omnius 1.0.18 → 1.0.20

package/dist/index.js

@@ -15546,8 +15546,8 @@ function deleteCustomToolDefinition(name10, scope, repoRoot) {
   const dir = scope === "project" && repoRoot ? projectToolsDir(repoRoot) : globalToolsDir();
   const filePath = join24(dir, `${name10}.json`);
   if (existsSync19(filePath)) {
-    const { unlinkSync: unlinkSync25 } = __require("node:fs");
-    unlinkSync25(filePath);
+    const { unlinkSync: unlinkSync26 } = __require("node:fs");
+    unlinkSync26(filePath);
     return true;
   }
   return false;
@@ -25254,7 +25254,7 @@ function ecdsa(Point, hash, ecdsaOpts = {}) {
     bits2int_modN: "function"
   });
   ecdsaOpts = Object.assign({}, ecdsaOpts);
-  const randomBytes25 = ecdsaOpts.randomBytes || randomBytes7;
+  const randomBytes26 = ecdsaOpts.randomBytes || randomBytes7;
   const hmac2 = ecdsaOpts.hmac || ((key, msg) => hmac(hash, key, msg));
   const { Fp, Fn } = Point;
   const { ORDER: CURVE_ORDER, BITS: fnBits } = Fn;
@@ -25396,7 +25396,7 @@ function ecdsa(Point, hash, ecdsaOpts = {}) {
       throw new Error("invalid private key");
     const seedArgs = [int2octets(d2), int2octets(h1int)];
     if (extraEntropy != null && extraEntropy !== false) {
-      const e2 = extraEntropy === true ? randomBytes25(lengths.secretKey) : extraEntropy;
+      const e2 = extraEntropy === true ? randomBytes26(lengths.secretKey) : extraEntropy;
       seedArgs.push(abytes(e2, void 0, "extraEntropy"));
     }
     const seed = concatBytes(...seedArgs);
@@ -61906,9 +61906,9 @@ var init_cookies = __esm({
 
 // ../node_modules/@libp2p/http-peer-id-auth/dist/src/utils.js
 function generateChallenge() {
-  const randomBytes25 = new Uint8Array(32);
-  crypto.getRandomValues(randomBytes25);
-  return toString2(randomBytes25, "base64urlpad");
+  const randomBytes26 = new Uint8Array(32);
+  crypto.getRandomValues(randomBytes26);
+  return toString2(randomBytes26, "base64urlpad");
 }
 function encodeAuthParams(params) {
   const encodedParams = Object.entries(params).map(([key, value2]) => `${key}="${value2}"`).join(", ");
@@ -84452,7 +84452,7 @@ var require_mime_types = __commonJS({
   "../node_modules/mime-types/index.js"(exports) {
     "use strict";
     var db = require_mime_db();
-    var extname15 = __require("path").extname;
+    var extname16 = __require("path").extname;
     var EXTRACT_TYPE_REGEXP = /^\s*([^;\s]*)(?:;|\s|$)/;
     var TEXT_TYPE_REGEXP = /^text\//i;
     exports.charset = charset;
@@ -84506,7 +84506,7 @@ var require_mime_types = __commonJS({
       if (!path11 || typeof path11 !== "string") {
         return false;
       }
-      var extension4 = extname15("x." + path11).toLowerCase().substr(1);
+      var extension4 = extname16("x." + path11).toLowerCase().substr(1);
       if (!extension4) {
         return false;
       }
@@ -234104,7 +234104,7 @@ var require_websocket2 = __commonJS({
     var http6 = __require("http");
     var net5 = __require("net");
     var tls2 = __require("tls");
-    var { randomBytes: randomBytes25, createHash: createHash24 } = __require("crypto");
+    var { randomBytes: randomBytes26, createHash: createHash24 } = __require("crypto");
     var { Duplex: Duplex3, Readable } = __require("stream");
     var { URL: URL3 } = __require("url");
     var PerMessageDeflate3 = require_permessage_deflate2();
@@ -234634,7 +234634,7 @@ var require_websocket2 = __commonJS({
         }
       }
       const defaultPort = isSecure ? 443 : 80;
-      const key = randomBytes25(16).toString("base64");
+      const key = randomBytes26(16).toString("base64");
       const request = isSecure ? https4.request : http6.request;
       const protocolSet = /* @__PURE__ */ new Set();
       let perMessageDeflate;
@@ -255836,8 +255836,8 @@ var init_browser_action = __esm({
               const afterDom = await apiCall("/dom", "GET");
               const afterTitle = (afterDom.dom || "").match(/<title[^>]*>([^<]*)<\/title>/i)?.[1] || "";
               try {
-                const { unlinkSync: unlinkSync25 } = await import("node:fs");
-                unlinkSync25(imagePath);
+                const { unlinkSync: unlinkSync26 } = await import("node:fs");
+                unlinkSync26(imagePath);
               } catch {
               }
               return {
@@ -477005,7 +477005,7 @@ var require_path_browserify = __commonJS({
           return path11.slice(start2, end);
         }
       },
-      extname: function extname15(path11) {
+      extname: function extname16(path11) {
         assertPath(path11);
         var startDot = -1;
         var startPart = 0;
@@ -507302,12 +507302,23 @@ function ensureGeneratedVoiceDir() {
   mkdirSync16(generatedVoiceDir(), { recursive: true });
 }
 function ttsOutputPath(args, backend) {
-  const output = typeof args["output"] === "string" ? args["output"] : typeof args["output_path"] === "string" ? args["output_path"] : "";
-  if (output.trim())
-    return resolvePath(output.trim());
+  for (const key of ["output", "output_path", "path", "file_path", "file"]) {
+    const output = args[key];
+    if (typeof output === "string" && output.trim()) {
+      return resolvePath(output.trim());
+    }
+  }
   ensureGeneratedVoiceDir();
   return join58(generatedVoiceDir(), `tts-${backend}-${Date.now()}-${Math.random().toString(36).slice(2, 7)}.wav`);
 }
+function ttsTextArg(args) {
+  for (const key of ["text", "input", "prompt", "content", "message"]) {
+    const value2 = args[key];
+    if (typeof value2 === "string" && value2.trim())
+      return value2.trim();
+  }
+  return "";
+}
 function listCloneRefs() {
   try {
     return readdirSync14(cloneRefsDir()).filter((file) => /\.(wav|mp3|flac|ogg|m4a)$/i.test(file) && existsSync40(join58(cloneRefsDir(), file))).sort((a2, b) => a2.localeCompare(b));
@@ -507348,6 +507359,12 @@ function supertonicInferScript() {
 function mlxVenvPy() {
   return process.platform === "win32" ? join58(voiceDir(), "mlx-venv", "Scripts", "python.exe") : join58(voiceDir(), "mlx-venv", "bin", "python3");
 }
+function piperVenvDir() {
+  return join58(voiceDir(), "piper-venv");
+}
+function piperVenvBin() {
+  return process.platform === "win32" ? join58(piperVenvDir(), "Scripts", "piper.exe") : join58(piperVenvDir(), "bin", "piper");
+}
 function ensureSupertonicInstalled() {
   const venvPy = supertonicVenvPy();
   if (!existsSync40(venvPy)) {
@@ -507385,6 +507402,25 @@ function ensureMlxInstalled() {
   }
   return venvPy;
 }
+function ensurePiperInstalled() {
+  if (hasCommand3("piper"))
+    return "piper";
+  const bin = piperVenvBin();
+  if (!existsSync40(bin)) {
+    const py = findPython32();
+    if (!py)
+      throw new Error("python3 is required to set up Piper TTS.");
+    mkdirSync16(voiceDir(), { recursive: true });
+    execFileSync2(py, ["-m", "venv", piperVenvDir()], { stdio: "pipe", timeout: 18e4 });
+    const venvPy = process.platform === "win32" ? join58(piperVenvDir(), "Scripts", "python.exe") : join58(piperVenvDir(), "bin", "python3");
+    execFileSync2(venvPy, ["-m", "pip", "install", "--quiet", "--upgrade", "pip"], { stdio: "pipe", timeout: 12e4 });
+    execFileSync2(venvPy, ["-m", "pip", "install", "--quiet", "piper-tts"], { stdio: "pipe", timeout: 6e5 });
+  }
+  if (!existsSync40(bin)) {
+    throw new Error("Piper TTS installed but the piper executable was not found in the managed venv.");
+  }
+  return bin;
+}
 function saveCloneRefFromSample(sample, cloneName) {
   const source = resolvePath(sample);
   if (!existsSync40(source))
@@ -507552,7 +507588,7 @@ except Exception as exc:
 `;
     AudioPlaybackTool = class {
       name = "audio_playback";
-      description = "Play audio through speakers, synthesize text-to-speech, and manage TTS clone voices. Actions: 'play' to play an audio file (WAV/MP3/OGG — including recordings from memory episodes), 'speak' to synthesize and play text, 'synthesize' to save TTS to a WAV file, 'clone' to register a voice-clone sample, 'list_voices' to inspect available clone refs/backends, 'volume' to get or set system volume, 'list' to enumerate audio output devices. TTS backends are explicit: auto, luxtts, supertonic, mlx, onnx/piper, or espeak. Use generate_tts when the task is specifically to create a TTS file.";
+      description = "Play audio through speakers, synthesize text-to-speech, and manage TTS clone voices. Actions: 'play' to play an audio file (WAV/MP3/OGG — including recordings from memory episodes), 'speak' to synthesize and play text, 'synthesize' to save TTS to a WAV file, 'clone' to register a voice-clone sample, 'list_voices' to inspect available clone refs/backends, 'volume' to get or set system volume, 'list' to enumerate audio output devices. TTS backends are explicit: auto, luxtts, supertonic, mlx, onnx/piper, or espeak. Neural TTS backends self-provision into ~/.omnius/voice on first use where supported. Use generate_tts when the task is specifically to create a TTS file; do not use shell speech commands or generate_audio for spoken TTS.";
       parameters = {
         type: "object",
         properties: {
@@ -507569,6 +507605,14 @@ except Exception as exc:
             type: "string",
             description: "Text to speak or synthesize"
           },
+          input: {
+            type: "string",
+            description: "Alias for text."
