freeGB ?? 0,
-                diskPath: data.disk?.path ?? ""
+                diskPath: data.disk?.path ?? "",
+                tokensPerSecond: data.gateway?.tokensPerSecond
               });
             }
           } catch {
@@ -578967,10 +579543,6 @@ var init_status_bar = __esm({
        */
       startPeerMetricsPolling(sendCommand, peerId, authKey, nexusDir) {
         this.stopRemoteMetricsPolling();
-        this._metricsCollector.startRemote((m2) => {
-          this._unifiedMetrics = m2;
-          if (this.active) this.renderFooterPreserveCursor();
-        });
         let pollAttempt = 0;
         const extractMetrics = (raw) => {
           let obj = raw;
@@ -579037,6 +579609,7 @@ var init_status_bar = __esm({
                 const cached = JSON.parse(raw);
                 if (cached && cached.ts && Date.now() - cached.ts < 6e4) {
                   const m2 = cached.data;
+                  this.setRemoteTokensPerSecond(m2?.gateway?.tokensPerSecond);
                   if (m2?.cpu) {
                     lastPeerMetricsDebug = `ok: cpu=${m2.cpu?.utilization}%`;
                     this.setRemoteMetrics({
@@ -579055,7 +579628,8 @@ var init_status_bar = __esm({
                       diskTotalGB: m2.disk?.totalGB ?? 0,
                       diskUsedGB: m2.disk?.usedGB ?? 0,
                       diskFreeGB: m2.disk?.freeGB ?? 0,
-                      diskPath: m2.disk?.path ?? ""
+                      diskPath: m2.disk?.path ?? "",
+                      tokensPerSecond: m2.gateway?.tokensPerSecond
                     });
                     return;
                   }
@@ -579083,7 +579657,11 @@ var init_status_bar = __esm({
           clearInterval(this._remoteMetricsTimer);
           this._remoteMetricsTimer = null;
         }
-        this.startLocalMetrics();
+        this._remoteUnifiedMetrics = null;
+        this._remoteMetricsUpdatedAt = 0;
+        if (!this._metricsCollector.isActive || this._metricsCollector.source !== "local") {
+          this.startLocalMetrics();
+        }
       }
       /** Update token metrics from a token_usage event */
       updateMetrics(update2) {
@@ -579252,7 +579830,7 @@ var init_status_bar = __esm({
           // 10: █ full block
         ];
         if (this._focusFrame < 4) return DENSITY2[10];
-        const m2 = this._unifiedMetrics ?? getInstantSnapshot();
+        const m2 = this.getDisplayMetrics();
         const cpu = m2.hardware.cpuUtil;
         const gpu = m2.hardware.gpuUtil;
         const mem = m2.hardware.memUtil;
@@ -580718,7 +581296,7 @@ ${CONTENT_BG_SEQ}`);
           });
         }
         {
-          const um = this._unifiedMetrics ?? getInstantSnapshot();
+          const um = this.getDisplayMetrics();
           const rm4 = um.hardware;
           const isLocal = um.source === "local";
           const srcTag = isLocal ? pastel2(120, "L") : pastel2(117, "R");
@@ -583813,21 +584391,27 @@ function ensureZstd() {
   process.stdout.write(`
   ${c3.cyan("●")} Installing zstd (required by ollama install.sh)...
 `);
+  const terminalElevation = process.env["OMNIUS_ELEVATION_MODE"] === "terminal" && process.stdin.isTTY && process.stdout.isTTY;
   const hasDisplay = !!(process.env.DISPLAY || process.env.WAYLAND_DISPLAY);
   const askpassHelper = detectAskpassHelper() ?? writeAskpassHelper();
   const askpassEnv = askpassHelper ? { ...process.env, SUDO_ASKPASS: askpassHelper, DEBIAN_FRONTEND: "noninteractive" } : { ...process.env, DEBIAN_FRONTEND: "noninteractive" };
   const candidates = [];
-  if (hasCmd("pkexec") && hasDisplay) {
-    candidates.push({ cmd: `pkexec sh -c ${shellEscape(installCmd)}`, env: process.env });
-  }
-  if (askpassHelper) {
-    candidates.push({ cmd: `sudo -A ${installCmd}`, env: askpassEnv });
+  if (terminalElevation) {
+    const isRoot = typeof process.getuid === "function" && process.getuid() === 0;
+    candidates.push({ cmd: isRoot ? installCmd : `sudo ${installCmd}`, env: askpassEnv, stdio: "inherit" });
+  } else {
+    if (hasCmd("pkexec") && hasDisplay) {
+      candidates.push({ cmd: `pkexec sh -c ${shellEscape(installCmd)}`, env: process.env });
+    }
+    if (askpassHelper) {
+      candidates.push({ cmd: `sudo -A ${installCmd}`, env: askpassEnv });
+    }
   }
   candidates.push({ cmd: installCmd, env: process.env });
   for (const cand of candidates) {
     try {
       execSync51(cand.cmd, {
-        stdio: ["ignore", "inherit", "pipe"],
+        stdio: cand.stdio ?? ["ignore", "inherit", "pipe"],
         env: cand.env,
         timeout: 18e4
       });
