omnius 1.0.19 → 1.0.20

package/dist/index.js

@@ -15546,8 +15546,8 @@ function deleteCustomToolDefinition(name10, scope, repoRoot) {
   const dir = scope === "project" && repoRoot ? projectToolsDir(repoRoot) : globalToolsDir();
   const filePath = join24(dir, `${name10}.json`);
   if (existsSync19(filePath)) {
-    const { unlinkSync: unlinkSync25 } = __require("node:fs");
-    unlinkSync25(filePath);
+    const { unlinkSync: unlinkSync26 } = __require("node:fs");
+    unlinkSync26(filePath);
     return true;
   }
   return false;
@@ -25254,7 +25254,7 @@ function ecdsa(Point, hash, ecdsaOpts = {}) {
     bits2int_modN: "function"
   });
   ecdsaOpts = Object.assign({}, ecdsaOpts);
-  const randomBytes25 = ecdsaOpts.randomBytes || randomBytes7;
+  const randomBytes26 = ecdsaOpts.randomBytes || randomBytes7;
   const hmac2 = ecdsaOpts.hmac || ((key, msg) => hmac(hash, key, msg));
   const { Fp, Fn } = Point;
   const { ORDER: CURVE_ORDER, BITS: fnBits } = Fn;
@@ -25396,7 +25396,7 @@ function ecdsa(Point, hash, ecdsaOpts = {}) {
       throw new Error("invalid private key");
     const seedArgs = [int2octets(d2), int2octets(h1int)];
     if (extraEntropy != null && extraEntropy !== false) {
-      const e2 = extraEntropy === true ? randomBytes25(lengths.secretKey) : extraEntropy;
+      const e2 = extraEntropy === true ? randomBytes26(lengths.secretKey) : extraEntropy;
       seedArgs.push(abytes(e2, void 0, "extraEntropy"));
     }
     const seed = concatBytes(...seedArgs);
@@ -61906,9 +61906,9 @@ var init_cookies = __esm({
 
 // ../node_modules/@libp2p/http-peer-id-auth/dist/src/utils.js
 function generateChallenge() {
-  const randomBytes25 = new Uint8Array(32);
-  crypto.getRandomValues(randomBytes25);
-  return toString2(randomBytes25, "base64urlpad");
+  const randomBytes26 = new Uint8Array(32);
+  crypto.getRandomValues(randomBytes26);
+  return toString2(randomBytes26, "base64urlpad");
 }
 function encodeAuthParams(params) {
   const encodedParams = Object.entries(params).map(([key, value2]) => `${key}="${value2}"`).join(", ");
@@ -234104,7 +234104,7 @@ var require_websocket2 = __commonJS({
     var http6 = __require("http");
     var net5 = __require("net");
     var tls2 = __require("tls");
-    var { randomBytes: randomBytes25, createHash: createHash24 } = __require("crypto");
+    var { randomBytes: randomBytes26, createHash: createHash24 } = __require("crypto");
     var { Duplex: Duplex3, Readable } = __require("stream");
     var { URL: URL3 } = __require("url");
     var PerMessageDeflate3 = require_permessage_deflate2();
@@ -234634,7 +234634,7 @@ var require_websocket2 = __commonJS({
         }
       }
       const defaultPort = isSecure ? 443 : 80;
-      const key = randomBytes25(16).toString("base64");
+      const key = randomBytes26(16).toString("base64");
       const request = isSecure ? https4.request : http6.request;
       const protocolSet = /* @__PURE__ */ new Set();
       let perMessageDeflate;
@@ -255836,8 +255836,8 @@ var init_browser_action = __esm({
               const afterDom = await apiCall("/dom", "GET");
               const afterTitle = (afterDom.dom || "").match(/<title[^>]*>([^<]*)<\/title>/i)?.[1] || "";
               try {
-                const { unlinkSync: unlinkSync25 } = await import("node:fs");
-                unlinkSync25(imagePath);
+                const { unlinkSync: unlinkSync26 } = await import("node:fs");
+                unlinkSync26(imagePath);
               } catch {
               }
               return {
@@ -542582,7 +542582,7 @@ ${result}`
             let resizedBase64 = null;
             try {
               const { execSync: execSync60 } = await import("node:child_process");
-              const { writeFileSync: writeFileSync71, readFileSync: readFileSync102, unlinkSync: unlinkSync25 } = await import("node:fs");
+              const { writeFileSync: writeFileSync71, readFileSync: readFileSync102, unlinkSync: unlinkSync26 } = await import("node:fs");
               const { join: join142 } = await import("node:path");
               const { tmpdir: tmpdir23 } = await import("node:os");
               const tmpIn = join142(tmpdir23(), `omnius_img_in_${Date.now()}.png`);
@@ -542595,11 +542595,11 @@ ${result}`
               const resizedBuf = readFileSync102(tmpOut);
               resizedBase64 = `data:image/jpeg;base64,${resizedBuf.toString("base64")}`;
               try {
-                unlinkSync25(tmpIn);
+                unlinkSync26(tmpIn);
               } catch {
               }
               try {
-                unlinkSync25(tmpOut);
+                unlinkSync26(tmpOut);
               } catch {
               }
             } catch {
@@ -551117,7 +551117,7 @@ var require_websocket3 = __commonJS({
     var http6 = __require("http");
     var net5 = __require("net");
     var tls2 = __require("tls");
-    var { randomBytes: randomBytes25, createHash: createHash24 } = __require("crypto");
