open-agents-ai 0.185.72 → 0.185.73

package/dist/index.js

@@ -13782,9 +13782,9 @@ print("${sentinel}")
         if (!this.proc || this.proc.killed) {
           return { success: false, path: "" };
         }
-        const { mkdirSync: mkdirSync31, writeFileSync: writeFileSync30 } = await import("node:fs");
+        const { mkdirSync: mkdirSync32, writeFileSync: writeFileSync30 } = await import("node:fs");
         const sessionDir = join22(this.cwd, ".oa", "rlm");
-        mkdirSync31(sessionDir, { recursive: true });
+        mkdirSync32(sessionDir, { recursive: true });
         const sessionPath = join22(sessionDir, "session.json");
         try {
           const inspectCode = `
@@ -13820,11 +13820,11 @@ print("__SESSION__" + json.dumps(_session) + "__SESSION__")
        *  what was previously computed. */
       async loadSessionInfo() {
         try {
-          const { readFileSync: readFileSync45, existsSync: existsSync57 } = await import("node:fs");
+          const { readFileSync: readFileSync46, existsSync: existsSync58 } = await import("node:fs");
           const sessionPath = join22(this.cwd, ".oa", "rlm", "session.json");
-          if (!existsSync57(sessionPath))
+          if (!existsSync58(sessionPath))
             return null;
-          return JSON.parse(readFileSync45(sessionPath, "utf8"));
+          return JSON.parse(readFileSync46(sessionPath, "utf8"));
         } catch {
           return null;
         }
@@ -14001,10 +14001,10 @@ var init_memory_metabolism = __esm({
         const trajDir = join23(this.cwd, ".oa", "rlm-trajectories");
         let lessons = [];
         try {
-          const { readdirSync: readdirSync24, readFileSync: readFileSync45 } = await import("node:fs");
+          const { readdirSync: readdirSync24, readFileSync: readFileSync46 } = await import("node:fs");
           const files = readdirSync24(trajDir).filter((f) => f.endsWith(".jsonl")).sort().reverse().slice(0, 3);
           for (const file of files) {
-            const lines = readFileSync45(join23(trajDir, file), "utf8").split("\n").filter((l) => l.trim());
+            const lines = readFileSync46(join23(trajDir, file), "utf8").split("\n").filter((l) => l.trim());
             for (const line of lines) {
               try {
                 const entry = JSON.parse(line);
@@ -14388,14 +14388,14 @@ ${issues.map((i) => `  - ${i}`).join("\n")}` : "  No issues found."),
        * Optionally filter by task type for phase-aware context (FSM paper insight).
        */
       getTopMemoriesSync(k = 5, taskType) {
-        const { readFileSync: readFileSync45, existsSync: existsSync57 } = __require("node:fs");
+        const { readFileSync: readFileSync46, existsSync: existsSync58 } = __require("node:fs");
         const metaDir = join23(this.cwd, ".oa", "memory", "metabolism");
         const storeFile = join23(metaDir, "store.json");
-        if (!existsSync57(storeFile))
+        if (!existsSync58(storeFile))
           return "";
         let store = [];
         try {
-          store = JSON.parse(readFileSync45(storeFile, "utf8"));
+          store = JSON.parse(readFileSync46(storeFile, "utf8"));
         } catch {
           return "";
         }
@@ -14417,14 +14417,14 @@ ${issues.map((i) => `  - ${i}`).join("\n")}` : "  No issues found."),
       /** Update memory scores based on task outcome. Called after task completion.
        *  Memories used in successful tasks get boosted. Memories present during failures get decayed. */
       updateFromOutcomeSync(surfacedMemoryText, succeeded) {
-        const { readFileSync: readFileSync45, writeFileSync: writeFileSync30, existsSync: existsSync57, mkdirSync: mkdirSync31 } = __require("node:fs");
+        const { readFileSync: readFileSync46, writeFileSync: writeFileSync30, existsSync: existsSync58, mkdirSync: mkdirSync32 } = __require("node:fs");
         const metaDir = join23(this.cwd, ".oa", "memory", "metabolism");
         const storeFile = join23(metaDir, "store.json");
-        if (!existsSync57(storeFile))
+        if (!existsSync58(storeFile))
           return;
         let store = [];
         try {
-          store = JSON.parse(readFileSync45(storeFile, "utf8"));
+          store = JSON.parse(readFileSync46(storeFile, "utf8"));
         } catch {
           return;
         }
@@ -14448,7 +14448,7 @@ ${issues.map((i) => `  - ${i}`).join("\n")}` : "  No issues found."),
           updated = true;
         }
         if (updated) {
-          mkdirSync31(metaDir, { recursive: true });
+          mkdirSync32(metaDir, { recursive: true });
           writeFileSync30(storeFile, JSON.stringify(store, null, 2));
         }
       }
@@ -14871,13 +14871,13 @@ Recommendation: Strategy ${scored[0].index + 1} scores highest.`;
       // Per EvoSkill (arXiv:2603.02766): retrieve relevant strategies from archive.