@@ -583915,6 +584499,14 @@ osascript -e 'Tell application "System Events" to display dialog "Omnius needs a
 function buildElevatedInstall() {
   const installCmd = "curl -fsSL https://ollama.com/install.sh | sh";
   const baseEnv = { ...process.env };
+  if (process.env["OMNIUS_ELEVATION_MODE"] === "terminal" && process.stdin.isTTY && process.stdout.isTTY) {
+    const isRoot = typeof process.getuid === "function" && process.getuid() === 0;
+    return {
+      cmd: isRoot ? `sh -c ${shellEscape(installCmd)}` : `sudo sh -c ${shellEscape(installCmd)}`,
+      env: { ...baseEnv, DEBIAN_FRONTEND: "noninteractive" },
+      mode: "terminal"
+    };
+  }
   if (process.platform === "linux" && hasCmd("pkexec") && (process.env.DISPLAY || process.env.WAYLAND_DISPLAY)) {
     return {
       cmd: `pkexec sh -c ${shellEscape(installCmd)}`,
@@ -583946,20 +584538,29 @@ function runElevatedCommand(command, opts = {}) {
   const hasDisplay = !!(process.env.DISPLAY || process.env.WAYLAND_DISPLAY);
   const askpassHelper = detectAskpassHelper() ?? writeAskpassHelper();
   const askpassEnv = askpassHelper ? { ...process.env, SUDO_ASKPASS: askpassHelper } : process.env;
+  const terminalElevation = process.env["OMNIUS_ELEVATION_MODE"] === "terminal" && process.stdin.isTTY && process.stdout.isTTY;
   const candidates = [];
-  if (hasCmd("pkexec") && hasDisplay) {
-    candidates.push({ cmd: `pkexec sh -c ${shellEscape(command)}`, env: process.env });
-  }
-  if (askpassHelper) {
-    candidates.push({ cmd: `sudo -A sh -c ${shellEscape(command)}`, env: askpassEnv });
+  if (terminalElevation) {
+    const isRoot = typeof process.getuid === "function" && process.getuid() === 0;
+    candidates.push({
+      cmd: isRoot ? `sh -c ${shellEscape(command)}` : `sudo sh -c ${shellEscape(command)}`,
+      env: { ...process.env, DEBIAN_FRONTEND: "noninteractive" },
+      stdio: "inherit"
+    });
+  } else {
+    if (hasCmd("pkexec") && hasDisplay) {
+      candidates.push({ cmd: `pkexec sh -c ${shellEscape(command)}`, env: process.env });
+    }
+    if (askpassHelper) {
+      candidates.push({ cmd: `sudo -A sh -c ${shellEscape(command)}`, env: askpassEnv });
+    }
   }
   candidates.push({ cmd: command, env: process.env });
   let lastErr = null;
   for (const cand of candidates) {
     try {
       execSync51(cand.cmd, {
-        stdio: ["ignore", "pipe", "pipe"],
-        // never inherit TUI stdin
+        stdio: cand.stdio ?? ["ignore", "pipe", "pipe"],
         env: cand.env,
         timeout: timeout2
       });
@@ -583979,7 +584580,10 @@ function runOllamaInstallScript() {
 `);
   }
   const elevated = buildElevatedInstall();
-  if (elevated.mode === "pkexec") {
+  if (elevated.mode === "terminal") {
+    process.stdout.write(`  ${c3.cyan("●")} Elevation: sudo terminal prompt
+`);
+  } else if (elevated.mode === "pkexec") {
     process.stdout.write(`  ${c3.cyan("●")} Elevation: pkexec (graphical PolicyKit prompt)
 `);
   } else if (elevated.mode === "askpass") {
@@ -583993,7 +584597,7 @@ function runOllamaInstallScript() {
   }
   const runOnce = () => {
     execSync51(elevated.cmd, {
-      stdio: ["ignore", "inherit", "pipe"],
+      stdio: elevated.mode === "terminal" ? "inherit" : ["ignore", "inherit", "pipe"],
       env: elevated.env,
       timeout: 6e5
     });
@@ -585270,6 +585874,20 @@ async function acquireSudoPassword(getSudoPassword, log22, cachedPasswordRef) {
 }
 async function sudoInstall(cmd, getSudoPassword, log22, cachedPasswordRef, timeoutMs = 12e4) {
   if (trySudoPasswordless(cmd, timeoutMs)) return true;
+  if (process.env["OMNIUS_ELEVATION_MODE"] === "terminal" && process.stdin.isTTY && process.stdout.isTTY) {
+    try {
+      const isRoot = typeof process.getuid === "function" && process.getuid() === 0;
+      const escaped = cmd.replace(/'/g, "'\\''");
+      execSync51(isRoot ? `bash -c '${escaped}'` : `sudo bash -c '${escaped}'`, {
+        stdio: "inherit",
+        timeout: timeoutMs,
+        env: { ...process.env, DEBIAN_FRONTEND: "noninteractive" }
+      });
+      return true;
+    } catch {
+      return false;
+    }
+  }
   const pw2 = await acquireSudoPassword(getSudoPassword, log22, cachedPasswordRef);
   if (pw2 === null) return false;
   if (pw2 === "") return false;
@@ -585569,9 +586187,11 @@ function ensureCloudflaredBackground(onInfo) {
       } catch {
       }
       try {
+        const terminalElevation = process.env["OMNIUS_ELEVATION_MODE"] === "terminal" && process.stdin.isTTY && process.stdout.isTTY;
+        const sudoMove = terminalElevation ? `sudo mv /tmp/cloudflared /usr/local/bin/cloudflared` : `sudo mv /tmp/cloudflared /usr/local/bin/cloudflared 2>/dev/null`;