+          },
+          prompt: {
+            type: "string",
+            description: "Alias for text."
+          },
           backend: {
             type: "string",
             enum: ["auto", "luxtts", "supertonic", "mlx", "onnx", "piper", "espeak"],
@@ -507598,6 +507642,10 @@ except Exception as exc:
             type: "string",
             description: "Backend model id or raw ONNX/Piper model path. MLX default is mlx-community/Kokoro-82M-bf16."
           },
+          strict_backend: {
+            type: "boolean",
+            description: "When true, fail instead of falling back if the requested TTS backend is unavailable. Defaults false."
+          },
           volume: {
             type: "number",
             description: "Volume level 0-100 (for 'volume' action to SET volume)"
@@ -507693,7 +507741,7 @@ except Exception as exc:
           `  luxtts: ${existsSync40(join58(voiceDir(), "luxtts-venv", "bin", "python3")) ? "installed" : "not installed"}; clone refs: ${refs.length}`,
           `  supertonic: ${existsSync40(supertonicVenvPy()) ? "installed" : "not installed"}; voices include M1, M2, M3, M4 when package assets are available`,
           `  mlx: ${existsSync40(mlxVenvPy()) ? "installed" : "not installed"}; Apple Silicon only; default model mlx-community/Kokoro-82M-bf16`,
-          `  piper/onnx: ${hasCommand3("piper") ? "available" : "not found"}; pass model=<path.onnx> for raw ONNX voices`,
+          `  piper/onnx: ${hasCommand3("piper") || existsSync40(piperVenvBin()) ? "available" : "not installed"}; first use installs piper-tts into ${piperVenvDir()}; pass model=<path.onnx> for raw ONNX voices`,
           `  espeak: ${hasCommand3("espeak-ng") ? "available" : "not found"}`,
           "",
           "Registered clone refs:",
@@ -507702,16 +507750,18 @@ except Exception as exc:
         return { success: true, output: lines.join("\n"), durationMs: performance.now() - start2 };
       }
       async synthesizeText(args, start2, speakDefault) {
-        const text = typeof args["text"] === "string" ? args["text"].trim() : "";
+        const text = ttsTextArg(args);
         if (!text) {
           return { success: false, output: "", error: "Missing 'text' parameter. Provide text to synthesize.", durationMs: performance.now() - start2 };
         }
         const requestedBackend = normalizeTtsBackend(args["backend"]);
+        const strictBackend = boolArg(args["strict_backend"] ?? args["strictBackend"], false);
         const playback = playbackArg(args, speakDefault);
         const outputPath2 = ttsOutputPath(args, requestedBackend);
         const device = typeof args["device"] === "string" ? args["device"] : "default";
         const tried = [];
-        const candidates = requestedBackend === "auto" ? ["luxtts", "supertonic", ...process.platform === "darwin" && process.arch === "arm64" ? ["mlx"] : [], "piper", "espeak"] : [requestedBackend];
+        const autoCandidates = ["luxtts", "supertonic", ...process.platform === "darwin" && process.arch === "arm64" ? ["mlx"] : [], "piper", "espeak"];
+        const candidates = requestedBackend === "auto" ? autoCandidates : strictBackend ? [requestedBackend] : [requestedBackend, ...autoCandidates.filter((backend) => backend !== requestedBackend)];
         let usedBackend = "";
         let voiceSummary = "";
         for (const backend of candidates) {
@@ -507734,7 +507784,7 @@ except Exception as exc:
           } catch (err) {
             const message2 = err instanceof Error ? err.message : String(err);
             tried.push(`${backend}: ${message2.slice(0, 300)}`);
-            if (requestedBackend !== "auto") {
+            if (requestedBackend !== "auto" && strictBackend) {
               return { success: false, output: "", error: `${backend} TTS failed: ${message2}`, durationMs: performance.now() - start2 };
             }
           }
@@ -507754,11 +507804,13 @@ ${tried.map((line) => `- ${line}`).join("\n")}`,
         })() : "  Playback: disabled";
         const size = Math.round(statSync18(outputPath2).size / 1024);
         const preview = text.length > 140 ? `${text.slice(0, 137)}...` : text;
+        const fallbackLine = requestedBackend !== "auto" && usedBackend !== requestedBackend ? `  Fallback: requested ${requestedBackend}; ${tried[0] ?? "requested backend unavailable"}` : "";
         return {
           success: true,
           output: [
             `TTS generated: ${outputPath2}`,
             `  Backend: ${usedBackend}`,
+            fallbackLine,
             voiceSummary ? `  Voice: ${voiceSummary}` : "",
             `  Size: ${size}KB`,
             playbackLine,
@@ -507783,8 +507835,9 @@ ${tried.map((line) => `- ${line}`).join("\n")}`,
         }
         const venvPy = join58(voiceDir(), "luxtts-venv", "bin", "python3");
         const repoDir = join58(voiceDir(), "LuxTTS");
-        if (!existsSync40(venvPy) || !existsSync40(repoDir))
-          throw new Error("LuxTTS is not installed. Run /voice model luxtts or set up the LuxTTS voice backend first.");
+        if (!existsSync40(venvPy) || !existsSync40(repoDir)) {
+          throw new Error("LuxTTS is not installed in the managed voice environment yet.");
+        }
         const pyScript = [
           "import json, sys, wave",
           "import numpy as np, torch",
@@ -507842,8 +507895,7 @@ ${tried.map((line) => `- ${line}`).join("\n")}`,
         return `${voice} (${model})`;
       }
       synthesizePiper(text, outputPath2, args, requireModel) {
-        if (!hasCommand3("piper"))
-          throw new Error("piper command not found. Install Piper for ONNX TTS.");
+        const piper = ensurePiperInstalled();
         const rawModel = typeof args["model"] === "string" ? args["model"] : typeof args["voice"] === "string" && /\.(onnx|onnx\.json)$/i.test(args["voice"]) ? args["voice"] : "";
         const argv = ["--output_file", outputPath2];
         let summary = "default piper voice";
@@ -507853,10 +507905,10 @@ ${tried.map((line) => `- ${line}`).join("\n")}`,
             throw new Error(`Piper/ONNX model file not found: ${rawModel}`);
           argv.unshift("--model", modelPath);
           summary = basename12(modelPath);
-        } else if (requireModel) {
-          throw new Error("Raw ONNX TTS requires model=<path.onnx> or voice=<path.onnx>.");
+        } else {
+          throw new Error(`${requireModel ? "Raw ONNX" : "Piper"} TTS requires model=<path.onnx> or voice=<path.onnx>.`);
         }
-        execFileSync2("piper", argv, { input: text, stdio: ["pipe", "pipe", "pipe"], timeout: 12e4 });
+        execFileSync2(piper, argv, { input: text, stdio: ["pipe", "pipe", "pipe"], timeout: 12e4 });
         return summary;
       }
       synthesizeEspeak(text, outputPath2, args) {
@@ -507943,14 +507995,18 @@ ${devices.join("\n")}`,
     };
     TtsGenerateTool = class {
       name = "generate_tts";
-      description = "Generate text-to-speech audio as a WAV file, optionally playing it after synthesis. Supports explicit backends: auto, luxtts voice cloning, supertonic, mlx, onnx/piper, and espeak. Use clone_ref to select a registered LuxTTS voice, sample+clone_name to register a clone sample via audio_playback action=clone, and playback=false for silent file generation.";
+      description = "Generate text-to-speech audio as a WAV file, optionally playing it after synthesis. Supports explicit backends: auto, luxtts voice cloning, supertonic, mlx, onnx/piper, and espeak. Neural TTS backends self-provision into ~/.omnius/voice on first use where supported. Use clone_ref to select a registered LuxTTS voice, sample+clone_name to register a clone sample via audio_playback action=clone, and playback=false for silent file generation. Use this tool for speech/TTS requests; do not use shell commands or generate_audio as a TTS fallback.";