       /** Retrieve top-K strategies for context injection. Returns "" if none. */
       getRelevantStrategiesSync(k = 3, taskType) {
-        const { readFileSync: readFileSync45, existsSync: existsSync57 } = __require("node:fs");
+        const { readFileSync: readFileSync46, existsSync: existsSync58 } = __require("node:fs");
         const archiveFile = join25(this.cwd, ".oa", "arche", "variants.json");
-        if (!existsSync57(archiveFile))
+        if (!existsSync58(archiveFile))
           return "";
         let variants = [];
         try {
-          variants = JSON.parse(readFileSync45(archiveFile, "utf8"));
+          variants = JSON.parse(readFileSync46(archiveFile, "utf8"));
         } catch {
           return "";
         }
@@ -14895,13 +14895,13 @@ Recommendation: Strategy ${scored[0].index + 1} scores highest.`;
       }
       /** Archive a strategy variant synchronously (for task completion path) */
       archiveVariantSync(strategy, outcome, tags = []) {
-        const { readFileSync: readFileSync45, writeFileSync: writeFileSync30, existsSync: existsSync57, mkdirSync: mkdirSync31 } = __require("node:fs");
+        const { readFileSync: readFileSync46, writeFileSync: writeFileSync30, existsSync: existsSync58, mkdirSync: mkdirSync32 } = __require("node:fs");
         const dir = join25(this.cwd, ".oa", "arche");
         const archiveFile = join25(dir, "variants.json");
         let variants = [];
         try {
-          if (existsSync57(archiveFile))
-            variants = JSON.parse(readFileSync45(archiveFile, "utf8"));
+          if (existsSync58(archiveFile))
+            variants = JSON.parse(readFileSync46(archiveFile, "utf8"));
         } catch {
         }
         variants.push({
@@ -14916,7 +14916,7 @@ Recommendation: Strategy ${scored[0].index + 1} scores highest.`;
         });
         if (variants.length > 50)
           variants = variants.slice(-50);
-        mkdirSync31(dir, { recursive: true });
+        mkdirSync32(dir, { recursive: true });
         writeFileSync30(archiveFile, JSON.stringify(variants, null, 2));
       }
       async saveArchive(variants) {
@@ -27422,10 +27422,10 @@ ${marker}` : marker);
         if (!this._workingDirectory)
           return;
         try {
-          const { mkdirSync: mkdirSync31, writeFileSync: writeFileSync30 } = __require("node:fs");
-          const { join: join77 } = __require("node:path");
-          const sessionDir = join77(this._workingDirectory, ".oa", "session", this._sessionId);
-          mkdirSync31(sessionDir, { recursive: true });
+          const { mkdirSync: mkdirSync32, writeFileSync: writeFileSync30 } = __require("node:fs");
+          const { join: join78 } = __require("node:path");
+          const sessionDir = join78(this._workingDirectory, ".oa", "session", this._sessionId);
+          mkdirSync32(sessionDir, { recursive: true });
           const checkpoint = {
             timestamp: (/* @__PURE__ */ new Date()).toISOString(),
             sessionId: this._sessionId,
@@ -27437,7 +27437,7 @@ ${marker}` : marker);
             memexEntryCount: this._memexArchive.size,
             fileRegistrySize: this._fileRegistry.size
           };
-          writeFileSync30(join77(sessionDir, "checkpoint.json"), JSON.stringify(checkpoint, null, 2));
+          writeFileSync30(join78(sessionDir, "checkpoint.json"), JSON.stringify(checkpoint, null, 2));
         } catch {
         }
       }
@@ -28575,17 +28575,17 @@ ${transcript}`
             let resizedBase64 = null;
             try {
               const { execSync: execSync36 } = await import("node:child_process");
-              const { writeFileSync: writeFileSync30, readFileSync: readFileSync45, unlinkSync: unlinkSync13 } = await import("node:fs");
-              const { join: join77 } = await import("node:path");
+              const { writeFileSync: writeFileSync30, readFileSync: readFileSync46, unlinkSync: unlinkSync13 } = await import("node:fs");
+              const { join: join78 } = await import("node:path");
               const { tmpdir: tmpdir11 } = await import("node:os");