         execSync51(
-          `curl -fsSL "https://github.com/cloudflare/cloudflared/releases/latest/download/cloudflared-linux-${cfArch}" -o /tmp/cloudflared && chmod +x /tmp/cloudflared && sudo mv /tmp/cloudflared /usr/local/bin/cloudflared 2>/dev/null`,
-          { stdio: "pipe", timeout: 6e4 }
+          `curl -fsSL "https://github.com/cloudflare/cloudflared/releases/latest/download/cloudflared-linux-${cfArch}" -o /tmp/cloudflared && chmod +x /tmp/cloudflared && ` + sudoMove,
+          { stdio: terminalElevation ? "inherit" : "pipe", timeout: 6e4 }
         );
         if (hasCmd("cloudflared")) {
           log22("cloudflared installed.");
@@ -590309,6 +590929,15 @@ __export(sponsor_wizard_exports, {
 });
 import { existsSync as existsSync104, readFileSync as readFileSync83, writeFileSync as writeFileSync52, mkdirSync as mkdirSync57 } from "node:fs";
 import { join as join118 } from "node:path";
+function fmtTokens2(n2) {
+  if (n2 < 1e3) return String(Math.max(0, Math.floor(n2)));
+  if (n2 < 1e6) return `${(n2 / 1e3).toFixed(1)}K`;
+  return `${(n2 / 1e6).toFixed(1)}M`;
+}
+function fmtTps(n2) {
+  if (!Number.isFinite(n2) || n2 <= 0) return "0";
+  return n2 >= 10 ? n2.toFixed(0) : n2.toFixed(1);
+}
 function sponsorDir(projectDir2) {
   return join118(projectDir2, ".omnius", "sponsor");
 }
@@ -591090,7 +591719,13 @@ async function showSponsorDashboard(config, projectDir2, rl, availableRows, spon
   const dailyTokensLimit = sponsorUsage?.dailyTokensLimit || config.rateLimits.maxTokensPerDay;
   const requestsPerMinuteLimit = sponsorUsage?.requestsPerMinuteLimit || config.rateLimits.maxRequestsPerMinute;
   const maxConcurrent = sponsorUsage?.maxConcurrent || config.rateLimits.maxConcurrent;
+  const topModels = (sponsorUsage?.models ?? []).slice(0, 5);
+  const topPeers = (sponsorUsage?.peers ?? []).slice(0, 5);
   const usageItems = [
+    {
+      key: "info_usage_totals",
+      label: `  Totals: ${sponsorUsage?.totalRequests ?? 0} req · in ${fmtTokens2(sponsorUsage?.totalTokensIn ?? 0)} · out ${fmtTokens2(sponsorUsage?.totalTokensOut ?? 0)} · ${fmtTps(sponsorUsage?.tokensPerSecond ?? 0)} t/s`
+    },
     {
       key: "info_usage_daily",
       label: `  ${formatUsageBar({
@@ -591122,12 +591757,31 @@ async function showSponsorDashboard(config, projectDir2, rl, availableRows, spon
       label: `  Blocked: ${sponsorUsage?.blockedRequests ?? 0}`
     }
   ];
+  if (topModels.length > 0) {
+    usageItems.push({ key: "info_usage_models_hdr", label: "  Models" });
+    for (const [idx, model] of topModels.entries()) {
+      usageItems.push({
+        key: `info_usage_model_${idx}`,
+        label: `    ${model.model}: ${model.requests} req · ${fmtTokens2(model.tokensIn + model.tokensOut)} tok`
+      });
+    }
+  }
+  if (topPeers.length > 0) {
+    usageItems.push({ key: "info_usage_peers_hdr", label: "  Peers" });
+    for (const [idx, peer] of topPeers.entries()) {
+      const active = peer.activeRequests > 0 ? ` · ${peer.activeRequests} active` : "";
+      usageItems.push({
+        key: `info_usage_peer_${idx}`,
+        label: `    ${peer.peer}: ${peer.requests} req · ${fmtTokens2(peer.tokensIn + peer.tokensOut)} tok${active}`
+      });
+    }
+  }
   const items = [
     { key: "hdr", label: "Sponsor Dashboard" },
     { key: "info_status", label: `  Status: ${isPaused ? "● PAUSED" : "● ACTIVE"}` },
     { key: "info_ep", label: `  Endpoints: ${enabledEps.map((e2) => e2.label).join(", ")}` },
     { key: "info_transport", label: `  Transport: ${[config.transport.cloudflared ? "Cloudflared" : "", config.transport.libp2p ? "libp2p" : ""].filter(Boolean).join(" + ")}` },
-    { key: "info_limits", label: `  Limits: ${config.rateLimits.maxRequestsPerMinute} req/min, ${config.rateLimits.maxTokensPerDay.toLocaleString()} tokens/day` },
+    { key: "info_limits", label: `  Limits: ${config.rateLimits.maxRequestsPerMinute} req/min, ${config.rateLimits.maxTokensPerDay.toLocaleString()} tokens/day, ${config.rateLimits.maxConcurrent} concurrent` },
     { key: "info_usage_hdr", label: "  Usage" },
     ...usageItems,
     { key: "sep", label: "" },
@@ -591139,7 +591793,7 @@ async function showSponsorDashboard(config, projectDir2, rl, availableRows, spon
     items,
     title: "Sponsor Dashboard",
     rl,
-    skipKeys: ["hdr", "sep", "info_status", "info_ep", "info_transport", "info_limits", "info_usage_hdr", "info_usage_daily", "info_usage_rpm", "info_usage_concurrent", "info_usage_blocked"],
+    skipKeys: items.map((item) => item.key).filter((key) => !["modify", "pause", "resume", "remove"].includes(key)),