       parameters = {
         type: "object",
         properties: {
           text: { type: "string", description: "Text to synthesize" },
+          input: { type: "string", description: "Alias for text." },
+          prompt: { type: "string", description: "Alias for text." },
           backend: { type: "string", enum: ["auto", "luxtts", "supertonic", "mlx", "onnx", "piper", "espeak"] },
           output: { type: "string", description: "Output WAV path. Defaults to ~/.omnius/voice/generated/tts-*.wav." },
+          path: { type: "string", description: "Alias for output." },
           playback: { type: "boolean", description: "Whether to play after generating. Defaults false for generate_tts." },
+          strict_backend: { type: "boolean", description: "When true, fail instead of falling back if the requested backend is unavailable. Defaults false." },
           voice: { type: "string", description: "Voice id/name, or raw Piper/ONNX path when backend=onnx/piper." },
           clone_ref: { type: "string", description: "LuxTTS clone reference path, filename, or registered clone name." },
           model: { type: "string", description: "Backend model id or raw ONNX/Piper model path." },
@@ -507958,7 +508014,7 @@ ${devices.join("\n")}`,
           speed: { type: "number", description: "Speech speed multiplier or backend-specific rate." },
           device: { type: "string", description: "Playback output device when playback=true." }
         },
-        required: ["text"]
+        required: []
       };
       async execute(args) {
         const tool = new AudioPlaybackTool();
@@ -534492,7 +534548,7 @@ Respond with your assessment, then take action.`;
           } catch {
           }
         }
-        if (!this.options.disablePersistentMemory && !this.options.disableCodebaseMap && process.env["OMNIUS_DISABLE_CODEBASE_MAP"] !== "1" && this._episodeStore && this._workingDirectory) {
+        if (!this.options.disablePersistentMemory && !this.options.disableCodebaseMap && !this.options.subAgent && !this.options.stateDir && process.env["OMNIUS_DISABLE_CODEBASE_MAP"] !== "1" && this._episodeStore && this._workingDirectory) {
           try {
             const memMod = await Promise.resolve().then(() => (init_dist7(), dist_exports2));
             let commitSha = "no-commit";
@@ -542526,7 +542582,7 @@ ${result}`
             let resizedBase64 = null;
             try {
               const { execSync: execSync60 } = await import("node:child_process");
-              const { writeFileSync: writeFileSync71, readFileSync: readFileSync102, unlinkSync: unlinkSync25 } = await import("node:fs");
+              const { writeFileSync: writeFileSync71, readFileSync: readFileSync102, unlinkSync: unlinkSync26 } = await import("node:fs");
               const { join: join142 } = await import("node:path");
               const { tmpdir: tmpdir23 } = await import("node:os");
               const tmpIn = join142(tmpdir23(), `omnius_img_in_${Date.now()}.png`);
@@ -542539,11 +542595,11 @@ ${result}`
               const resizedBuf = readFileSync102(tmpOut);
               resizedBase64 = `data:image/jpeg;base64,${resizedBuf.toString("base64")}`;
               try {
-                unlinkSync25(tmpIn);
+                unlinkSync26(tmpIn);
               } catch {
               }
               try {
-                unlinkSync25(tmpOut);
+                unlinkSync26(tmpOut);
               } catch {
               }
             } catch {
@@ -551061,7 +551117,7 @@ var require_websocket3 = __commonJS({
     var http6 = __require("http");
     var net5 = __require("net");
     var tls2 = __require("tls");
-    var { randomBytes: randomBytes25, createHash: createHash24 } = __require("crypto");
+    var { randomBytes: randomBytes26, createHash: createHash24 } = __require("crypto");
     var { Duplex: Duplex3, Readable } = __require("stream");
     var { URL: URL3 } = __require("url");
     var PerMessageDeflate3 = require_permessage_deflate3();
@@ -551591,7 +551647,7 @@ var require_websocket3 = __commonJS({
         }
       }
       const defaultPort = isSecure ? 443 : 80;
-      const key = randomBytes25(16).toString("base64");
+      const key = randomBytes26(16).toString("base64");
       const request = isSecure ? https4.request : http6.request;
       const protocolSet = /* @__PURE__ */ new Set();
       let perMessageDeflate;
@@ -579632,11 +579688,11 @@ async function handleSlashCommand(input, ctx3) {
         }
         if (action === "new") {
           try {
-            const { randomBytes: randomBytes25 } = await import("node:crypto");
+            const { randomBytes: randomBytes26 } = await import("node:crypto");
             const { homedir: homedir48 } = await import("node:os");
             const { mkdirSync: mkdirSync76, writeFileSync: writeFileSync71 } = await import("node:fs");
             const { join: join142 } = await import("node:path");
-            const newKey = randomBytes25(16).toString("hex");
+            const newKey = randomBytes26(16).toString("hex");
             process.env["OMNIUS_API_KEY"] = newKey;
             const dir = join142(homedir48(), ".omnius");
             mkdirSync76(dir, { recursive: true });
@@ -579893,8 +579949,8 @@ async function handleSlashCommand(input, ctx3) {
           }
           process.env["OMNIUS_ACCESS"] = val2;
           if (val2 === "any" && !process.env["OMNIUS_API_KEY"]) {
-            const { randomBytes: randomBytes25 } = await import("node:crypto");
-            const apiKey = randomBytes25(16).toString("hex");
+            const { randomBytes: randomBytes26 } = await import("node:crypto");
+            const apiKey = randomBytes26(16).toString("hex");
             process.env["OMNIUS_API_KEY"] = apiKey;
             renderInfo(`Generated API key: ${c3.bold(c3.yellow(apiKey))}`);
             renderInfo(
@@ -580013,8 +580069,8 @@ async function handleSlashCommand(input, ctx3) {
       }
       process.env["OMNIUS_ACCESS"] = val;
       if (val === "any" && !process.env["OMNIUS_API_KEY"]) {
-        const { randomBytes: randomBytes25 } = await import("node:crypto");
-        const apiKey = randomBytes25(16).toString("hex");
+        const { randomBytes: randomBytes26 } = await import("node:crypto");
+        const apiKey = randomBytes26(16).toString("hex");
         process.env["OMNIUS_API_KEY"] = apiKey;
         renderInfo(`Generated API key: ${c3.bold(c3.yellow(apiKey))}`);
         renderInfo(
@@ -590321,11 +590377,11 @@ var init_commands = __esm({
           process.env["OMNIUS_ACCESS"] = val;
           if (val === "any" && !process.env["OMNIUS_API_KEY"]) {
             try {
-              const { randomBytes: randomBytes25 } = await import("node:crypto");
+              const { randomBytes: randomBytes26 } = await import("node:crypto");
               const { homedir: homedir48 } = await import("node:os");
               const { mkdirSync: mkdirSync76, writeFileSync: writeFileSync71 } = await import("node:fs");
               const { join: join142 } = await import("node:path");
-              const apiKey = randomBytes25(16).toString("hex");
+              const apiKey = randomBytes26(16).toString("hex");
               process.env["OMNIUS_API_KEY"] = apiKey;
               const dir = join142(homedir48(), ".omnius");
               mkdirSync76(dir, { recursive: true });
@@ -596290,6 +596346,8 @@ var init_tool_policy = __esm({
       "glob_find",
       "list_directory",
       "code_sandbox",
+      "full_sub_agent",
+      "telegram_sandbox_handoff",