-              const tmpIn = join77(tmpdir11(), `oa_img_in_${Date.now()}.png`);
-              const tmpOut = join77(tmpdir11(), `oa_img_out_${Date.now()}.jpg`);
+              const tmpIn = join78(tmpdir11(), `oa_img_in_${Date.now()}.png`);
+              const tmpOut = join78(tmpdir11(), `oa_img_out_${Date.now()}.jpg`);
               writeFileSync30(tmpIn, buffer);
               const pyBin = process.platform === "win32" ? "python" : "python3";
               const escapedIn = tmpIn.replace(/\\/g, "\\\\");
               const escapedOut = tmpOut.replace(/\\/g, "\\\\");
               execSync36(`${pyBin} -c "from PIL import Image; img = Image.open('${escapedIn}'); img.thumbnail((512, 512), Image.LANCZOS); img = img.convert('RGB'); img.save('${escapedOut}', 'JPEG', quality=75)"`, { timeout: 1e4, stdio: "pipe" });
-              const resizedBuf = readFileSync45(tmpOut);
+              const resizedBuf = readFileSync46(tmpOut);
               resizedBase64 = `data:image/jpeg;base64,${resizedBuf.toString("base64")}`;
               try {
                 unlinkSync13(tmpIn);
@@ -39557,26 +39557,26 @@ async function fetchOpenAIModels(baseUrl, apiKey) {
 async function fetchPeerModels(peerId, authKey) {
   try {
     const { NexusTool: NexusTool2 } = await Promise.resolve().then(() => (init_dist2(), dist_exports));
-    const { existsSync: existsSync57, readFileSync: readFileSync45 } = await import("node:fs");
-    const { join: join77 } = await import("node:path");
+    const { existsSync: existsSync58, readFileSync: readFileSync46 } = await import("node:fs");
+    const { join: join78 } = await import("node:path");
     const cwd4 = process.cwd();
     const nexusTool = new NexusTool2(cwd4);
     const nexusDir = nexusTool.getNexusDir();
     let isLocalPeer = false;
     try {
-      const statusPath = join77(nexusDir, "status.json");
-      if (existsSync57(statusPath)) {
-        const status = JSON.parse(readFileSync45(statusPath, "utf8"));
+      const statusPath = join78(nexusDir, "status.json");
+      if (existsSync58(statusPath)) {
+        const status = JSON.parse(readFileSync46(statusPath, "utf8"));
         if (status.peerId === peerId)
           isLocalPeer = true;
       }
     } catch {
     }
     if (isLocalPeer) {
-      const pricingPath = join77(nexusDir, "pricing.json");
-      if (existsSync57(pricingPath)) {
+      const pricingPath = join78(nexusDir, "pricing.json");
+      if (existsSync58(pricingPath)) {
         try {
-          const pricing = JSON.parse(readFileSync45(pricingPath, "utf8"));
+          const pricing = JSON.parse(readFileSync46(pricingPath, "utf8"));
           const localModels = (pricing.models || []).map((m) => ({
             name: m.model || "unknown",
             size: m.parameterSize || "",
@@ -39590,10 +39590,10 @@ async function fetchPeerModels(peerId, authKey) {
         }
       }
     }
-    const cachePath = join77(nexusDir, "peer-models-cache.json");
-    if (existsSync57(cachePath)) {
+    const cachePath = join78(nexusDir, "peer-models-cache.json");
+    if (existsSync58(cachePath)) {
       try {
-        const cache4 = JSON.parse(readFileSync45(cachePath, "utf8"));
+        const cache4 = JSON.parse(readFileSync46(cachePath, "utf8"));
         if (cache4.peerId === peerId && cache4.models?.length > 0) {
           const age = Date.now() - new Date(cache4.cachedAt).getTime();
           if (age < 5 * 60 * 1e3) {
@@ -39708,10 +39708,10 @@ async function fetchPeerModels(peerId, authKey) {
     } catch {
     }
     if (isLocalPeer) {
-      const pricingPath = join77(nexusDir, "pricing.json");
-      if (existsSync57(pricingPath)) {
+      const pricingPath = join78(nexusDir, "pricing.json");
+      if (existsSync58(pricingPath)) {
         try {
-          const pricing = JSON.parse(readFileSync45(pricingPath, "utf8"));
+          const pricing = JSON.parse(readFileSync46(pricingPath, "utf8"));
           return (pricing.models || []).map((m) => ({
             name: m.model || "unknown",
             size: m.parameterSize || "",