     availableRows
   });
   if (!result.confirmed) return "close";
@@ -595400,9 +596054,22 @@ import {
   lstatSync,
   statSync as statSync41,
   rmSync as rmSync4,
-  appendFileSync as appendFileSync8
+  appendFileSync as appendFileSync8,
+  writeSync as writeSync2
 } from "node:fs";
 import { relative as relative11, join as join120 } from "node:path";
+async function parseJsonResponse(resp, source) {
+  const body = await resp.text();
+  const trimmed = body.trim();
+  if (!trimmed) {
+    throw new Error(`${source} returned an empty response${resp.status ? ` (HTTP ${resp.status})` : ""}`);
+  }
+  try {
+    return JSON.parse(trimmed);
+  } catch {
+    throw new Error(`${source} returned malformed JSON${resp.status ? ` (HTTP ${resp.status})` : ""}`);
+  }
+}
 async function _immediateReregister(newUrl) {
   if (!_lastRegisteredSponsorPayload) return;
   _lastRegisteredSponsorPayload.tunnelUrl = newUrl;
@@ -595619,50 +596286,161 @@ function parseTelegramMessageIdList(value2) {
   if (!value2) return [];
   return [...new Set(value2.split(",").map((part) => Number(part.trim())).filter((num) => Number.isFinite(num)))];
 }
-async function runSudoScript(ctx3, script) {
-  const stdinAny = process.stdin;
-  const hadRaw = !!(stdinAny && stdinAny.isTTY && stdinAny.isRaw);
+function writeDirectTerminal(data) {
   try {
-    ctx3.deactivateStatusBar?.();
+    writeSync2(1, data);
   } catch {
+    try {
+      overlayWrite(data);
+    } catch {
+      process.stdout.write(data);
+    }
   }
+}
+function setRawInputMode(enabled2) {
+  const stdinAny = process.stdin;
   try {
     if (stdinAny && stdinAny.isTTY && typeof stdinAny.setRawMode === "function") {
-      stdinAny.setRawMode(false);
+      stdinAny.setRawMode(enabled2);
     }
   } catch {
   }
+}
+async function withTransientTerminalPrivilegePrompt(ctx3, reason, run2) {
+  const hasInteractiveTty = Boolean(process.stdin.isTTY && process.stdout.isTTY);
+  if (!hasInteractiveTty) return await run2();
+  const stdinAny = process.stdin;
+  const hadRaw = Boolean(stdinAny?.isTTY && stdinAny.isRaw);
+  const hadMouse = ctx3.isMouseEnabled?.() ?? false;
+  const hadElevationMode = Object.prototype.hasOwnProperty.call(
+    process.env,
+    "OMNIUS_ELEVATION_MODE"
+  );
+  const previousElevationMode = process.env["OMNIUS_ELEVATION_MODE"];
   try {
-    const { spawn: spawn34 } = await import("node:child_process");
-    const full = `set -e; ${script}`;
-    await new Promise((resolve56) => {
-      const usePkexec = process.platform === "linux";
-      const cmd = usePkexec ? "pkexec" : "sudo";
-      const args = usePkexec ? ["bash", "-lc", full] : ["-n", "bash", "-lc", full];
-      const child = spawn34(cmd, args, { stdio: ["ignore", "pipe", "pipe"] });
-      let stdout = "";
-      let stderr = "";
-      child.stdout?.on("data", (data) => {
-        stdout += data.toString();
-      });
-      child.stderr?.on("data", (data) => {
-        stderr += data.toString();
-      });
-      onChildExit(child, () => resolve56());
-      onChildError(child, () => resolve56());
-    });
+    ctx3.lockFooter?.();
   } catch {
   }
   try {
-    if (hadRaw && stdinAny && stdinAny.isTTY && typeof stdinAny.setRawMode === "function") {
-      stdinAny.setRawMode(true);
-    }
+    lockFooterRedraws();
   } catch {
   }
   try {
-    ctx3.showPrompt?.();
+    ctx3.disableMouse?.();
   } catch {
   }
+  setRawInputMode(false);
+  process.env["OMNIUS_ELEVATION_MODE"] = "terminal";
+  writeDirectTerminal(
+    "\x1B[?2026l\x1B[?25h\x1B[?1000l\x1B[?1002l\x1B[?1003l\x1B[?1006l\x1B[r\x1B[0m\x1B[2J\x1B[H"
+  );
+  writeDirectTerminal(
+    `${c3.bold("Omnius needs administrator privileges")}
+${reason}
+
+`
+  );
+  try {
+    return await run2();
+  } finally {
+    if (hadElevationMode) {
+      process.env["OMNIUS_ELEVATION_MODE"] = previousElevationMode;
+    } else {
+      delete process.env["OMNIUS_ELEVATION_MODE"];
+    }
+    setRawInputMode(hadRaw);
+    writeDirectTerminal(
+      "\x1B[?2026l\x1B[?25h\x1B[r\x1B[0m\x1B[2J\x1B[H"
+    );
+    try {
+      ctx3.unlockFooter?.();
+    } catch {
+    }
+    try {
+      unlockFooterRedraws();
+    } catch {
+    }
+    try {
+      ctx3.refreshDisplay?.();
+    } catch {
+    }
+    try {
+      if (hadMouse) {
+        ctx3.enableMouse?.();
+        writeDirectTerminal("\x1B[?1002h\x1B[?1006h");
+      } else {
+        writeDirectTerminal("\x1B[?1002l\x1B[?1006l");
+      }
+    } catch {
+    }
+    try {
+      ctx3.showPrompt?.();
+    } catch {
+    }
+  }
+}