       "codebase_map",
       "diagnostic",
       "git_info",
@@ -596324,7 +596382,6 @@ var init_tool_policy = __esm({
       "generate_tts",
       "create_audio_file",
       "telegram_send_file",
-      "telegram_sandbox_handoff",
       "task_complete"
     ]);
     SAFE_GROUP_ADMIN_TOOLS = /* @__PURE__ */ new Set([
@@ -596341,24 +596398,26 @@ var init_tool_policy = __esm({
       "generate_tts",
       "create_audio_file",
       "telegram_send_file",
-      "telegram_sandbox_handoff",
       "task_complete"
     ]);
   }
 });
 
 // packages/cli/src/tui/telegram-creative-tools.ts
+import { createCipheriv as createCipheriv4, createDecipheriv as createDecipheriv4, randomBytes as randomBytes21 } from "node:crypto";
 import {
   existsSync as existsSync104,
   mkdirSync as mkdirSync59,
   readFileSync as readFileSync85,
   statSync as statSync35,
+  unlinkSync as unlinkSync19,
   writeFileSync as writeFileSync55
 } from "node:fs";
 import { mkdir as mkdir17 } from "node:fs/promises";
 import {
   basename as basename22,
   dirname as dirname33,
+  extname as extname14,
   isAbsolute as isAbsolute6,
   join as join119,
   relative as relative12,
@@ -596377,11 +596436,27 @@ function formatTelegramCreativeWorkspacePrompt(root) {
     "Public/group creative workspace is enabled.",
     `Workspace root: ${root}`,
     "Creative file tools are scoped to that folder only.",
-    "Allowed: create new files, read/list files in this workspace, and edit/patch files already created in this workspace.",
-    "Forbidden: delete files, access paths outside this workspace, mutate the project tree, run shell commands, or touch system state.",
+    "Allowed: create and send non-executable creative artifacts in this workspace.",
+    "At rest, artifacts are stored as random internal blobs with random header bytes; requested filenames are logical names restored only during Telegram upload.",
+    "Forbidden: delete files, create scripts/executables, access paths outside this workspace, mutate the project tree, run shell/Python/code commands, or touch system state.",
     "When a user asks for an artifact to be sent, create it here and then call telegram_send_file. The bridge also auto-attaches recorded artifacts as a fallback. Refer to the attachment naturally; do not expose filesystem paths unless the admin explicitly asks."
   ].join("\n");
 }
+function publicCreativeArtifactPolicyError(path11) {
+  const ext = extname14(path11).toLowerCase();
+  if (PUBLIC_EXECUTABLE_ARTIFACT_EXTENSIONS.has(ext)) {
+    return `Public Telegram creative work cannot create or send executable/script/code artifacts (${ext || "no extension"}). Use a non-executable artifact such as .md, .txt, .json, image, audio, or PDF.`;
+  }
+  return null;
+}
+function publicCreativeContentPolicyError(args) {
+  const content = args["content"] ?? args["text"] ?? args["data"];
+  if (typeof content !== "string") return null;
+  if (/^\s*#!/.test(content)) {
+    return "Public Telegram creative work cannot create executable scripts or shebang files.";
+  }
+  return null;
+}
 function collectGeneratedArtifactPathsFromText(text, root) {
   const rootAbs = resolve38(root);
   const paths = /* @__PURE__ */ new Set();
@@ -596389,7 +596464,7 @@ function collectGeneratedArtifactPathsFromText(text, root) {
     const value2 = match[1];
     if (!value2) continue;
     const guarded = guardPath(rootAbs, value2);
-    if (guarded.ok && existsSync104(guarded.path.abs) && safeStatFile(guarded.path.abs)) {
+    if (guarded.ok && (isManifestArtifact(rootAbs, guarded.path.rel) || existsSync104(guarded.path.abs) && safeStatFile(guarded.path.abs))) {
       paths.add(guarded.path.abs);
     }
   }
@@ -596398,7 +596473,7 @@ function collectGeneratedArtifactPathsFromText(text, root) {
     const value2 = marker?.[1]?.trim().replace(/^["']|["']$/g, "");
     if (!value2) continue;
     const guarded = guardPath(rootAbs, value2);
-    if (guarded.ok && existsSync104(guarded.path.abs) && safeStatFile(guarded.path.abs)) {
+    if (guarded.ok && (isManifestArtifact(rootAbs, guarded.path.rel) || existsSync104(guarded.path.abs) && safeStatFile(guarded.path.abs))) {
       paths.add(guarded.path.abs);
     }
   }
@@ -596408,11 +596483,7 @@ function buildTelegramCreativeTools(repoRoot, chatId, backendUrl, imageDefaults
   const root = telegramCreativeWorkspaceRoot(repoRoot, chatId);
   ensureManifest(root);
   return [
-    scopedTool(new FileReadTool(root), root, "read"),
-    scopedTool(new ListDirectoryTool(root), root, "list"),
     scopedTool(new FileWriteTool(root), root, "create"),
-    scopedTool(new FileEditTool(root), root, "edit"),
-    scopedTool(new FilePatchTool(root), root, "edit"),
     scopedTool(new StructuredFileTool(root), root, "create"),
     scopedTool(new ImageGenerateTool(root, backendUrl, imageDefaults), root, "generate"),
     scopedTool(new AudioGenerateTool(root, audioDefaults), root, "generate"),
@@ -596461,6 +596532,10 @@ function scopedTool(base3, root, mode) {
       if (pathKey) {
         const guarded = guardPath(rootAbs, String(next[pathKey]));
         if (!guarded.ok) return denied(guarded.error);
+        const pathPolicyError = publicCreativeArtifactPolicyError(guarded.path.abs);
+        if (pathPolicyError) return denied(pathPolicyError);
+        const contentPolicyError = mode === "create" || mode === "edit" ? publicCreativeContentPolicyError(next) : null;
+        if (contentPolicyError) return denied(contentPolicyError);
         if (mode === "edit" && !manifestHas(rootAbs, guarded.path.rel)) {
           return denied(`Public Telegram creative tools can only edit files created in this chat workspace: ${guarded.path.rel}`);
         }
@@ -596530,12 +596605,21 @@ function readManifest(root) {
   ensureManifest(root);
   try {
     const parsed = JSON.parse(readFileSync85(manifestPath(root), "utf8"));
+    const objects = parsed.objects && typeof parsed.objects === "object" ? Object.fromEntries(
+      Object.entries(parsed.objects).filter((entry) => {
+        const value2 = entry[1];
+        return Boolean(
+          value2 && typeof value2.logicalRel === "string" && typeof value2.storedRel === "string" && typeof value2.originalName === "string" && typeof value2.prefixBytes === "number" && typeof value2.size === "number"
+        );
+      })
+    ) : {};
     return {
       files: Array.isArray(parsed.files) ? parsed.files.filter((file) => typeof file === "string") : [],
+      objects,
       updatedAt: typeof parsed.updatedAt === "string" ? parsed.updatedAt : (/* @__PURE__ */ new Date()).toISOString()
     };
   } catch {
-    return { files: [], updatedAt: (/* @__PURE__ */ new Date()).toISOString() };
+    return { files: [], objects: {}, updatedAt: (/* @__PURE__ */ new Date()).toISOString() };
   }
 }
 function writeManifest(root, manifest) {
@@ -596544,18 +596628,114 @@ function writeManifest(root, manifest) {
 }
 function manifestHas(root, relPath) {
   const rel = relPath.replace(/\\/g, "/");
-  return readManifest(root).files.includes(rel);
+  const manifest = readManifest(root);
+  return manifest.files.includes(rel) || Boolean(manifest.objects?.[rel]);
 }
 function rememberCreated(root, absPath) {
   const guarded = guardPath(root, absPath);
   if (!guarded.ok || guarded.path.rel === ".") return;
   const manifest = readManifest(root);
   const rel = guarded.path.rel.replace(/\\/g, "/");
+  if (publicCreativeArtifactPolicyError(guarded.path.abs)) return;
+  if (existsSync104(guarded.path.abs) && safeStatFile(guarded.path.abs)) {
+    const previous = manifest.objects?.[rel];
+    if (previous) {
+      const previousPath = resolve38(root, previous.storedRel);