+    var { randomBytes: randomBytes26, createHash: createHash24 } = __require("crypto");
     var { Duplex: Duplex3, Readable } = __require("stream");
     var { URL: URL3 } = __require("url");
     var PerMessageDeflate3 = require_permessage_deflate3();
@@ -551647,7 +551647,7 @@ var require_websocket3 = __commonJS({
         }
       }
       const defaultPort = isSecure ? 443 : 80;
-      const key = randomBytes25(16).toString("base64");
+      const key = randomBytes26(16).toString("base64");
       const request = isSecure ? https4.request : http6.request;
       const protocolSet = /* @__PURE__ */ new Set();
       let perMessageDeflate;
@@ -579688,11 +579688,11 @@ async function handleSlashCommand(input, ctx3) {
         }
         if (action === "new") {
           try {
-            const { randomBytes: randomBytes25 } = await import("node:crypto");
+            const { randomBytes: randomBytes26 } = await import("node:crypto");
             const { homedir: homedir48 } = await import("node:os");
             const { mkdirSync: mkdirSync76, writeFileSync: writeFileSync71 } = await import("node:fs");
             const { join: join142 } = await import("node:path");
-            const newKey = randomBytes25(16).toString("hex");
+            const newKey = randomBytes26(16).toString("hex");
             process.env["OMNIUS_API_KEY"] = newKey;
             const dir = join142(homedir48(), ".omnius");
             mkdirSync76(dir, { recursive: true });
@@ -579949,8 +579949,8 @@ async function handleSlashCommand(input, ctx3) {
           }
           process.env["OMNIUS_ACCESS"] = val2;
           if (val2 === "any" && !process.env["OMNIUS_API_KEY"]) {
-            const { randomBytes: randomBytes25 } = await import("node:crypto");
-            const apiKey = randomBytes25(16).toString("hex");
+            const { randomBytes: randomBytes26 } = await import("node:crypto");
+            const apiKey = randomBytes26(16).toString("hex");
             process.env["OMNIUS_API_KEY"] = apiKey;
             renderInfo(`Generated API key: ${c3.bold(c3.yellow(apiKey))}`);
             renderInfo(
@@ -580069,8 +580069,8 @@ async function handleSlashCommand(input, ctx3) {
       }
       process.env["OMNIUS_ACCESS"] = val;
       if (val === "any" && !process.env["OMNIUS_API_KEY"]) {
-        const { randomBytes: randomBytes25 } = await import("node:crypto");
-        const apiKey = randomBytes25(16).toString("hex");
+        const { randomBytes: randomBytes26 } = await import("node:crypto");
+        const apiKey = randomBytes26(16).toString("hex");
         process.env["OMNIUS_API_KEY"] = apiKey;
         renderInfo(`Generated API key: ${c3.bold(c3.yellow(apiKey))}`);
         renderInfo(
@@ -590377,11 +590377,11 @@ var init_commands = __esm({
           process.env["OMNIUS_ACCESS"] = val;
           if (val === "any" && !process.env["OMNIUS_API_KEY"]) {
             try {
-              const { randomBytes: randomBytes25 } = await import("node:crypto");
+              const { randomBytes: randomBytes26 } = await import("node:crypto");
               const { homedir: homedir48 } = await import("node:os");
               const { mkdirSync: mkdirSync76, writeFileSync: writeFileSync71 } = await import("node:fs");
               const { join: join142 } = await import("node:path");
-              const apiKey = randomBytes25(16).toString("hex");
+              const apiKey = randomBytes26(16).toString("hex");
               process.env["OMNIUS_API_KEY"] = apiKey;
               const dir = join142(homedir48(), ".omnius");
               mkdirSync76(dir, { recursive: true });
@@ -596404,11 +596404,13 @@ var init_tool_policy = __esm({
 });
 
 // packages/cli/src/tui/telegram-creative-tools.ts
+import { createCipheriv as createCipheriv4, createDecipheriv as createDecipheriv4, randomBytes as randomBytes21 } from "node:crypto";
 import {
   existsSync as existsSync104,
   mkdirSync as mkdirSync59,
   readFileSync as readFileSync85,
   statSync as statSync35,
+  unlinkSync as unlinkSync19,
   writeFileSync as writeFileSync55
 } from "node:fs";
 import { mkdir as mkdir17 } from "node:fs/promises";
@@ -596435,6 +596437,7 @@ function formatTelegramCreativeWorkspacePrompt(root) {
     `Workspace root: ${root}`,
     "Creative file tools are scoped to that folder only.",
     "Allowed: create and send non-executable creative artifacts in this workspace.",
+    "At rest, artifacts are stored as random internal blobs with random header bytes; requested filenames are logical names restored only during Telegram upload.",
     "Forbidden: delete files, create scripts/executables, access paths outside this workspace, mutate the project tree, run shell/Python/code commands, or touch system state.",
     "When a user asks for an artifact to be sent, create it here and then call telegram_send_file. The bridge also auto-attaches recorded artifacts as a fallback. Refer to the attachment naturally; do not expose filesystem paths unless the admin explicitly asks."