@@ -52121,12 +52121,12 @@ async function handleVoiceMenu(ctx, save, hasLocal) {
               continue;
             }
             const { basename: basename18, join: pathJoin } = await import("node:path");
-            const { copyFileSync: copyFileSync3, mkdirSync: mkdirSync31, existsSync: exists } = await import("node:fs");
+            const { copyFileSync: copyFileSync3, mkdirSync: mkdirSync32, existsSync: exists } = await import("node:fs");
             const { homedir: homedir21 } = await import("node:os");
             const modelName = basename18(onnxDrop.path, ".onnx").replace(/[^a-zA-Z0-9_-]/g, "-");
             const destDir = pathJoin(homedir21(), ".open-agents", "voice", "models", modelName);
             if (!exists(destDir))
-              mkdirSync31(destDir, { recursive: true });
+              mkdirSync32(destDir, { recursive: true });
             copyFileSync3(onnxDrop.path, pathJoin(destDir, "model.onnx"));
             copyFileSync3(jsonDrop.path, pathJoin(destDir, "config.json"));
             const { registerCustomOnnxModel: registerCustomOnnxModel2 } = await Promise.resolve().then(() => (init_voice(), voice_exports));
@@ -52965,10 +52965,10 @@ async function handlePeerEndpoint(peerId, authKey, ctx, local) {
     const models = await fetchModels(peerUrl, authKey);
     if (models.length > 0) {
       try {
-        const { writeFileSync: writeFileSync30, mkdirSync: mkdirSync31 } = await import("node:fs");
-        const { join: join77, dirname: dirname24 } = await import("node:path");
-        const cachePath = join77(ctx.repoRoot || process.cwd(), ".oa", "nexus", "peer-models-cache.json");
-        mkdirSync31(dirname24(cachePath), { recursive: true });
+        const { writeFileSync: writeFileSync30, mkdirSync: mkdirSync32 } = await import("node:fs");
+        const { join: join78, dirname: dirname24 } = await import("node:path");
+        const cachePath = join78(ctx.repoRoot || process.cwd(), ".oa", "nexus", "peer-models-cache.json");
+        mkdirSync32(dirname24(cachePath), { recursive: true });
         writeFileSync30(cachePath, JSON.stringify({
           peerId,
           cachedAt: (/* @__PURE__ */ new Date()).toISOString(),
@@ -53168,17 +53168,17 @@ async function handleUpdate(subcommand, ctx) {
   try {
     const { createRequire: createRequire6 } = await import("node:module");
     const { fileURLToPath: fileURLToPath16 } = await import("node:url");
-    const { dirname: dirname24, join: join77 } = await import("node:path");
-    const { existsSync: existsSync57 } = await import("node:fs");
+    const { dirname: dirname24, join: join78 } = await import("node:path");
+    const { existsSync: existsSync58 } = await import("node:fs");
     const req = createRequire6(import.meta.url);
     const thisDir = dirname24(fileURLToPath16(import.meta.url));
     const candidates = [
-      join77(thisDir, "..", "package.json"),
-      join77(thisDir, "..", "..", "package.json"),
-      join77(thisDir, "..", "..", "..", "package.json")
+      join78(thisDir, "..", "package.json"),
+      join78(thisDir, "..", "..", "package.json"),
+      join78(thisDir, "..", "..", "..", "package.json")
     ];
     for (const pkgPath of candidates) {
-      if (existsSync57(pkgPath)) {
+      if (existsSync58(pkgPath)) {
         const pkg = req(pkgPath);
         if (pkg.name === "open-agents-ai" || pkg.name === "@open-agents/cli") {
           currentVersion = pkg.version ?? "0.0.0";
@@ -65238,25 +65238,561 @@ var init_direct_input = __esm({
   }
 });
 
-// packages/cli/dist/api/profiles.js
-import { existsSync as existsSync52, readFileSync as readFileSync41, writeFileSync as writeFileSync25, mkdirSync as mkdirSync26, readdirSync as readdirSync20, unlinkSync as unlinkSync12 } from "node:fs";
+// packages/cli/dist/api/audit-log.js
+import { mkdirSync as mkdirSync26, appendFileSync as appendFileSync4, readFileSync as readFileSync41, existsSync as existsSync52 } from "node:fs";
 import { join as join69 } from "node:path";
+function initAuditLog(oaDir) {
+  auditDir = join69(oaDir, "audit");