+      if (isInside(resolve38(root), previousPath) && existsSync104(previousPath)) {
+        try {
+          unlinkSync19(previousPath);
+        } catch {
+        }
+      }
+    }
+    mkdirSync59(join119(root, OBJECTS_DIR), { recursive: true });
+    const data = readFileSync85(guarded.path.abs);
+    const prefix = randomBytes21(48);
+    const key = randomBytes21(32);
+    const iv = randomBytes21(12);
+    const cipher = createCipheriv4("aes-256-gcm", key, iv);
+    const encrypted = Buffer.concat([cipher.update(data), cipher.final()]);
+    const tag = cipher.getAuthTag();
+    const storedRel = join119(OBJECTS_DIR, `${Date.now()}-${randomBytes21(12).toString("hex")}.blob`).replace(/\\/g, "/");
+    const storedAbs = join119(root, storedRel);
+    writeFileSync55(storedAbs, Buffer.concat([prefix, encrypted]));
+    try {
+      unlinkSync19(guarded.path.abs);
+    } catch {
+    }
+    manifest.objects = manifest.objects || {};
+    manifest.objects[rel] = {
+      logicalRel: rel,
+      storedRel,
+      originalName: basename22(guarded.path.abs),
+      prefixBytes: prefix.length,
+      encrypted: true,
+      key: key.toString("base64"),
+      iv: iv.toString("base64"),
+      tag: tag.toString("base64"),
+      size: data.length,
+      updatedAt: (/* @__PURE__ */ new Date()).toISOString()
+    };
+  }
   if (!manifest.files.includes(rel)) manifest.files.push(rel);
   manifest.files.sort();
   manifest.updatedAt = (/* @__PURE__ */ new Date()).toISOString();
   writeManifest(root, manifest);
 }
+function isManifestArtifact(root, relPath) {
+  return manifestHas(root, relPath);
+}
+function materializeTelegramCreativeArtifactForSend(root, rawPath) {
+  const rootAbs = resolve38(root);
+  const guarded = guardPath(rootAbs, rawPath);
+  if (!guarded.ok) return { ok: false, error: guarded.error };
+  const policyError = publicCreativeArtifactPolicyError(guarded.path.abs);
+  if (policyError) return { ok: false, error: policyError };
+  const manifest = readManifest(rootAbs);
+  const rel = guarded.path.rel.replace(/\\/g, "/");
+  const object = manifest.objects?.[rel];
+  if (object) {
+    const storedAbs = resolve38(rootAbs, object.storedRel);
+    if (!isInside(rootAbs, storedAbs) || !existsSync104(storedAbs) || !safeStatFile(storedAbs)) {
+      return { ok: false, error: `Scoped artifact storage is missing for ${rel}.` };
+    }
+    const blob = readFileSync85(storedAbs);
+    if (blob.length < object.prefixBytes) {
+      return { ok: false, error: `Scoped artifact storage is corrupt for ${rel}.` };
+    }
+    let payload = blob.subarray(object.prefixBytes);
+    if (object.encrypted) {
+      if (!object.key || !object.iv || !object.tag) {
+        return { ok: false, error: `Scoped artifact encryption metadata is missing for ${rel}.` };
+      }
+      const decipher = createDecipheriv4(
+        "aes-256-gcm",
+        Buffer.from(object.key, "base64"),
+        Buffer.from(object.iv, "base64")
+      );
+      decipher.setAuthTag(Buffer.from(object.tag, "base64"));
+      payload = Buffer.concat([decipher.update(payload), decipher.final()]);
+    }
+    const stageDir = join119(rootAbs, SEND_DIR, `${Date.now()}-${randomBytes21(8).toString("hex")}`);
+    mkdirSync59(stageDir, { recursive: true });
+    const staged = join119(stageDir, object.originalName || basename22(rel));
+    writeFileSync55(staged, payload);
+    return {
+      ok: true,
+      path: staged,
+      cleanup: () => {
+        try {
+          unlinkSync19(staged);
+        } catch {
+        }
+      }
+    };
+  }
+  if (existsSync104(guarded.path.abs) && safeStatFile(guarded.path.abs)) {
+    return { ok: true, path: guarded.path.abs };
+  }
+  return { ok: false, error: `Scoped artifact not found in manifest: ${rawPath}` };
+}
 function safeStatFile(path11) {
   try {
     return statSync35(path11).isFile();
@@ -596573,15 +596753,75 @@ function denied(error) {
     mutatedFiles: []
   };
 }
-var MANIFEST_FILE, PATH_KEYS, MEDIA_PATH_RE, CreativeAudioFileTool;
+var MANIFEST_FILE, OBJECTS_DIR, SEND_DIR, PATH_KEYS, MEDIA_PATH_RE, PUBLIC_EXECUTABLE_ARTIFACT_EXTENSIONS, CreativeAudioFileTool;
 var init_telegram_creative_tools = __esm({
   "packages/cli/src/tui/telegram-creative-tools.ts"() {
     "use strict";
-    init_typed_node_events();
     init_dist5();
     MANIFEST_FILE = ".omnius-creative-manifest.json";
+    OBJECTS_DIR = ".objects";
+    SEND_DIR = ".send";
     PATH_KEYS = ["path", "file", "file_path", "filename", "filepath", "filePath"];
     MEDIA_PATH_RE = /(?:^|[\s([])(\/[^\s<>"')\]]+\.[A-Za-z0-9]{1,12})(?:$|[\s),.\]])/g;
+    PUBLIC_EXECUTABLE_ARTIFACT_EXTENSIONS = /* @__PURE__ */ new Set([
+      ".sh",
+      ".bash",
+      ".zsh",
+      ".fish",
+      ".ksh",
+      ".csh",
+      ".py",
+      ".pyw",
+      ".pyc",
+      ".pyo",
+      ".ipynb",
+      ".js",
+      ".mjs",
+      ".cjs",
+      ".ts",
+      ".tsx",
+      ".jsx",
+      ".rb",
+      ".pl",
+      ".pm",
+      ".php",
+      ".lua",
+      ".r",
+      ".jl",
+      ".ps1",
+      ".psm1",
+      ".bat",
+      ".cmd",
+      ".com",
+      ".exe",
+      ".msi",
+      ".jar",
+      ".class",
+      ".war",
+      ".ear",
+      ".go",
+      ".rs",
+      ".c",
+      ".cc",
+      ".cpp",
+      ".cxx",
+      ".h",
+      ".hpp",
+      ".java",
+      ".kt",
+      ".kts",
+      ".scala",
+      ".swift",
+      ".cs",
+      ".vb",
+      ".fs",
+      ".so",
+      ".dylib",
+      ".dll",
+      ".app",
+      ".appimage",
+      ".desktop"
+    ]);
     CreativeAudioFileTool = class {
       constructor(root) {
         this.root = root;
@@ -596593,6 +596833,8 @@ var init_telegram_creative_tools = __esm({
         type: "object",
         properties: {
           text: { type: "string", description: "Text to synthesize into speech" },
+          input: { type: "string", description: "Alias for text" },
+          prompt: { type: "string", description: "Alias for text" },
           path: { type: "string", description: "Output .wav path inside the creative workspace" },
           backend: { type: "string", enum: ["auto", "luxtts", "supertonic", "mlx", "onnx", "piper", "espeak"], description: "TTS backend. Defaults to auto." },
           voice: { type: "string", description: "Voice id/name for the selected TTS backend" },
@@ -596600,11 +596842,11 @@ var init_telegram_creative_tools = __esm({
           model: { type: "string", description: "Optional backend model id or raw Piper/ONNX path" },
           speed: { type: "number", description: "Speech speed multiplier or backend-specific rate" }
         },
-        required: ["text", "path"]
+        required: []
       };
       async execute(args) {
         const start2 = performance.now();
-        const text = typeof args["text"] === "string" ? args["text"].trim() : "";
+        const text = typeof args["text"] === "string" && args["text"].trim() ? args["text"].trim() : typeof args["input"] === "string" && args["input"].trim() ? args["input"].trim() : typeof args["prompt"] === "string" && args["prompt"].trim() ? args["prompt"].trim() : "";
         if (!text) return { success: false, output: "", error: "text is required", durationMs: performance.now() - start2 };
         const rawPath = typeof args["path"] === "string" && args["path"].trim() ? String(args["path"]) : `speech-${Date.now()}.wav`;
         const guarded = guardPath(this.root, rawPath);
@@ -596663,7 +596905,7 @@ __export(vision_ingress_exports, {
   runVisionIngress: () => runVisionIngress
 });
 import { execFileSync as execFileSync4 } from "node:child_process";
-import { existsSync as existsSync105, readFileSync as readFileSync86, unlinkSync as unlinkSync19 } from "node:fs";