   ].join("\n");
@@ -596461,7 +596464,7 @@ function collectGeneratedArtifactPathsFromText(text, root) {
     const value2 = match[1];
     if (!value2) continue;
     const guarded = guardPath(rootAbs, value2);
-    if (guarded.ok && existsSync104(guarded.path.abs) && safeStatFile(guarded.path.abs)) {
+    if (guarded.ok && (isManifestArtifact(rootAbs, guarded.path.rel) || existsSync104(guarded.path.abs) && safeStatFile(guarded.path.abs))) {
       paths.add(guarded.path.abs);
     }
   }
@@ -596470,7 +596473,7 @@ function collectGeneratedArtifactPathsFromText(text, root) {
     const value2 = marker?.[1]?.trim().replace(/^["']|["']$/g, "");
     if (!value2) continue;
     const guarded = guardPath(rootAbs, value2);
-    if (guarded.ok && existsSync104(guarded.path.abs) && safeStatFile(guarded.path.abs)) {
+    if (guarded.ok && (isManifestArtifact(rootAbs, guarded.path.rel) || existsSync104(guarded.path.abs) && safeStatFile(guarded.path.abs))) {
       paths.add(guarded.path.abs);
     }
   }
@@ -596480,11 +596483,7 @@ function buildTelegramCreativeTools(repoRoot, chatId, backendUrl, imageDefaults
   const root = telegramCreativeWorkspaceRoot(repoRoot, chatId);
   ensureManifest(root);
   return [
-    scopedTool(new FileReadTool(root), root, "read"),
-    scopedTool(new ListDirectoryTool(root), root, "list"),
     scopedTool(new FileWriteTool(root), root, "create"),
-    scopedTool(new FileEditTool(root), root, "edit"),
-    scopedTool(new FilePatchTool(root), root, "edit"),
     scopedTool(new StructuredFileTool(root), root, "create"),
     scopedTool(new ImageGenerateTool(root, backendUrl, imageDefaults), root, "generate"),
     scopedTool(new AudioGenerateTool(root, audioDefaults), root, "generate"),
@@ -596606,12 +596605,21 @@ function readManifest(root) {
   ensureManifest(root);
   try {
     const parsed = JSON.parse(readFileSync85(manifestPath(root), "utf8"));
+    const objects = parsed.objects && typeof parsed.objects === "object" ? Object.fromEntries(
+      Object.entries(parsed.objects).filter((entry) => {
+        const value2 = entry[1];
+        return Boolean(
+          value2 && typeof value2.logicalRel === "string" && typeof value2.storedRel === "string" && typeof value2.originalName === "string" && typeof value2.prefixBytes === "number" && typeof value2.size === "number"
+        );
+      })
+    ) : {};
     return {
       files: Array.isArray(parsed.files) ? parsed.files.filter((file) => typeof file === "string") : [],
+      objects,
       updatedAt: typeof parsed.updatedAt === "string" ? parsed.updatedAt : (/* @__PURE__ */ new Date()).toISOString()
     };
   } catch {
-    return { files: [], updatedAt: (/* @__PURE__ */ new Date()).toISOString() };
+    return { files: [], objects: {}, updatedAt: (/* @__PURE__ */ new Date()).toISOString() };
   }
 }
 function writeManifest(root, manifest) {
@@ -596620,18 +596628,114 @@ function writeManifest(root, manifest) {
 }
 function manifestHas(root, relPath) {
   const rel = relPath.replace(/\\/g, "/");
-  return readManifest(root).files.includes(rel);
+  const manifest = readManifest(root);
+  return manifest.files.includes(rel) || Boolean(manifest.objects?.[rel]);
 }
 function rememberCreated(root, absPath) {
   const guarded = guardPath(root, absPath);
   if (!guarded.ok || guarded.path.rel === ".") return;
   const manifest = readManifest(root);
   const rel = guarded.path.rel.replace(/\\/g, "/");
+  if (publicCreativeArtifactPolicyError(guarded.path.abs)) return;
+  if (existsSync104(guarded.path.abs) && safeStatFile(guarded.path.abs)) {
+    const previous = manifest.objects?.[rel];
+    if (previous) {
+      const previousPath = resolve38(root, previous.storedRel);
+      if (isInside(resolve38(root), previousPath) && existsSync104(previousPath)) {
+        try {
+          unlinkSync19(previousPath);
+        } catch {
+        }
+      }
+    }
+    mkdirSync59(join119(root, OBJECTS_DIR), { recursive: true });
+    const data = readFileSync85(guarded.path.abs);
+    const prefix = randomBytes21(48);
+    const key = randomBytes21(32);
+    const iv = randomBytes21(12);
+    const cipher = createCipheriv4("aes-256-gcm", key, iv);
+    const encrypted = Buffer.concat([cipher.update(data), cipher.final()]);
+    const tag = cipher.getAuthTag();
+    const storedRel = join119(OBJECTS_DIR, `${Date.now()}-${randomBytes21(12).toString("hex")}.blob`).replace(/\\/g, "/");
+    const storedAbs = join119(root, storedRel);
+    writeFileSync55(storedAbs, Buffer.concat([prefix, encrypted]));