+  auditFile = join69(auditDir, "audit.jsonl");
+  try {
+    mkdirSync26(auditDir, { recursive: true });
+    initialized = true;
+  } catch {
+  }
+}
+function recordAudit(record) {
+  if (!initialized)
+    return;
+  try {
+    const line = JSON.stringify(record) + "\n";
+    appendFileSync4(auditFile, line, "utf-8");
+  } catch {
+  }
+}
+function queryAudit(opts) {
+  if (!initialized || !existsSync52(auditFile))
+    return [];
+  try {
+    const raw = readFileSync41(auditFile, "utf-8");
+    const lines = raw.split("\n").filter(Boolean);
+    let records = lines.map((l) => {
+      try {
+        return JSON.parse(l);
+      } catch {
+        return null;
+      }
+    }).filter(Boolean);
+    if (opts.since) {
+      const sinceTs = new Date(opts.since).getTime();
+      records = records.filter((r) => new Date(r.ts).getTime() >= sinceTs);
+    }
+    if (opts.user) {
+      records = records.filter((r) => r.user === opts.user);
+    }
+    records.reverse();
+    if (opts.limit && opts.limit > 0) {
+      records = records.slice(0, opts.limit);
+    }
+    return records;
+  } catch {
+    return [];
+  }
+}
+var auditDir, auditFile, initialized;
+var init_audit_log = __esm({
+  "packages/cli/dist/api/audit-log.js"() {
+    "use strict";
+    auditDir = "";
+    auditFile = "";
+    initialized = false;
+  }
+});
+
+// packages/cli/dist/api/web-ui.js
+function getWebUI() {
+  return `<!DOCTYPE html>
+<html lang="en">
+<head>
+<meta charset="UTF-8">
+<meta name="viewport" content="width=device-width, initial-scale=1.0">
+<title>Open Agents</title>
+<style>
+* { margin: 0; padding: 0; box-sizing: border-box; }
+body {
+  font-family: 'SF Mono', 'Cascadia Code', 'Fira Code', monospace;
+  background: #1a1a1e;
+  color: #b0b0b0;
+  display: flex;
+  flex-direction: column;
+  height: 100vh;
+  overflow: hidden;
+}
+#header {
+  display: flex;
+  align-items: center;
+  gap: 12px;
+  padding: 8px 16px;
+  background: #1e1e22;
+  border-bottom: 1px solid #2a2a30;
+  flex-shrink: 0;
+}
+#header .accent { color: #b2920a; font-weight: bold; font-size: 0.8rem; }
+#header .status { font-size: 0.7rem; color: #555; }
+#header .status.live { color: #b2920a; }
+#header select {
+  background: #2a2a30;
+  border: 1px solid #3a3a42;
+  color: #b0b0b0;
+  padding: 4px 8px;
+  border-radius: 3px;
+  font-family: inherit;
+  font-size: 0.7rem;
+  margin-left: auto;
+}
+#header .key-btn {
+  background: #2a2a30;
+  border: 1px solid #3a3a42;
+  color: #b2920a;
+  padding: 4px 10px;
+  border-radius: 3px;
+  font-family: inherit;
+  font-size: 0.7rem;
+  cursor: pointer;
+  transition: background 0.15s;
+}
+#header .key-btn:hover { background: #3a3a42; }
+#conversation {
+  flex: 1;
+  overflow-y: auto;
+  padding: 12px 16px;
+  display: flex;
+  flex-direction: column;
+  gap: 4px;
+}
+.msg { padding: 6px 0; font-size: 0.82rem; line-height: 1.5; white-space: pre-wrap; word-break: break-word; }
+.msg.user { color: #888; }
+.msg.user::before { content: '\\25B8 '; color: #555; }
+.msg.assistant { color: #b2920a; }
+.msg.assistant::before { content: '\\25B9 '; color: #b2920a; }
+.msg.system { color: #555; font-size: 0.7rem; }
+.msg code {
+  background: #2a2a30;
+  padding: 1px 4px;
+  border-radius: 2px;
+  font-size: 0.78rem;
+}
+.msg pre {
+  background: #1e1e22;
+  border: 1px solid #2a2a30;
+  border-radius: 3px;
+  padding: 8px 12px;
+  margin: 6px 0;
+  overflow-x: auto;
+  font-size: 0.78rem;
+  line-height: 1.4;
+  position: relative;
+}
+.msg pre .copy-btn {
+  position: absolute;
+  top: 4px;
+  right: 4px;
+  background: #2a2a30;
+  border: 1px solid #3a3a42;
+  color: #b2920a;
+  padding: 2px 8px;
+  border-radius: 2px;
+  font-family: inherit;
+  font-size: 0.6rem;
+  cursor: pointer;
+  opacity: 0.5;
+  transition: opacity 0.15s;
+}
+.msg pre:hover .copy-btn { opacity: 1; }
+.msg-actions {
+  display: flex;
+  gap: 8px;
+  margin-top: 2px;
+}
+.msg-actions button {
+  background: none;
+  border: none;
+  color: #555;
+  font-family: inherit;
+  font-size: 0.6rem;
+  cursor: pointer;
+  padding: 0;
+}
+.msg-actions button:hover { color: #b2920a; }