+import { existsSync as existsSync105, readFileSync as readFileSync86, unlinkSync as unlinkSync20 } from "node:fs";
 import { join as join120 } from "node:path";
 function isTesseractAvailable() {
   try {
@@ -596721,7 +596963,7 @@ function advancedOcr(imagePath) {
         const text = readFileSync86(txtFile, "utf-8").trim();
         if (text.length > 0) results.push(text);
         try {
-          unlinkSync19(txtFile);
+          unlinkSync20(txtFile);
         } catch {
         }
       }
@@ -596806,7 +597048,7 @@ var init_vision_ingress = __esm({
 });
 
 // packages/cli/src/tui/telegram-bridge.ts
-import { mkdirSync as mkdirSync60, existsSync as existsSync106, unlinkSync as unlinkSync20, readdirSync as readdirSync36, statSync as statSync36, readFileSync as readFileSync87, writeFileSync as writeFileSync57 } from "node:fs";
+import { mkdirSync as mkdirSync60, existsSync as existsSync106, unlinkSync as unlinkSync21, readdirSync as readdirSync36, statSync as statSync36, readFileSync as readFileSync87, writeFileSync as writeFileSync57 } from "node:fs";
 import { join as join121, resolve as resolve39, basename as basename23, relative as relative13, isAbsolute as isAbsolute7 } from "node:path";
 import { writeFile as writeFileAsync } from "node:fs/promises";
 import { createHash as createHash19, randomInt } from "node:crypto";
@@ -597122,7 +597364,8 @@ function telegramSyntheticHelpSignatures() {
   return [
     { signature: "/help", description: "Show Telegram command help" },
     { signature: "/start", description: "Show Telegram bridge status and authentication instructions" },
-    { signature: "/auth <code>", description: "Authenticate this Telegram user as bot admin using the TUI code" }
+    { signature: "/auth <code>", description: "Authenticate this Telegram user as bot admin using the TUI code" },
+    { signature: "/call", description: "Get the active voice call link when a call session is running" }
   ];
 }
 function telegramHelpCommandAllowed(cmd, scope) {
@@ -597626,7 +597869,8 @@ path and target. Do not search for Telegram bot tokens, environment secrets, or
 credentials; upload authorization is encapsulated by telegram_send_file.
 
 When asked to generate speech, narration, or TTS, use generate_tts or audio_playback.
-Do not fall back to shell commands for speech synthesis while those tools are available.
+Those tools handle first-use backend setup where supported. Do not fall back to shell
+commands or generic audio generation for speech synthesis while those tools are available.
 
 Keep responses concise for Telegram but don't withhold information from the admin.
 `.trim();
@@ -599550,6 +599794,9 @@ ${mediaContext}` : ""}`
         runner.onEvent((event) => {
           if (subAgent.aborted) return;
           let suppressExternalEvent = false;
+          if (!isAdminDM && event.type === "status") {
+            suppressExternalEvent = true;
+          }
           if (event.type === "tool_call" && event.toolName) {
             if (event.toolName === "task_complete") {
               subAgent.completionBoundarySeen = true;
@@ -599585,7 +599832,9 @@ ${mediaContext}` : ""}`
               }
             }
           } else if (event.type === "status" && event.content) {
-            this.subAgentViewCallbacks?.onWrite(subAgent.viewId, `status: ${event.content}`);
+            if (isAdminDM) {
+              this.subAgentViewCallbacks?.onWrite(subAgent.viewId, `status: ${event.content}`);
+            }
           } else if (event.type === "assistant_text" && event.content && event.source !== "task_complete_summary") {
             subAgent.assistantText = event.content;
           } else if (event.type === "stream_start") {
@@ -600056,10 +600305,27 @@ Scoped workspace: ${scopedRoot}`,
           ).map((tool) => adaptTool5(tool, todoSessionId));
           adaptedTools.push(...creativeTools);
           adaptedTools.push(adaptTool5(this.buildTelegramSendFileTool(context2, repoRoot, chatId, msg), todoSessionId));
-          adaptedTools.push(adaptTool5(this.buildTelegramSandboxHandoffTool(context2, repoRoot, `chat:${String(chatId ?? "unknown")}`, chatId), todoSessionId));
+          adaptedTools = this.filterNonAdminTelegramTools(adaptedTools);
         }
         return [...adaptedTools, taskComplete];
       }
+      filterNonAdminTelegramTools(tools) {
+        const blocked = /* @__PURE__ */ new Set([
+          "shell",
+          "code_sandbox",
+          "background_run",
+          "task_output",
+          "task_status",
+          "task_stop",
+          "full_sub_agent",
+          "telegram_sandbox_handoff",
+          "create_tool",
+          "manage_tools",
+          "aiwg_setup",
+          "aiwg_workflow"
+        ]);
+        return tools.filter((tool) => !blocked.has(tool.name));
+      }
       imageGenerationDefaultsForRepo(repoRoot) {
         const settings = resolveSettings(repoRoot);
         return {
@@ -600164,6 +600430,8 @@ Scoped workspace: ${scopedRoot}`,
                 error: `Telegram file upload failed: ${err instanceof Error ? err.message : String(err)}`,
                 durationMs: performance.now() - start2
               };
+            } finally {
+              file.cleanup?.();
             }
           }
         };
@@ -600217,10 +600485,12 @@ ${knownList}` : "Private-user telegram_send_file target must be this DM or a kno
       resolveTelegramFilePath(rawPath, repoRoot, scopedRoot) {
         const base3 = scopedRoot ? resolve39(scopedRoot) : resolve39(repoRoot);
         const trimmed = rawPath.trim().replace(/^["']|["']$/g, "");
-        const abs = isAbsolute7(trimmed) ? resolve39(trimmed) : resolve39(base3, trimmed);
-        if (scopedRoot && !isPathInside(base3, abs)) {
-          return { ok: false, error: `Public/group telegram_send_file can only send files inside ${base3}.` };
+        if (scopedRoot) {
+          const materialized = materializeTelegramCreativeArtifactForSend(base3, trimmed);
+          if (!materialized.ok) return materialized;
+          return materialized;
         }
+        const abs = isAbsolute7(trimmed) ? resolve39(trimmed) : resolve39(base3, trimmed);
         if (!existsSync106(abs)) return { ok: false, error: `File does not exist: ${trimmed}` };
         if (!statSync36(abs).isFile()) return { ok: false, error: `Path is not a file: ${trimmed}` };
         return { ok: true, path: abs };
@@ -600381,7 +600651,7 @@ ${visionContext}]`;
         for (const [key, entry] of this.mediaCache) {
           if (now - entry.cachedAt > MEDIA_CACHE_TTL_MS) {
             try {
-              unlinkSync20(entry.localPath);
+              unlinkSync21(entry.localPath);
             } catch {
             }
             this.mediaCache.delete(key);
@@ -600548,15 +600818,22 @@ Content-Type: ${contentType}\r
           const abs = resolve39(path11);
           if (!isPathInside(rootAbs, abs)) continue;
           if (!includeMentioned && alreadySentByText.has(abs)) continue;
-          if (!existsSync106(abs) || !statSync36(abs).isFile()) continue;
-          const kind = classifyMedia(abs) ?? "document";
+          const materialized = materializeTelegramCreativeArtifactForSend(rootAbs, abs);
+          if (!materialized.ok) continue;
+          if (!existsSync106(materialized.path) || !statSync36(materialized.path).isFile()) {
+            materialized.cleanup?.();
+            continue;
+          }
+          const kind = classifyMedia(materialized.path) ?? "document";
           await this.sendMediaReference(msg.chatId, {
-            original: abs,
-            value: abs,
+            original: materialized.path,
+            value: materialized.path,
             kind,