+    try {
+      unlinkSync19(guarded.path.abs);
+    } catch {
+    }
+    manifest.objects = manifest.objects || {};
+    manifest.objects[rel] = {
+      logicalRel: rel,
+      storedRel,
+      originalName: basename22(guarded.path.abs),
+      prefixBytes: prefix.length,
+      encrypted: true,
+      key: key.toString("base64"),
+      iv: iv.toString("base64"),
+      tag: tag.toString("base64"),
+      size: data.length,
+      updatedAt: (/* @__PURE__ */ new Date()).toISOString()
+    };
+  }
   if (!manifest.files.includes(rel)) manifest.files.push(rel);
   manifest.files.sort();
   manifest.updatedAt = (/* @__PURE__ */ new Date()).toISOString();
   writeManifest(root, manifest);
 }
+function isManifestArtifact(root, relPath) {
+  return manifestHas(root, relPath);
+}
+function materializeTelegramCreativeArtifactForSend(root, rawPath) {
+  const rootAbs = resolve38(root);
+  const guarded = guardPath(rootAbs, rawPath);
+  if (!guarded.ok) return { ok: false, error: guarded.error };
+  const policyError = publicCreativeArtifactPolicyError(guarded.path.abs);
+  if (policyError) return { ok: false, error: policyError };
+  const manifest = readManifest(rootAbs);
+  const rel = guarded.path.rel.replace(/\\/g, "/");
+  const object = manifest.objects?.[rel];
+  if (object) {
+    const storedAbs = resolve38(rootAbs, object.storedRel);
+    if (!isInside(rootAbs, storedAbs) || !existsSync104(storedAbs) || !safeStatFile(storedAbs)) {
+      return { ok: false, error: `Scoped artifact storage is missing for ${rel}.` };
+    }
+    const blob = readFileSync85(storedAbs);
+    if (blob.length < object.prefixBytes) {
+      return { ok: false, error: `Scoped artifact storage is corrupt for ${rel}.` };
+    }
+    let payload = blob.subarray(object.prefixBytes);
+    if (object.encrypted) {
+      if (!object.key || !object.iv || !object.tag) {
+        return { ok: false, error: `Scoped artifact encryption metadata is missing for ${rel}.` };
+      }
+      const decipher = createDecipheriv4(
+        "aes-256-gcm",
+        Buffer.from(object.key, "base64"),
+        Buffer.from(object.iv, "base64")
+      );
+      decipher.setAuthTag(Buffer.from(object.tag, "base64"));
+      payload = Buffer.concat([decipher.update(payload), decipher.final()]);
+    }
+    const stageDir = join119(rootAbs, SEND_DIR, `${Date.now()}-${randomBytes21(8).toString("hex")}`);
+    mkdirSync59(stageDir, { recursive: true });
+    const staged = join119(stageDir, object.originalName || basename22(rel));
+    writeFileSync55(staged, payload);
+    return {
+      ok: true,
+      path: staged,
+      cleanup: () => {
+        try {
+          unlinkSync19(staged);
+        } catch {
+        }
+      }
+    };
+  }
+  if (existsSync104(guarded.path.abs) && safeStatFile(guarded.path.abs)) {
+    return { ok: true, path: guarded.path.abs };
+  }
+  return { ok: false, error: `Scoped artifact not found in manifest: ${rawPath}` };
+}
 function safeStatFile(path11) {
   try {
     return statSync35(path11).isFile();
@@ -596649,13 +596753,14 @@ function denied(error) {
     mutatedFiles: []
   };
 }
-var MANIFEST_FILE, PATH_KEYS, MEDIA_PATH_RE, PUBLIC_EXECUTABLE_ARTIFACT_EXTENSIONS, CreativeAudioFileTool;
+var MANIFEST_FILE, OBJECTS_DIR, SEND_DIR, PATH_KEYS, MEDIA_PATH_RE, PUBLIC_EXECUTABLE_ARTIFACT_EXTENSIONS, CreativeAudioFileTool;
 var init_telegram_creative_tools = __esm({
   "packages/cli/src/tui/telegram-creative-tools.ts"() {
     "use strict";
-    init_typed_node_events();
     init_dist5();
     MANIFEST_FILE = ".omnius-creative-manifest.json";
+    OBJECTS_DIR = ".objects";
+    SEND_DIR = ".send";
     PATH_KEYS = ["path", "file", "file_path", "filename", "filepath", "filePath"];
     MEDIA_PATH_RE = /(?:^|[\s([])(\/[^\s<>"')\]]+\.[A-Za-z0-9]{1,12})(?:$|[\s),.\]])/g;
     PUBLIC_EXECUTABLE_ARTIFACT_EXTENSIONS = /* @__PURE__ */ new Set([
@@ -596800,7 +596905,7 @@ __export(vision_ingress_exports, {
   runVisionIngress: () => runVisionIngress
 });
 import { execFileSync as execFileSync4 } from "node:child_process";
-import { existsSync as existsSync105, readFileSync as readFileSync86, unlinkSync as unlinkSync19 } from "node:fs";
+import { existsSync as existsSync105, readFileSync as readFileSync86, unlinkSync as unlinkSync20 } from "node:fs";
 import { join as join120 } from "node:path";
 function isTesseractAvailable() {
   try {
@@ -596858,7 +596963,7 @@ function advancedOcr(imagePath) {
         const text = readFileSync86(txtFile, "utf-8").trim();
         if (text.length > 0) results.push(text);