+async function acquireSudoCredentials(ctx3, reason) {
+  const isRoot = typeof process.getuid === "function" && process.getuid() === 0;
+  if (isRoot) return true;
+  const { spawnSync: spawnSync8 } = await import("node:child_process");
+  return await withTransientTerminalPrivilegePrompt(ctx3, reason, () => {
+    const hasInteractiveTty = Boolean(process.stdin.isTTY && process.stdout.isTTY);
+    const sudoResult = spawnSync8(
+      "sudo",
+      hasInteractiveTty ? ["-v"] : ["-n", "-v"],
+      {
+        stdio: hasInteractiveTty ? "inherit" : "pipe",
+        timeout: 6e4
+      }
+    );
+    return sudoResult.status === 0;
+  });
+}
+async function runSudoScript(ctx3, script) {
+  try {
+    const { spawn: spawn34 } = await import("node:child_process");
+    const full = `set -e; ${script}`;
+    await withTransientTerminalPrivilegePrompt(
+      ctx3,
+      "Running elevated system changes.",
+      () => new Promise((resolve56, reject) => {
+        const isRoot = typeof process.getuid === "function" && process.getuid() === 0;
+        const hasInteractiveTty = Boolean(
+          process.stdin.isTTY && process.stdout.isTTY
+        );
+        const cmd = isRoot ? "bash" : "sudo";
+        const args = isRoot ? ["-lc", full] : hasInteractiveTty ? ["bash", "-lc", full] : ["-n", "bash", "-lc", full];
+        const child = spawn34(cmd, args, {
+          stdio: hasInteractiveTty ? "inherit" : ["ignore", "pipe", "pipe"],
+          env: { ...process.env, DEBIAN_FRONTEND: "noninteractive" }
+        });
+        let stdout = "";
+        let stderr = "";
+        child.stdout?.on("data", (data) => {
+          stdout += data.toString();
+        });
+        child.stderr?.on("data", (data) => {
+          stderr += data.toString();
+        });
+        onChildExit(child, (code8) => {
+          if (code8 === 0) {
+            resolve56();
+            return;
+          }
+          reject(
+            new Error(
+              (stderr || stdout || `elevated command exited with ${code8}`).trim().slice(0, 500)
+            )
+          );
+        });
+        onChildError(child, (err) => reject(err));
+      })
+    );
+  } catch (err) {
+    renderWarning(
+      `Elevated command failed: ${err instanceof Error ? err.message : String(err)}`
+    );
+  }
 }
 async function ensureVoiceDeps(ctx3) {
   try {
@@ -600137,7 +600915,8 @@ sleep 1
             authKey: tunnelGw?.authKey || "",
             limits: {
               maxRequestsPerMinute: config.rateLimits.maxRequestsPerMinute,
-              maxTokensPerDay: config.rateLimits.maxTokensPerDay
+              maxTokensPerDay: config.rateLimits.maxTokensPerDay,
+              maxConcurrent: config.rateLimits.maxConcurrent
             },
             banner: "none",
             message: config.header.message || sponsorName,
@@ -600161,7 +600940,10 @@ sleep 1
                 signal: AbortSignal.timeout(1e4)
               }
             );
-            const kvResult = await kvResp.json();
+            const kvResult = await parseJsonResponse(
+              kvResp,
+              "Sponsor directory"
+            );
             if (kvResult.persisted) {
               _spLog("KV registration: persisted");
               renderInfo(
@@ -605450,7 +606232,7 @@ async function handleSponsoredEndpoint(ctx3, local) {
       signal: AbortSignal.timeout(5e3)
     });
     if (kvResp.ok) {
-      const kvData = await kvResp.json();
+      const kvData = await parseJsonResponse(kvResp, "Sponsor directory");
       const kvSponsors = (kvData.sponsors || []).filter(
         (s2) => s2.status === "active"
       );
@@ -606706,14 +607488,23 @@ async function handleUpdate(subcommand, ctx3) {
       renderInfo("Updating Ollama to the latest version...");
     }
     try {
-      if (doUpdateOllama()) {
+      const updated = await withTransientTerminalPrivilegePrompt(
+        ctx3,
+        "Updating Ollama may need administrator privileges.",
+        () => doUpdateOllama()
+      );
+      if (updated) {
         renderInfo("Ollama updated successfully.");
         try {
           const { runElevatedCommand: runElevatedCommand2 } = await Promise.resolve().then(() => (init_setup(), setup_exports));
-          runElevatedCommand2("systemctl restart ollama", {
-            timeoutMs: 1e4,
-            swallowErrors: true
-          });
+          await withTransientTerminalPrivilegePrompt(
+            ctx3,
+            "Restarting the Ollama service may need administrator privileges.",
+            () => runElevatedCommand2("systemctl restart ollama", {
+              timeoutMs: 1e4,