             source: "file",
             audioAsVoice: kind === "voice"
-          }).catch(() => null);
+          }).catch(() => null).finally(() => {
+            materialized.cleanup?.();
+          });
         }
       }
       async uploadTelegramFiles(method, fields, files) {
@@ -600998,7 +601275,7 @@ import {
   writeFileSync as writeFileSync58,
   renameSync as renameSync5,
   mkdirSync as mkdirSync61,
-  unlinkSync as unlinkSync21
+  unlinkSync as unlinkSync22
 } from "node:fs";
 import { join as join122 } from "node:path";
 import { homedir as homedir36 } from "node:os";
@@ -601036,7 +601313,7 @@ function persistInFlight(j) {
 function deleteInFlightFile(id) {
   try {
     const p2 = inFlightPath(id);
-    if (existsSync107(p2)) unlinkSync21(p2);
+    if (existsSync107(p2)) unlinkSync22(p2);
   } catch {
   }
 }
@@ -601257,7 +601534,7 @@ function drainCheckins(sessionId) {
   try {
     const raw = readFileSync88(fp, "utf-8");
     try {
-      unlinkSync21(fp);
+      unlinkSync22(fp);
     } catch {
     }
     if (!raw.trim()) return [];
@@ -601295,7 +601572,7 @@ function listSessions2() {
 function deleteSession2(id) {
   try {
     const p2 = sessionPath(id);
-    if (existsSync107(p2)) unlinkSync21(p2);
+    if (existsSync107(p2)) unlinkSync22(p2);
   } catch {
   }
   deleteInFlightFile(id);
@@ -602231,7 +602508,7 @@ var init_access_policy = __esm({
 
 // packages/cli/src/api/project-preferences.ts
 import { createHash as createHash20 } from "node:crypto";
-import { existsSync as existsSync109, mkdirSync as mkdirSync63, readFileSync as readFileSync90, renameSync as renameSync7, writeFileSync as writeFileSync60, unlinkSync as unlinkSync22 } from "node:fs";
+import { existsSync as existsSync109, mkdirSync as mkdirSync63, readFileSync as readFileSync90, renameSync as renameSync7, writeFileSync as writeFileSync60, unlinkSync as unlinkSync23 } from "node:fs";
 import { homedir as homedir38 } from "node:os";
 import { join as join124, resolve as resolve41 } from "node:path";
 import { randomUUID as randomUUID15 } from "node:crypto";
@@ -602292,7 +602569,7 @@ function writeProjectPreferences(root, partial) {
     } catch {
     }
     try {
-      unlinkSync22(tmp);
+      unlinkSync23(tmp);
     } catch {
     }
     throw err;
@@ -602303,7 +602580,7 @@ function deleteProjectPreferences(root) {
   try {
     const file = prefsPath(root);
     if (!existsSync109(file)) return false;
-    unlinkSync22(file);
+    unlinkSync23(file);
     return true;
   } catch {
     return false;
@@ -604350,7 +604627,7 @@ __export(runtime_keys_exports, {
 import { existsSync as existsSync113, readFileSync as readFileSync93, writeFileSync as writeFileSync61, mkdirSync as mkdirSync66, chmodSync } from "node:fs";
 import { join as join127 } from "node:path";
 import { homedir as homedir40 } from "node:os";
-import { randomBytes as randomBytes21 } from "node:crypto";
+import { randomBytes as randomBytes22 } from "node:crypto";
 function ensureDir2() {
   const dir = join127(homedir40(), ".omnius");
   if (!existsSync113(dir)) mkdirSync66(dir, { recursive: true });
@@ -604376,7 +604653,7 @@ function persistAll(records) {
 }
 function mintKey(args) {
   const records = loadAll();
-  const key = `omnius_${randomBytes21(32).toString("hex")}`;
+  const key = `omnius_${randomBytes22(32).toString("hex")}`;
   const record = {
     key,
     scope: args.scope,
@@ -607684,11 +607961,11 @@ async function handleAimsIncidentPost(ctx3) {
       }));
       return true;
     }
-    const { randomBytes: randomBytes25 } = await import("node:crypto");
+    const { randomBytes: randomBytes26 } = await import("node:crypto");
     const record = await withAimsLock("incidents.json", () => {
       const existing = readAimsFile("incidents.json", []);
       const rec = {
-        id: `INC-${Date.now()}-${randomBytes25(4).toString("hex")}`,
+        id: `INC-${Date.now()}-${randomBytes26(4).toString("hex")}`,
         ts: (/* @__PURE__ */ new Date()).toISOString(),
         raised_by: user ?? "anonymous",
         status: "open",
@@ -616849,10 +617126,10 @@ var init_usage_tracker = __esm({
 });
 
 // packages/cli/src/api/profiles.ts
-import { existsSync as existsSync118, readFileSync as readFileSync97, writeFileSync as writeFileSync64, mkdirSync as mkdirSync69, readdirSync as readdirSync40, unlinkSync as unlinkSync23 } from "node:fs";
+import { existsSync as existsSync118, readFileSync as readFileSync97, writeFileSync as writeFileSync64, mkdirSync as mkdirSync69, readdirSync as readdirSync40, unlinkSync as unlinkSync24 } from "node:fs";
 import { join as join132 } from "node:path";
 import { homedir as homedir43 } from "node:os";
-import { createCipheriv as createCipheriv4, createDecipheriv as createDecipheriv4, randomBytes as randomBytes22, scryptSync as scryptSync3 } from "node:crypto";
+import { createCipheriv as createCipheriv5, createDecipheriv as createDecipheriv5, randomBytes as randomBytes23, scryptSync as scryptSync3 } from "node:crypto";
 function globalProfileDir() {
   return join132(homedir43(), ".omnius", "profiles");
 }
@@ -616930,16 +617207,16 @@ function deleteProfile(name10, scope = "global", projectDir2) {
   const dir = scope === "project" ? projectProfileDir(projectDir2) : globalProfileDir();
   const filePath = join132(dir, `${sanitized}.json`);
   if (existsSync118(filePath)) {
-    unlinkSync23(filePath);
+    unlinkSync24(filePath);
     return true;
   }
   return false;
 }
 function encryptProfile(profile, password) {
-  const salt = randomBytes22(32);
+  const salt = randomBytes23(32);
   const key = scryptSync3(password, salt, 32);
-  const iv = randomBytes22(16);
-  const cipher = createCipheriv4("aes-256-gcm", key, iv);
+  const iv = randomBytes23(16);
+  const cipher = createCipheriv5("aes-256-gcm", key, iv);
   const plaintext = JSON.stringify(profile);
   const encrypted = Buffer.concat([cipher.update(plaintext, "utf8"), cipher.final()]);
   const tag = cipher.getAuthTag();
@@ -616958,7 +617235,7 @@ function decryptProfile(enc, password) {
     const salt = Buffer.from(enc.salt, "hex");
     const key = scryptSync3(password, salt, 32);
     const iv = Buffer.from(enc.iv, "hex");
-    const decipher = createDecipheriv4("aes-256-gcm", key, iv);
+    const decipher = createDecipheriv5("aes-256-gcm", key, iv);
     decipher.setAuthTag(Buffer.from(enc.tag, "hex"));
     const decrypted = Buffer.concat([
       decipher.update(Buffer.from(enc.data, "hex")),
@@ -617590,8 +617867,8 @@ import { fileURLToPath as fileURLToPath17 } from "node:url";
 import { dirname as dirname37, join as join135, resolve as resolve43 } from "node:path";
 import { homedir as homedir45 } from "node:os";
 import { spawn as spawn29, execSync as execSync57 } from "node:child_process";
-import { mkdirSync as mkdirSync71, writeFileSync as writeFileSync66, readFileSync as readFileSync98, readdirSync as readdirSync41, existsSync as existsSync120, watch as fsWatch3, renameSync as renameSync8, unlinkSync as unlinkSync24 } from "node:fs";
-import { randomBytes as randomBytes23, randomUUID as randomUUID16 } from "node:crypto";
+import { mkdirSync as mkdirSync71, writeFileSync as writeFileSync66, readFileSync as readFileSync98, readdirSync as readdirSync41, existsSync as existsSync120, watch as fsWatch3, renameSync as renameSync8, unlinkSync as unlinkSync25 } from "node:fs";
+import { randomBytes as randomBytes24, randomUUID as randomUUID16 } from "node:crypto";
 import { createHash as createHash23 } from "node:crypto";
 function getVersion3() {
   try {
@@ -618340,13 +618617,13 @@ function pruneOldJobs() {
       const ts = ageRef ? Date.parse(ageRef) : NaN;
       if (Number.isFinite(ts) && ts < cutoffMs) {