         try {
-          unlinkSync19(txtFile);
+          unlinkSync20(txtFile);
         } catch {
         }
       }
@@ -596943,7 +597048,7 @@ var init_vision_ingress = __esm({
 });
 
 // packages/cli/src/tui/telegram-bridge.ts
-import { mkdirSync as mkdirSync60, existsSync as existsSync106, unlinkSync as unlinkSync20, readdirSync as readdirSync36, statSync as statSync36, readFileSync as readFileSync87, writeFileSync as writeFileSync57 } from "node:fs";
+import { mkdirSync as mkdirSync60, existsSync as existsSync106, unlinkSync as unlinkSync21, readdirSync as readdirSync36, statSync as statSync36, readFileSync as readFileSync87, writeFileSync as writeFileSync57 } from "node:fs";
 import { join as join121, resolve as resolve39, basename as basename23, relative as relative13, isAbsolute as isAbsolute7 } from "node:path";
 import { writeFile as writeFileAsync } from "node:fs/promises";
 import { createHash as createHash19, randomInt } from "node:crypto";
@@ -600325,6 +600430,8 @@ Scoped workspace: ${scopedRoot}`,
                 error: `Telegram file upload failed: ${err instanceof Error ? err.message : String(err)}`,
                 durationMs: performance.now() - start2
               };
+            } finally {
+              file.cleanup?.();
             }
           }
         };
@@ -600378,14 +600485,12 @@ ${knownList}` : "Private-user telegram_send_file target must be this DM or a kno
       resolveTelegramFilePath(rawPath, repoRoot, scopedRoot) {
         const base3 = scopedRoot ? resolve39(scopedRoot) : resolve39(repoRoot);
         const trimmed = rawPath.trim().replace(/^["']|["']$/g, "");
-        const abs = isAbsolute7(trimmed) ? resolve39(trimmed) : resolve39(base3, trimmed);
-        if (scopedRoot && !isPathInside(base3, abs)) {
-          return { ok: false, error: `Public/group telegram_send_file can only send files inside ${base3}.` };
-        }
         if (scopedRoot) {
-          const policyError = publicCreativeArtifactPolicyError(abs);
-          if (policyError) return { ok: false, error: policyError };
+          const materialized = materializeTelegramCreativeArtifactForSend(base3, trimmed);
+          if (!materialized.ok) return materialized;
+          return materialized;
         }
+        const abs = isAbsolute7(trimmed) ? resolve39(trimmed) : resolve39(base3, trimmed);
         if (!existsSync106(abs)) return { ok: false, error: `File does not exist: ${trimmed}` };
         if (!statSync36(abs).isFile()) return { ok: false, error: `Path is not a file: ${trimmed}` };
         return { ok: true, path: abs };
@@ -600546,7 +600651,7 @@ ${visionContext}]`;
         for (const [key, entry] of this.mediaCache) {
           if (now - entry.cachedAt > MEDIA_CACHE_TTL_MS) {
             try {
-              unlinkSync20(entry.localPath);
+              unlinkSync21(entry.localPath);
             } catch {
             }
             this.mediaCache.delete(key);
@@ -600713,15 +600818,22 @@ Content-Type: ${contentType}\r
           const abs = resolve39(path11);
           if (!isPathInside(rootAbs, abs)) continue;
           if (!includeMentioned && alreadySentByText.has(abs)) continue;
-          if (!existsSync106(abs) || !statSync36(abs).isFile()) continue;
-          const kind = classifyMedia(abs) ?? "document";
+          const materialized = materializeTelegramCreativeArtifactForSend(rootAbs, abs);
+          if (!materialized.ok) continue;
+          if (!existsSync106(materialized.path) || !statSync36(materialized.path).isFile()) {
+            materialized.cleanup?.();
+            continue;
+          }
+          const kind = classifyMedia(materialized.path) ?? "document";
           await this.sendMediaReference(msg.chatId, {
-            original: abs,
-            value: abs,
+            original: materialized.path,
+            value: materialized.path,
             kind,
             source: "file",
             audioAsVoice: kind === "voice"
-          }).catch(() => null);
+          }).catch(() => null).finally(() => {
+            materialized.cleanup?.();
+          });
         }
       }
       async uploadTelegramFiles(method, fields, files) {
@@ -601163,7 +601275,7 @@ import {
   writeFileSync as writeFileSync58,
   renameSync as renameSync5,
   mkdirSync as mkdirSync61,
-  unlinkSync as unlinkSync21
+  unlinkSync as unlinkSync22
 } from "node:fs";
 import { join as join122 } from "node:path";
 import { homedir as homedir36 } from "node:os";
@@ -601201,7 +601313,7 @@ function persistInFlight(j) {