+              swallowErrors: true
+            })
+          );
         } catch {
         }
       } else {
@@ -606770,13 +607561,6 @@ async function handleUpdate(subcommand, ctx3) {
     "⣀",
     "⡀"
   ];
-  const safeWrite = (text) => {
-    if (isNeovimActive()) {
-      writeToNeovimOutput(text);
-    } else {
-      process.stdout.write(text);
-    }
-  };
   const PROGRESS_BLOCKS = [
     " ",
     "⠁",
@@ -606958,9 +607742,9 @@ async function handleUpdate(subcommand, ctx3) {
     (async () => {
       try {
         const prefix = await execA("npm prefix -g", { timeout: 5e3 });
-        const { accessSync, constants } = await import("node:fs");
+        const { accessSync: accessSync2, constants: constants2 } = await import("node:fs");
         try {
-          accessSync(prefix, constants.W_OK);
+          accessSync2(prefix, constants2.W_OK);
           return false;
         } catch {
           return true;
@@ -607200,7 +607984,16 @@ async function handleUpdate(subcommand, ctx3) {
       const globalModules = prefix.endsWith("/lib") ? prefix + "/node_modules" : prefix + "/lib/node_modules";
       const { join: pj3 } = await import("node:path");
       const omniusPkgDir = pj3(globalModules, "omnius");
-      const sudoPrefix2 = needsSudo ? "sudo " : "";
+      if (needsSudo && !await acquireSudoCredentials(
+        ctx3,
+        `Updating ${depName} in the global Omnius install requires administrator privileges.`
+      )) {
+        renderWarning(
+          "Could not acquire sudo credentials. Try: sudo npm i -g omnius"
+        );
+        return;
+      }
+      const sudoPrefix2 = needsSudo ? "sudo -n " : "";
       const cmd = `${sudoPrefix2}npm install ${depName}@latest --prefer-online --save --prefix "${omniusPkgDir}" 2>&1`;
       const result = await execA(cmd, { timeout: 6e4 }).catch(
         (e2) => e2.message
@@ -607220,14 +608013,23 @@ async function handleUpdate(subcommand, ctx3) {
     renderInfo("Updating Ollama...");
     try {
       const { updateOllama: updateOllama2 } = await Promise.resolve().then(() => (init_setup(), setup_exports));
-      if (updateOllama2()) {
+      const updated = await withTransientTerminalPrivilegePrompt(
+        ctx3,
+        "Updating Ollama may need administrator privileges.",
+        () => updateOllama2()
+      );
+      if (updated) {
         renderInfo(`Ollama updated successfully!`);
         try {
-          const { execSync: es } = await import("node:child_process");
-          es("sudo systemctl restart ollama 2>/dev/null || true", {
-            timeout: 1e4,
-            stdio: "pipe"
-          });
+          const { runElevatedCommand: runElevatedCommand2 } = await Promise.resolve().then(() => (init_setup(), setup_exports));
+          await withTransientTerminalPrivilegePrompt(
+            ctx3,
+            "Restarting the Ollama service may need administrator privileges.",
+            () => runElevatedCommand2("systemctl restart ollama", {
+              timeoutMs: 1e4,
+              swallowErrors: true
+            })
+          );
         } catch {
         }
       } else {
@@ -607257,7 +608059,7 @@ async function handleUpdate(subcommand, ctx3) {
     return compact3.slice(0, Math.max(1, max - 1)).trimEnd() + "…";
   };
   const summarizeInstallCommand = (cmd) => {
-    const cleaned = cmd.replace(/^\s*sudo\s+/, "").replace(/\s+2>\/dev\/null/g, "").replace(/\s+\|\|\s+true\s*$/g, "").replace(/\s+/g, " ").trim();
+    const cleaned = cmd.replace(/^\s*sudo(?:\s+-n)?\s+/, "").replace(/\s+2>\/dev\/null/g, "").replace(/\s+\|\|\s+true\s*$/g, "").replace(/\s+/g, " ").trim();
     if (/^npm install -g omnius@/i.test(cleaned)) {
       const match = cleaned.match(/omnius@([^\s]+)/i);
       return `installing omnius@${match?.[1] ?? "latest"}`;
@@ -607389,17 +608191,11 @@ async function handleUpdate(subcommand, ctx3) {
     installOverlay.stop("Requesting permissions...");
     await new Promise((r2) => setTimeout(r2, 300));
     installOverlay.dismiss();
-    renderInfo("Global npm directory requires elevated permissions.");
-    renderInfo("Enter your password if prompted...");
-    safeWrite("\n");
-    try {
-      const { spawnSync: spawnSync8 } = await import("node:child_process");
-      const sudoResult = spawnSync8("sudo", ["-v"], {
-        stdio: "inherit",
-        timeout: 6e4
-      });
-      if (sudoResult.status !== 0) throw new Error("sudo failed");
-    } catch {
+    const sudoReady = await acquireSudoCredentials(
+      ctx3,
+      "The global npm directory requires elevated permissions for this update."