+#footer {
+  display: flex;
+  align-items: flex-end;
+  gap: 10px;
+  padding: 8px 16px;
+  background: #1e1e22;
+  border-top: 1px solid #2a2a30;
+  flex-shrink: 0;
+}
+#input-area {
+  flex: 1;
+  background: #2a2a30;
+  border: 1px solid #3a3a42;
+  border-radius: 3px;
+  padding: 8px 12px;
+  color: #b0b0b0;
+  font-family: inherit;
+  font-size: 0.82rem;
+  resize: none;
+  min-height: 36px;
+  max-height: 120px;
+  line-height: 1.4;
+  outline: none;
+}
+#input-area:focus { border-color: #b2920a; }
+#send-btn {
+  background: #2a2a30;
+  border: 1px solid #3a3a42;
+  color: #b2920a;
+  padding: 8px 16px;
+  border-radius: 3px;
+  font-family: inherit;
+  font-size: 0.75rem;
+  cursor: pointer;
+  transition: background 0.15s;
+  flex-shrink: 0;
+}
+#send-btn:hover { background: #3a3a42; }
+#send-btn:disabled { opacity: 0.3; cursor: default; }
+#system-prompt-toggle {
+  font-size: 0.65rem;
+  color: #444;
+  cursor: pointer;
+  padding: 4px 0;
+}
+#system-prompt-toggle:hover { color: #b2920a; }
+#system-prompt-area {
+  display: none;
+  padding: 0 16px 8px;
+  background: #1e1e22;
+}
+#system-prompt-area textarea {
+  width: 100%;
+  background: #2a2a30;
+  border: 1px solid #3a3a42;
+  border-radius: 3px;
+  padding: 6px 10px;
+  color: #b0b0b0;
+  font-family: inherit;
+  font-size: 0.7rem;
+  resize: vertical;
+  min-height: 48px;
+  outline: none;
+}
+#key-modal {
+  display: none;
+  position: fixed;
+  top: 0; left: 0; right: 0; bottom: 0;
+  background: rgba(0,0,0,0.7);
+  z-index: 100;
+  align-items: center;
+  justify-content: center;
+}
+#key-modal.visible { display: flex; }
+#key-modal .modal {
+  background: #1e1e22;
+  border: 1px solid #2a2a30;
+  border-radius: 6px;
+  padding: 20px;
+  width: 360px;
+  max-width: 90vw;
+}
+#key-modal .modal h3 { color: #b2920a; font-size: 0.8rem; margin-bottom: 12px; }
+#key-modal .modal input {
+  width: 100%;
+  background: #2a2a30;
+  border: 1px solid #3a3a42;
+  border-radius: 3px;
+  padding: 8px 10px;
+  color: #b0b0b0;
+  font-family: inherit;
+  font-size: 0.75rem;
+  outline: none;
+  margin-bottom: 12px;
+}
+#key-modal .modal button {
+  background: #2a2a30;
+  border: 1px solid #b2920a;
+  color: #b2920a;
+  padding: 6px 16px;
+  border-radius: 3px;
+  font-family: inherit;
+  font-size: 0.75rem;
+  cursor: pointer;
+  margin-right: 8px;
+}
+</style>
+</head>
+<body>
+
+<div id="header">
+  <span class="accent">OA</span>
+  <span class="status" id="status">connecting...</span>
+  <select id="model-select"><option>loading...</option></select>
+  <button class="key-btn" id="key-btn" title="Set API key">key</button>
+</div>
+
+<div id="system-prompt-area">
+  <textarea id="system-prompt" placeholder="System prompt (optional)"></textarea>
+</div>
+
+<div id="conversation"></div>
+
+<div id="footer">
+  <span id="system-prompt-toggle" onclick="toggleSystemPrompt()">sys</span>
+  <textarea id="input-area" placeholder="Type a message..." rows="1"></textarea>
+  <button id="send-btn" onclick="sendMessage()">send</button>
+</div>
+
+<div id="key-modal">
+  <div class="modal">
+    <h3>API Key</h3>
+    <input id="key-input" type="password" placeholder="Bearer token (leave empty if auth disabled)">
+    <div>
+      <button onclick="saveKey()">save</button>
+      <button onclick="clearKey()">clear</button>
+      <button onclick="closeKeyModal()">cancel</button>
+    </div>
+  </div>
+</div>
+
+<script>
+const conv = document.getElementById('conversation');
+const input = document.getElementById('input-area');
+const sendBtn = document.getElementById('send-btn');
+const modelSelect = document.getElementById('model-select');
+const statusEl = document.getElementById('status');
+let apiKey = localStorage.getItem('oa-api-key') || '';
+let streaming = false;
+let messages = [];
+
+// Auto-resize textarea
+input.addEventListener('input', () => {
+  input.style.height = 'auto';
+  input.style.height = Math.min(input.scrollHeight, 120) + 'px';
+});
+input.addEventListener('keydown', (e) => {
+  if (e.key === 'Enter' && !e.shiftKey) { e.preventDefault(); sendMessage(); }