 function deleteInFlightFile(id) {
   try {
     const p2 = inFlightPath(id);
-    if (existsSync107(p2)) unlinkSync21(p2);
+    if (existsSync107(p2)) unlinkSync22(p2);
   } catch {
   }
 }
@@ -601422,7 +601534,7 @@ function drainCheckins(sessionId) {
   try {
     const raw = readFileSync88(fp, "utf-8");
     try {
-      unlinkSync21(fp);
+      unlinkSync22(fp);
     } catch {
     }
     if (!raw.trim()) return [];
@@ -601460,7 +601572,7 @@ function listSessions2() {
 function deleteSession2(id) {
   try {
     const p2 = sessionPath(id);
-    if (existsSync107(p2)) unlinkSync21(p2);
+    if (existsSync107(p2)) unlinkSync22(p2);
   } catch {
   }
   deleteInFlightFile(id);
@@ -602396,7 +602508,7 @@ var init_access_policy = __esm({
 
 // packages/cli/src/api/project-preferences.ts
 import { createHash as createHash20 } from "node:crypto";
-import { existsSync as existsSync109, mkdirSync as mkdirSync63, readFileSync as readFileSync90, renameSync as renameSync7, writeFileSync as writeFileSync60, unlinkSync as unlinkSync22 } from "node:fs";
+import { existsSync as existsSync109, mkdirSync as mkdirSync63, readFileSync as readFileSync90, renameSync as renameSync7, writeFileSync as writeFileSync60, unlinkSync as unlinkSync23 } from "node:fs";
 import { homedir as homedir38 } from "node:os";
 import { join as join124, resolve as resolve41 } from "node:path";
 import { randomUUID as randomUUID15 } from "node:crypto";
@@ -602457,7 +602569,7 @@ function writeProjectPreferences(root, partial) {
     } catch {
     }
     try {
-      unlinkSync22(tmp);
+      unlinkSync23(tmp);
     } catch {
     }
     throw err;
@@ -602468,7 +602580,7 @@ function deleteProjectPreferences(root) {
   try {
     const file = prefsPath(root);
     if (!existsSync109(file)) return false;
-    unlinkSync22(file);
+    unlinkSync23(file);
     return true;
   } catch {
     return false;
@@ -604515,7 +604627,7 @@ __export(runtime_keys_exports, {
 import { existsSync as existsSync113, readFileSync as readFileSync93, writeFileSync as writeFileSync61, mkdirSync as mkdirSync66, chmodSync } from "node:fs";
 import { join as join127 } from "node:path";
 import { homedir as homedir40 } from "node:os";
-import { randomBytes as randomBytes21 } from "node:crypto";
+import { randomBytes as randomBytes22 } from "node:crypto";
 function ensureDir2() {
   const dir = join127(homedir40(), ".omnius");
   if (!existsSync113(dir)) mkdirSync66(dir, { recursive: true });
@@ -604541,7 +604653,7 @@ function persistAll(records) {
 }
 function mintKey(args) {
   const records = loadAll();
-  const key = `omnius_${randomBytes21(32).toString("hex")}`;
+  const key = `omnius_${randomBytes22(32).toString("hex")}`;
   const record = {
     key,
     scope: args.scope,
@@ -607849,11 +607961,11 @@ async function handleAimsIncidentPost(ctx3) {
       }));
       return true;
     }
-    const { randomBytes: randomBytes25 } = await import("node:crypto");
+    const { randomBytes: randomBytes26 } = await import("node:crypto");
     const record = await withAimsLock("incidents.json", () => {
       const existing = readAimsFile("incidents.json", []);
       const rec = {
-        id: `INC-${Date.now()}-${randomBytes25(4).toString("hex")}`,
+        id: `INC-${Date.now()}-${randomBytes26(4).toString("hex")}`,
         ts: (/* @__PURE__ */ new Date()).toISOString(),
         raised_by: user ?? "anonymous",
         status: "open",
@@ -617014,10 +617126,10 @@ var init_usage_tracker = __esm({
 });
 
 // packages/cli/src/api/profiles.ts
-import { existsSync as existsSync118, readFileSync as readFileSync97, writeFileSync as writeFileSync64, mkdirSync as mkdirSync69, readdirSync as readdirSync40, unlinkSync as unlinkSync23 } from "node:fs";
+import { existsSync as existsSync118, readFileSync as readFileSync97, writeFileSync as writeFileSync64, mkdirSync as mkdirSync69, readdirSync as readdirSync40, unlinkSync as unlinkSync24 } from "node:fs";
 import { join as join132 } from "node:path";
 import { homedir as homedir43 } from "node:os";
-import { createCipheriv as createCipheriv4, createDecipheriv as createDecipheriv4, randomBytes as randomBytes22, scryptSync as scryptSync3 } from "node:crypto";
+import { createCipheriv as createCipheriv5, createDecipheriv as createDecipheriv5, randomBytes as randomBytes23, scryptSync as scryptSync3 } from "node:crypto";
 function globalProfileDir() {
   return join132(homedir43(), ".omnius", "profiles");
 }
@@ -617095,16 +617207,16 @@ function deleteProfile(name10, scope = "global", projectDir2) {