+    );
+    if (!sudoReady) {
       renderWarning(
         "Could not acquire sudo credentials. Try: sudo npm i -g omnius"
       );
@@ -607408,7 +608204,8 @@ async function handleUpdate(subcommand, ctx3) {
     const installOverlay2 = startInstallOverlay(targetVersion);
     Object.assign(installOverlay, installOverlay2);
   }
-  const sudoPrefix = needsSudo ? "sudo " : "";
+  const sudoPrefix = needsSudo ? "sudo -n " : "";
+  const manualSudoPrefix = needsSudo ? "sudo " : "";
   let primaryUpdated = false;
   let depsUpdated = false;
   const totalPhases = (doPackage && info ? 5 : 0) + (doDeps ? 5 : 0) + (doRebuild ? 3 : 0) + (doPython ? 3 : 0) + (doCloudflared ? 2 : 0) + (doOllama ? 2 : 0);
@@ -607463,7 +608260,7 @@ async function handleUpdate(subcommand, ctx3) {
       installOverlay.stop("Install failed");
       await new Promise((r2) => setTimeout(r2, 2e3));
       installOverlay.dismiss();
-      const hint = process.platform === "win32" ? `npm i -g omnius${versionSpec} (run terminal as Administrator)` : `${sudoPrefix}npm cache clean --force && ${sudoPrefix}npm i -g omnius${versionSpec}`;
+      const hint = process.platform === "win32" ? `npm i -g omnius${versionSpec} (run terminal as Administrator)` : `${manualSudoPrefix}npm cache clean --force && ${manualSudoPrefix}npm i -g omnius${versionSpec}`;
       renderWarning(
         `Update failed: ${installError.slice(0, 150) || "unknown error"}`
       );
@@ -607556,17 +608353,38 @@ async function handleUpdate(subcommand, ctx3) {
     installOverlay.setPhase("Ollama");
     installOverlay.setStatus("Updating Ollama...");
     try {
-      const { updateOllama: doOllamaUpgrade } = await Promise.resolve().then(() => (init_setup(), setup_exports));
-      if (doOllamaUpgrade()) {
-        installOverlay.setStatus(`Ollama updated to ${ollamaUpdate.latest}`);
-        try {
-          const { execSync: es22 } = await import("node:child_process");
-          es22("sudo systemctl restart ollama 2>/dev/null || true", {
-            timeout: 1e4,
-            stdio: "pipe"
-          });
-        } catch {
+      installOverlay.stop("Updating Ollama...");
+      await new Promise((r2) => setTimeout(r2, 300));
+      installOverlay.dismiss();
+      const ollamaUpdated = await withTransientTerminalPrivilegePrompt(
+        ctx3,
+        "Updating Ollama may need administrator privileges.",
+        async () => {
+          const {
+            updateOllama: doOllamaUpgrade,
+            runElevatedCommand: runElevatedCommand2
+          } = await Promise.resolve().then(() => (init_setup(), setup_exports));
+          const ok3 = doOllamaUpgrade();
+          if (ok3) {
+            try {
+              runElevatedCommand2("systemctl restart ollama", {
+                timeoutMs: 1e4,
+                swallowErrors: true
+              });
+            } catch {
+            }
+          }
+          return ok3;
         }
+      );
+      const installOverlay3 = startInstallOverlay(targetVersion);
+      Object.assign(installOverlay, installOverlay3);
+      installOverlay.setProgress(completedPhases, totalPhases);
+      installOverlay.setPhase("Ollama");
+      if (ollamaUpdated) {
+        installOverlay.setStatus(`Ollama updated to ${ollamaUpdate.latest}`);
+      } else {
+        installOverlay.setStatus("Ollama update skipped/failed");
       }
     } catch {
     }
@@ -607657,7 +608475,18 @@ async function handleUpdate(subcommand, ctx3) {
     if (!hasPython) {
       installOverlay.setStatus("Installing Python3...");
       try {
-        ensurePython3();
+        installOverlay.stop("Installing Python3...");
+        await new Promise((r2) => setTimeout(r2, 300));
+        installOverlay.dismiss();
+        await withTransientTerminalPrivilegePrompt(
+          ctx3,
+          "Installing Python3 may need administrator privileges.",
+          () => ensurePython3()
+        );
+        const installOverlayPy = startInstallOverlay(targetVersion);
+        Object.assign(installOverlay, installOverlayPy);
+        installOverlay.setProgress(completedPhases, totalPhases);
+        installOverlay.setPhase("Python");
         hasPython = hasCmd("python3") || hasCmd("python");
       } catch {
       }
@@ -607668,7 +608497,18 @@ async function handleUpdate(subcommand, ctx3) {
     if (hasPython && !checkPythonVenv()) {
       installOverlay.setStatus("Installing python3-venv...");
       try {
-        ensurePythonVenv();
+        installOverlay.stop("Installing python3-venv...");
+        await new Promise((r2) => setTimeout(r2, 300));
+        installOverlay.dismiss();
+        await withTransientTerminalPrivilegePrompt(
+          ctx3,
+          "Installing python3-venv may need administrator privileges.",
+          () => ensurePythonVenv()
+        );
+        const installOverlayVenv = startInstallOverlay(targetVersion);
+        Object.assign(installOverlay, installOverlayVenv);
+        installOverlay.setProgress(completedPhases, totalPhases);
+        installOverlay.setPhase("Python");
       } catch {
       }
     }
@@ -607689,9 +608529,20 @@ async function handleUpdate(subcommand, ctx3) {
       installOverlay.setStatus("Python packages updated");
     } else {
       installOverlay.setStatus("Setting up Python venv...");
-      await ensureVisionDeps(() => {
-      }).catch(() => {
+      installOverlay.stop("Setting up Python dependencies...");
+      await new Promise((r2) => setTimeout(r2, 300));
+      installOverlay.dismiss();
+      await withTransientTerminalPrivilegePrompt(
+        ctx3,
+        "Installing Python vision dependencies may need administrator privileges.",
+        () => ensureVisionDeps(() => {
+        })
+      ).catch(() => {
       });
+      const installOverlayVision = startInstallOverlay(targetVersion);
+      Object.assign(installOverlay, installOverlayVision);