         try {
-          unlinkSync24(path11);
+          unlinkSync25(path11);
         } catch {
         }
         const outFile = path11.replace(/\.json$/, ".output");
         if (existsSync120(outFile)) {
           try {
-            unlinkSync24(outFile);
+            unlinkSync25(outFile);
           } catch {
           }
         }
@@ -618356,7 +618633,7 @@ function pruneOldJobs() {
       }
     } catch {
       try {
-        unlinkSync24(path11);
+        unlinkSync25(path11);
         pruned++;
       } catch {
       }
@@ -618648,7 +618925,7 @@ function atomicJobWrite(dir, id, job) {
     } catch {
     }
     try {
-      unlinkSync24(tmpPath);
+      unlinkSync25(tmpPath);
     } catch {
     }
   }
@@ -619213,7 +619490,7 @@ ${messages2[firstSystemIdx].content}`
       messages2.unshift({ role: "system", content: SYSTEM_FACTUAL_FIRST });
     }
   }
-  const chatId = `chatcmpl-${randomBytes23(12).toString("hex")}`;
+  const chatId = `chatcmpl-${randomBytes24(12).toString("hex")}`;
   const turnsLog = [];
   for (let turn = 1; turn <= maxTurns; turn++) {
     if (Date.now() > totalDeadline) {
@@ -619478,7 +619755,7 @@ async function handleV1ChatCompletions(req2, res, ollamaUrl) {
       "Cache-Control": "no-cache",
       "Connection": "keep-alive"
     });
-    const chatId = `chatcmpl-${randomBytes23(12).toString("hex")}`;
+    const chatId = `chatcmpl-${randomBytes24(12).toString("hex")}`;
     let buffer2 = "";
     ollamaStream(
       targetUrl,
@@ -619520,7 +619797,7 @@ async function handleV1ChatCompletions(req2, res, ollamaUrl) {
               if (ollamaChunk.message.content) delta.content = ollamaChunk.message.content;
               if (ollamaChunk.message.tool_calls) {
                 delta.tool_calls = ollamaChunk.message.tool_calls.map((tc, idx) => ({
-                  id: tc.id || `call_${randomBytes23(8).toString("hex")}`,
+                  id: tc.id || `call_${randomBytes24(8).toString("hex")}`,
                   type: "function",
                   function: {
                     name: tc?.function?.name ?? tc?.name ?? "",
@@ -619599,14 +619876,14 @@ async function handleV1ChatCompletions(req2, res, ollamaUrl) {
       if (ollamaResp.eval_count) metrics.totalTokensOut += ollamaResp.eval_count;
       if (ollamaResp.prompt_eval_count) metrics.totalTokensIn += ollamaResp.prompt_eval_count;
       trackTokens("local", ollamaResp.prompt_eval_count ?? 0, ollamaResp.eval_count ?? 0);
-      const chatId = `chatcmpl-${randomBytes23(12).toString("hex")}`;
+      const chatId = `chatcmpl-${randomBytes24(12).toString("hex")}`;
       const responseMessage = {
         role: ollamaResp.message?.role ?? "assistant",
         content: ollamaResp.message?.content ?? ""
       };
       if (ollamaResp.message?.tool_calls && ollamaResp.message.tool_calls.length > 0) {
         responseMessage.tool_calls = ollamaResp.message.tool_calls.map((tc, idx) => ({
-          id: tc.id || `call_${randomBytes23(8).toString("hex")}`,
+          id: tc.id || `call_${randomBytes24(8).toString("hex")}`,
           type: "function",
           function: {
             name: tc?.function?.name ?? tc?.name ?? "",
@@ -620391,7 +620668,7 @@ async function handleV1Run(req2, res) {
       return;
     }
   }
-  const id = `job-${randomBytes23(8).toString("hex")}`;
+  const id = `job-${randomBytes24(8).toString("hex")}`;
   const dir = jobsDir();
   const workingDir = requestBody["working_directory"] || req2.headers["x-working-directory"];
   const isolate = requestBody["isolate"] === true;
@@ -621558,7 +621835,7 @@ async function handleRequest(req2, res, ollamaUrl, verbose) {
           return;
         }
         const { tmpdir: tmpdir23 } = await import("node:os");
-        const { writeFileSync: writeFileSync71, unlinkSync: unlinkSync25 } = await import("node:fs");
+        const { writeFileSync: writeFileSync71, unlinkSync: unlinkSync26 } = await import("node:fs");
         const { join: pjoin } = await import("node:path");
         const tmpPath = pjoin(tmpdir23(), `omnius-clone-upload-${Date.now()}-${safeName2}`);
         writeFileSync71(tmpPath, buf);
@@ -621573,7 +621850,7 @@ async function handleRequest(req2, res, ollamaUrl, verbose) {
           });
         } finally {
           try {
-            unlinkSync25(tmpPath);
+            unlinkSync26(tmpPath);
           } catch {
           }
         }
@@ -624026,8 +624303,8 @@ function startApiServer(options2 = {}) {
             const job = JSON.parse(readFileSync98(jobPath, "utf-8"));
             const jobTime = new Date(job.startedAt ?? job.completedAt ?? 0).getTime();
             if (jobTime > 0 && jobTime < cutoff && job.status !== "running") {
-              const { unlinkSync: unlinkSync25 } = require4("node:fs");
-              unlinkSync25(jobPath);
+              const { unlinkSync: unlinkSync26 } = require4("node:fs");
+              unlinkSync26(jobPath);
             }
           } catch {
           }
@@ -625026,7 +625303,7 @@ var init_clipboard_media = __esm({
 
 // packages/cli/src/tui/interactive.ts
 import { cwd } from "node:process";
-import { resolve as resolve44, join as join137, dirname as dirname38, extname as extname14, relative as relative14 } from "node:path";
+import { resolve as resolve44, join as join137, dirname as dirname38, extname as extname15, relative as relative14 } from "node:path";
 import { createRequire as createRequire8 } from "node:module";
 import { fileURLToPath as fileURLToPath18 } from "node:url";
 import {
@@ -632328,7 +632605,7 @@ Execute this skill now. Follow the behavioral guidance above.`;
           const imgPath = resolve44(repoRoot, cleanPath);
           const imgBuffer = readFileSync100(imgPath);
           const base642 = imgBuffer.toString("base64");
-          const ext = extname14(cleanPath).toLowerCase();
+          const ext = extname15(cleanPath).toLowerCase();
           const mime = ext === ".png" ? "image/png" : ext === ".gif" ? "image/gif" : ext === ".webp" ? "image/webp" : "image/jpeg";
           const asciiContext = await renderAsciiPreviewForImage(
             imgPath,
@@ -633511,7 +633788,7 @@ __export(run_exports, {
 import { resolve as resolve45 } from "node:path";
 import { spawn as spawn30 } from "node:child_process";
 import { mkdirSync as mkdirSync74, writeFileSync as writeFileSync69, readFileSync as readFileSync101, readdirSync as readdirSync43, existsSync as existsSync122 } from "node:fs";
-import { randomBytes as randomBytes24 } from "node:crypto";
+import { randomBytes as randomBytes25 } from "node:crypto";
 import { join as join138 } from "node:path";
 function jobsDir2(repoPath) {
   const root = resolve45(repoPath ?? process.cwd());
@@ -633609,7 +633886,7 @@ function extractSummary(captured) {
   return lines.slice(-3).join(" ").slice(0, 200);
 }
 async function runBackground(task, config, opts) {
-  const id = `job-${randomBytes24(3).toString("hex")}`;
+  const id = `job-${randomBytes25(3).toString("hex")}`;
   const dir = jobsDir2(opts.repoPath);
   const repoRoot = resolve45(opts.repoPath ?? process.cwd());
   const job = {

package/npm-shrinkwrap.json

@@ -1,12 +1,12 @@
 {
   "name": "omnius",
-  "version": "1.0.18",
+  "version": "1.0.20",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "omnius",
-      "version": "1.0.18",
+      "version": "1.0.20",
       "bundleDependencies": [
         "image-to-ascii"
       ],

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "omnius",
-  "version": "1.0.18",
+  "version": "1.0.20",
   "description": "AI coding agent powered by open-source models (Ollama/vLLM) — interactive TUI with agentic tool-calling loop",
   "type": "module",
   "main": "./dist/index.js",