   const dir = scope === "project" ? projectProfileDir(projectDir2) : globalProfileDir();
   const filePath = join132(dir, `${sanitized}.json`);
   if (existsSync118(filePath)) {
-    unlinkSync23(filePath);
+    unlinkSync24(filePath);
     return true;
   }
   return false;
 }
 function encryptProfile(profile, password) {
-  const salt = randomBytes22(32);
+  const salt = randomBytes23(32);
   const key = scryptSync3(password, salt, 32);
-  const iv = randomBytes22(16);
-  const cipher = createCipheriv4("aes-256-gcm", key, iv);
+  const iv = randomBytes23(16);
+  const cipher = createCipheriv5("aes-256-gcm", key, iv);
   const plaintext = JSON.stringify(profile);
   const encrypted = Buffer.concat([cipher.update(plaintext, "utf8"), cipher.final()]);
   const tag = cipher.getAuthTag();
@@ -617123,7 +617235,7 @@ function decryptProfile(enc, password) {
     const salt = Buffer.from(enc.salt, "hex");
     const key = scryptSync3(password, salt, 32);
     const iv = Buffer.from(enc.iv, "hex");
-    const decipher = createDecipheriv4("aes-256-gcm", key, iv);
+    const decipher = createDecipheriv5("aes-256-gcm", key, iv);
     decipher.setAuthTag(Buffer.from(enc.tag, "hex"));
     const decrypted = Buffer.concat([
       decipher.update(Buffer.from(enc.data, "hex")),
@@ -617755,8 +617867,8 @@ import { fileURLToPath as fileURLToPath17 } from "node:url";
 import { dirname as dirname37, join as join135, resolve as resolve43 } from "node:path";
 import { homedir as homedir45 } from "node:os";
 import { spawn as spawn29, execSync as execSync57 } from "node:child_process";
-import { mkdirSync as mkdirSync71, writeFileSync as writeFileSync66, readFileSync as readFileSync98, readdirSync as readdirSync41, existsSync as existsSync120, watch as fsWatch3, renameSync as renameSync8, unlinkSync as unlinkSync24 } from "node:fs";
-import { randomBytes as randomBytes23, randomUUID as randomUUID16 } from "node:crypto";
+import { mkdirSync as mkdirSync71, writeFileSync as writeFileSync66, readFileSync as readFileSync98, readdirSync as readdirSync41, existsSync as existsSync120, watch as fsWatch3, renameSync as renameSync8, unlinkSync as unlinkSync25 } from "node:fs";
+import { randomBytes as randomBytes24, randomUUID as randomUUID16 } from "node:crypto";
 import { createHash as createHash23 } from "node:crypto";
 function getVersion3() {
   try {
@@ -618505,13 +618617,13 @@ function pruneOldJobs() {
       const ts = ageRef ? Date.parse(ageRef) : NaN;
       if (Number.isFinite(ts) && ts < cutoffMs) {
         try {
-          unlinkSync24(path11);
+          unlinkSync25(path11);
         } catch {
         }
         const outFile = path11.replace(/\.json$/, ".output");
         if (existsSync120(outFile)) {
           try {
-            unlinkSync24(outFile);
+            unlinkSync25(outFile);
           } catch {
           }
         }
@@ -618521,7 +618633,7 @@ function pruneOldJobs() {
       }
     } catch {
       try {
-        unlinkSync24(path11);
+        unlinkSync25(path11);
         pruned++;
       } catch {
       }
@@ -618813,7 +618925,7 @@ function atomicJobWrite(dir, id, job) {
     } catch {
     }
     try {
-      unlinkSync24(tmpPath);
+      unlinkSync25(tmpPath);
     } catch {
     }
   }
@@ -619378,7 +619490,7 @@ ${messages2[firstSystemIdx].content}`
       messages2.unshift({ role: "system", content: SYSTEM_FACTUAL_FIRST });
     }
   }
-  const chatId = `chatcmpl-${randomBytes23(12).toString("hex")}`;
+  const chatId = `chatcmpl-${randomBytes24(12).toString("hex")}`;
   const turnsLog = [];
   for (let turn = 1; turn <= maxTurns; turn++) {
     if (Date.now() > totalDeadline) {
@@ -619643,7 +619755,7 @@ async function handleV1ChatCompletions(req2, res, ollamaUrl) {
       "Cache-Control": "no-cache",
       "Connection": "keep-alive"
     });
-    const chatId = `chatcmpl-${randomBytes23(12).toString("hex")}`;
+    const chatId = `chatcmpl-${randomBytes24(12).toString("hex")}`;
     let buffer2 = "";
     ollamaStream(
       targetUrl,
@@ -619685,7 +619797,7 @@ async function handleV1ChatCompletions(req2, res, ollamaUrl) {
               if (ollamaChunk.message.content) delta.content = ollamaChunk.message.content;
               if (ollamaChunk.message.tool_calls) {
                 delta.tool_calls = ollamaChunk.message.tool_calls.map((tc, idx) => ({
-                  id: tc.id || `call_${randomBytes23(8).toString("hex")}`,
+                  id: tc.id || `call_${randomBytes24(8).toString("hex")}`,
                   type: "function",