+      installOverlay.setProgress(completedPhases, totalPhases);
+      installOverlay.setPhase("Python");
       installOverlay.setStatus("Python deps bootstrapped");
     }
     completedPhases += 3;
@@ -607709,13 +608560,33 @@ async function handleUpdate(subcommand, ctx3) {
     }
     if (!hasCf) {
       installOverlay.setStatus("Installing cloudflared...");
-      void ensureCloudflaredBackground(() => {
-      });
-      await new Promise((r2) => setTimeout(r2, 1e3));
+      installOverlay.stop("Installing cloudflared...");
+      await new Promise((r2) => setTimeout(r2, 300));
+      installOverlay.dismiss();
+      await withTransientTerminalPrivilegePrompt(
+        ctx3,
+        "Installing cloudflared may need administrator privileges.",
+        () => ensureCloudflaredBackground(() => {
+        })
+      ).catch(() => false);
+      const installOverlayCf = startInstallOverlay(targetVersion);
+      Object.assign(installOverlay, installOverlayCf);
+      installOverlay.setProgress(completedPhases, totalPhases);
+      installOverlay.setPhase("Cloudflared");
     } else {
       installOverlay.setStatus("cloudflared ready");
     }
-    void ensureTranscribeCliBackground();
+    installOverlay.setStatus("Checking transcribe-cli...");
+    if (!hasCmd("transcribe-cli")) {
+      await withTransientTerminalPrivilegePrompt(
+        ctx3,
+        "Installing transcribe-cli may need administrator privileges.",
+        () => ensureTranscribeCliBackground()
+      ).catch(() => false);
+    } else {
+      await ensureTranscribeCliBackground().catch(() => false);
+    }
+    installOverlay.setStatus("cloudflared/transcribe checks complete");
   }
   if (!primaryUpdated) {
     installOverlay.stop("Done — no restart needed");
@@ -615894,7 +616765,7 @@ function fmtDuration(ms) {
   const rm4 = m2 % 60;
   return `${h}h ${rm4}m`;
 }
-function fmtTokens2(n2) {
+function fmtTokens3(n2) {
   if (n2 < 1e3) return String(n2);
   if (n2 < 1e6) return `${(n2 / 1e3).toFixed(1)}K`;
   return `${(n2 / 1e6).toFixed(2)}M`;
@@ -615923,8 +616794,8 @@ function buildMetricEntries(snap, scope) {
   entries.push({
     icon: "",
     label: "Tokens",
-    value: fmtTokens2(snap.totalTokens),
-    detail: `Prompt: ${fmtTokens2(snap.totalPromptTokens)} · Completion: ${fmtTokens2(snap.totalCompletionTokens)}`,
+    value: fmtTokens3(snap.totalTokens),
+    detail: `Prompt: ${fmtTokens3(snap.totalPromptTokens)} · Completion: ${fmtTokens3(snap.totalCompletionTokens)}`,
     category: "inference"
   });
   entries.push({
@@ -615960,14 +616831,14 @@ function buildMetricEntries(snap, scope) {
   entries.push({
     icon: "",
     label: "Context Window",
-    value: fmtTokens2(snap.contextWindowSize),
+    value: fmtTokens3(snap.contextWindowSize),
     category: "context"
   });
   entries.push({
     icon: "",
     label: "Context Used",
-    value: fmtTokens2(snap.estimatedContextTokens),
-    detail: `Utilization: ${fmtPct(snap.contextUtilizationPct)} · Peak: ${fmtTokens2(snap.peakContextTokens)}`,
+    value: fmtTokens3(snap.estimatedContextTokens),
+    detail: `Utilization: ${fmtPct(snap.contextUtilizationPct)} · Peak: ${fmtTokens3(snap.peakContextTokens)}`,
     category: "context"
   });
   entries.push({
@@ -661490,7 +662361,8 @@ Log: ${nexusLogPath}`)
             status: stats.status,
             totalRequests: stats.totalRequests,
             activeConnections: stats.activeConnections,
-            modelUsage: stats.modelUsage
+            modelUsage: stats.modelUsage,
+            tokensPerSecond: stats.tokensPerSecond
           });
         });
         reconnected.on("token_flash", () => statusBar.flashExposeToken());
@@ -661533,7 +662405,8 @@ Log: ${nexusLogPath}`)
             status: stats.status,
             totalRequests: stats.totalRequests,
             activeConnections: stats.activeConnections,
-            modelUsage: stats.modelUsage
+            modelUsage: stats.modelUsage,
+            tokensPerSecond: stats.tokensPerSecond
           });
         });
         reconnectedP2P.on("token_flash", () => statusBar.flashExposeToken());
@@ -661639,7 +662512,8 @@ Log: ${nexusLogPath}`)
               { signal: AbortSignal.timeout(8e3) }
             );
             if (spResp.ok) {
-              const spData = await spResp.json();
+              const spText = await spResp.text();
+              const spData = spText.trim() ? JSON.parse(spText) : { sponsors: [] };
               let active = (spData.sponsors || []).filter(
                 (s2) => s2.status === "active" && s2.tunnelUrl
               );
@@ -662000,6 +662874,9 @@ Log: ${nexusLogPath}`)
       statusBar.fillContentArea();
       statusBar.refreshHeaderContent();
     },
+    refreshDisplay() {
+      statusBar.refreshDisplay();
+    },
     exit() {
       if (reminderDispatchTimer) {
         clearInterval(reminderDispatchTimer);
@@ -663422,7 +664299,8 @@ Respond concisely and safely. Remember: you are talking to the general public.`;
             status: stats.status,
             totalRequests: stats.totalRequests,
             activeConnections: stats.activeConnections,
-            modelUsage: stats.modelUsage
+            modelUsage: stats.modelUsage,
+            tokensPerSecond: stats.tokensPerSecond
           });
         });
         newP2P.on("token_flash", () => statusBar.flashExposeToken());
@@ -663463,7 +664341,8 @@ Respond concisely and safely. Remember: you are talking to the general public.`;
           status: stats.status,
           totalRequests: stats.totalRequests,
           activeConnections: stats.activeConnections,
-          modelUsage: stats.modelUsage
+          modelUsage: stats.modelUsage,
+          tokensPerSecond: stats.tokensPerSecond
         });
       });
       newTunnel.on("token_flash", () => statusBar.flashExposeToken());