+});
+
+function headers() {
+  const h = { 'Content-Type': 'application/json' };
+  if (apiKey) h['Authorization'] = 'Bearer ' + apiKey;
+  return h;
+}
+
+// Health check
+async function checkHealth() {
+  try {
+    const r = await fetch('/health');
+    const d = await r.json();
+    statusEl.textContent = 'connected (' + d.version + ')';
+    statusEl.className = 'status live';
+  } catch {
+    statusEl.textContent = 'disconnected';
+    statusEl.className = 'status';
+  }
+}
+
+// Load models
+async function loadModels() {
+  try {
+    const r = await fetch('/v1/models', { headers: headers() });
+    const d = await r.json();
+    modelSelect.innerHTML = '';
+    for (const m of (d.data || [])) {
+      const opt = document.createElement('option');
+      // Strip "local/" prefix for cleaner display
+      opt.value = m.id.replace(/^local\\//, '');
+      opt.textContent = m.id.replace(/^local\\//, '');
+      modelSelect.appendChild(opt);
+    }
+    // Default to first model with "9b" in name, or first overall
+    const preferred = Array.from(modelSelect.options).find(o => /9b/i.test(o.value));
+    if (preferred) modelSelect.value = preferred.value;
+  } catch { modelSelect.innerHTML = '<option>error loading models</option>'; }
+}
+
+function addMessage(role, content) {
+  const div = document.createElement('div');
+  div.className = 'msg ' + role;
+  div.innerHTML = renderMarkdown(content);
+  // Copy button
+  if (role === 'assistant') {
+    const actions = document.createElement('div');
+    actions.className = 'msg-actions';
+    const copyBtn = document.createElement('button');
+    copyBtn.textContent = 'copy';
+    copyBtn.onclick = () => { navigator.clipboard.writeText(content); copyBtn.textContent = 'copied'; setTimeout(() => copyBtn.textContent = 'copy', 1500); };
+    actions.appendChild(copyBtn);
+    div.appendChild(actions);
+  }
+  conv.appendChild(div);
+  conv.scrollTop = conv.scrollHeight;
+  return div;
+}
+
+function renderMarkdown(text) {
+  // Code blocks
+  text = text.replace(/\`\`\`(\\w*)\\n([\\s\\S]*?)\`\`\`/g, (_, lang, code) => {
+    const id = 'cb' + Math.random().toString(36).slice(2,8);
+    return '<pre><button class="copy-btn" onclick="navigator.clipboard.writeText(document.getElementById(\\'' + id + '\\').textContent);this.textContent=\\'copied\\';setTimeout(()=>this.textContent=\\'copy\\',1500)">copy</button><code id="' + id + '">' + escHtml(code) + '</code></pre>';
+  });
+  // Inline code
+  text = text.replace(/\`([^\`]+)\`/g, '<code>$1</code>');
+  // Bold
+  text = text.replace(/\\*\\*(.+?)\\*\\*/g, '<strong>$1</strong>');
+  return text;
+}
+
+function escHtml(s) {
+  return s.replace(/&/g,'&amp;').replace(/</g,'&lt;').replace(/>/g,'&gt;');
+}
+
+async function sendMessage() {
+  const text = input.value.trim();
+  if (!text || streaming) return;
+  input.value = '';
+  input.style.height = 'auto';
+
+  // Add user message
+  messages.push({ role: 'user', content: text });
+  addMessage('user', text);
+
+  // System prompt
+  const sysPrompt = document.getElementById('system-prompt').value.trim();
+
+  streaming = true;
+  sendBtn.disabled = true;
+  sendBtn.textContent = '...';
+
+  const msgDiv = addMessage('assistant', '');
+  let fullContent = '';
+
+  try {
+    const body = {
+      model: modelSelect.value,
+      messages: [
+        ...(sysPrompt ? [{ role: 'system', content: sysPrompt }] : []),
+        ...messages,
+      ],
+      stream: true,
+      max_tokens: 4096,
+    };
+
+    const response = await fetch('/v1/chat/completions', {
+      method: 'POST',
+      headers: headers(),
+      body: JSON.stringify(body),
+    });
+
+    const reader = response.body.getReader();
+    const decoder = new TextDecoder();
+    let buffer = '';
+
+    while (true) {
+      const { done, value } = await reader.read();
+      if (done) break;
+      buffer += decoder.decode(value, { stream: true });
+
+      const lines = buffer.split('\\n');
+      buffer = lines.pop() || '';
+
+      for (const line of lines) {