                   function: {
                     name: tc?.function?.name ?? tc?.name ?? "",
@@ -619764,14 +619876,14 @@ async function handleV1ChatCompletions(req2, res, ollamaUrl) {
       if (ollamaResp.eval_count) metrics.totalTokensOut += ollamaResp.eval_count;
       if (ollamaResp.prompt_eval_count) metrics.totalTokensIn += ollamaResp.prompt_eval_count;
       trackTokens("local", ollamaResp.prompt_eval_count ?? 0, ollamaResp.eval_count ?? 0);
-      const chatId = `chatcmpl-${randomBytes23(12).toString("hex")}`;
+      const chatId = `chatcmpl-${randomBytes24(12).toString("hex")}`;
       const responseMessage = {
         role: ollamaResp.message?.role ?? "assistant",
         content: ollamaResp.message?.content ?? ""
       };
       if (ollamaResp.message?.tool_calls && ollamaResp.message.tool_calls.length > 0) {
         responseMessage.tool_calls = ollamaResp.message.tool_calls.map((tc, idx) => ({
-          id: tc.id || `call_${randomBytes23(8).toString("hex")}`,
+          id: tc.id || `call_${randomBytes24(8).toString("hex")}`,
           type: "function",
           function: {
             name: tc?.function?.name ?? tc?.name ?? "",
@@ -620556,7 +620668,7 @@ async function handleV1Run(req2, res) {
       return;
     }
   }
-  const id = `job-${randomBytes23(8).toString("hex")}`;
+  const id = `job-${randomBytes24(8).toString("hex")}`;
   const dir = jobsDir();
   const workingDir = requestBody["working_directory"] || req2.headers["x-working-directory"];
   const isolate = requestBody["isolate"] === true;
@@ -621723,7 +621835,7 @@ async function handleRequest(req2, res, ollamaUrl, verbose) {
           return;
         }
         const { tmpdir: tmpdir23 } = await import("node:os");
-        const { writeFileSync: writeFileSync71, unlinkSync: unlinkSync25 } = await import("node:fs");
+        const { writeFileSync: writeFileSync71, unlinkSync: unlinkSync26 } = await import("node:fs");
         const { join: pjoin } = await import("node:path");
         const tmpPath = pjoin(tmpdir23(), `omnius-clone-upload-${Date.now()}-${safeName2}`);
         writeFileSync71(tmpPath, buf);
@@ -621738,7 +621850,7 @@ async function handleRequest(req2, res, ollamaUrl, verbose) {
           });
         } finally {
           try {
-            unlinkSync25(tmpPath);
+            unlinkSync26(tmpPath);
           } catch {
           }
         }
@@ -624191,8 +624303,8 @@ function startApiServer(options2 = {}) {
             const job = JSON.parse(readFileSync98(jobPath, "utf-8"));
             const jobTime = new Date(job.startedAt ?? job.completedAt ?? 0).getTime();
             if (jobTime > 0 && jobTime < cutoff && job.status !== "running") {
-              const { unlinkSync: unlinkSync25 } = require4("node:fs");
-              unlinkSync25(jobPath);
+              const { unlinkSync: unlinkSync26 } = require4("node:fs");
+              unlinkSync26(jobPath);
             }
           } catch {
           }
@@ -633676,7 +633788,7 @@ __export(run_exports, {
 import { resolve as resolve45 } from "node:path";
 import { spawn as spawn30 } from "node:child_process";
 import { mkdirSync as mkdirSync74, writeFileSync as writeFileSync69, readFileSync as readFileSync101, readdirSync as readdirSync43, existsSync as existsSync122 } from "node:fs";
-import { randomBytes as randomBytes24 } from "node:crypto";
+import { randomBytes as randomBytes25 } from "node:crypto";
 import { join as join138 } from "node:path";
 function jobsDir2(repoPath) {
   const root = resolve45(repoPath ?? process.cwd());
@@ -633774,7 +633886,7 @@ function extractSummary(captured) {
   return lines.slice(-3).join(" ").slice(0, 200);
 }
 async function runBackground(task, config, opts) {
-  const id = `job-${randomBytes24(3).toString("hex")}`;
+  const id = `job-${randomBytes25(3).toString("hex")}`;
   const dir = jobsDir2(opts.repoPath);
   const repoRoot = resolve45(opts.repoPath ?? process.cwd());
   const job = {

package/npm-shrinkwrap.json

@@ -1,12 +1,12 @@
 {
   "name": "omnius",
-  "version": "1.0.19",
+  "version": "1.0.20",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "omnius",
-      "version": "1.0.19",
+      "version": "1.0.20",
       "bundleDependencies": [
         "image-to-ascii"
       ],

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "omnius",
-  "version": "1.0.19",
+  "version": "1.0.20",
   "description": "AI coding agent powered by open-source models (Ollama/vLLM) — interactive TUI with agentic tool-calling loop",
   "type": "module",
   "main": "./dist/index.js",