+        if (!line.startsWith('data: ')) continue;
+        const data = line.slice(6);
+        if (data === '[DONE]') continue;
+        try {
+          const chunk = JSON.parse(data);
+          const delta = chunk.choices?.[0]?.delta?.content || '';
+          if (delta) {
+            fullContent += delta;
+            msgDiv.innerHTML = renderMarkdown(fullContent);
+            conv.scrollTop = conv.scrollHeight;
+          }
+        } catch {}
+      }
+    }
+
+    messages.push({ role: 'assistant', content: fullContent });
+    // Re-render with copy button
+    msgDiv.innerHTML = renderMarkdown(fullContent);
+    const actions = document.createElement('div');
+    actions.className = 'msg-actions';
+    const copyBtn = document.createElement('button');
+    copyBtn.textContent = 'copy';
+    copyBtn.onclick = () => { navigator.clipboard.writeText(fullContent); copyBtn.textContent = 'copied'; setTimeout(() => copyBtn.textContent = 'copy', 1500); };
+    actions.appendChild(copyBtn);
+    msgDiv.appendChild(actions);
+  } catch (err) {
+    msgDiv.innerHTML = '<span style="color:#ff4444">Error: ' + escHtml(err.message) + '</span>';
+  }
+
+  streaming = false;
+  sendBtn.disabled = false;
+  sendBtn.textContent = 'send';
+  conv.scrollTop = conv.scrollHeight;
+}
+
+function toggleSystemPrompt() {
+  const area = document.getElementById('system-prompt-area');
+  area.style.display = area.style.display === 'none' ? 'block' : 'none';
+}
+
+// Key modal
+document.getElementById('key-btn').onclick = () => {
+  document.getElementById('key-modal').classList.add('visible');
+  document.getElementById('key-input').value = apiKey;
+};
+function saveKey() {
+  apiKey = document.getElementById('key-input').value;
+  localStorage.setItem('oa-api-key', apiKey);
+  closeKeyModal();
+  loadModels();
+}
+function clearKey() {
+  apiKey = '';
+  localStorage.removeItem('oa-api-key');
+  document.getElementById('key-input').value = '';
+  closeKeyModal();
+  loadModels();
+}
+function closeKeyModal() {
+  document.getElementById('key-modal').classList.remove('visible');
+}
+
+// Init
+checkHealth();
+loadModels();
+setInterval(checkHealth, 30000);
+input.focus();
+</script>
+</body>
+</html>`;
+}
+var init_web_ui = __esm({
+  "packages/cli/dist/api/web-ui.js"() {
+    "use strict";
+  }
+});
+
+// packages/cli/dist/api/profiles.js
+import { existsSync as existsSync53, readFileSync as readFileSync42, writeFileSync as writeFileSync25, mkdirSync as mkdirSync27, readdirSync as readdirSync20, unlinkSync as unlinkSync12 } from "node:fs";
+import { join as join70 } from "node:path";
 import { homedir as homedir18 } from "node:os";
 import { createCipheriv as createCipheriv3, createDecipheriv as createDecipheriv3, randomBytes as randomBytes15, scryptSync as scryptSync3, createHash as createHash5 } from "node:crypto";
 function globalProfileDir() {
-  return join69(homedir18(), ".open-agents", "profiles");
+  return join70(homedir18(), ".open-agents", "profiles");
 }
 function projectProfileDir(projectDir) {
-  return join69(projectDir || process.cwd(), ".oa", "profiles");
+  return join70(projectDir || process.cwd(), ".oa", "profiles");
 }
 function listProfiles(projectDir) {
   const result = [];
   const seen = /* @__PURE__ */ new Set();
   const projDir = projectProfileDir(projectDir);
-  if (existsSync52(projDir)) {
+  if (existsSync53(projDir)) {
     for (const f of readdirSync20(projDir).filter((f2) => f2.endsWith(".json"))) {
       try {
-        const raw = JSON.parse(readFileSync41(join69(projDir, f), "utf8"));
+        const raw = JSON.parse(readFileSync42(join70(projDir, f), "utf8"));
         const name = f.replace(".json", "");
         seen.add(name);
         result.push({
@@ -65270,13 +65806,13 @@ function listProfiles(projectDir) {
     }
   }
   const globDir = globalProfileDir();
-  if (existsSync52(globDir)) {
+  if (existsSync53(globDir)) {
     for (const f of readdirSync20(globDir).filter((f2) => f2.endsWith(".json"))) {
       const name = f.replace(".json", "");
       if (seen.has(name))
         continue;
       try {
-        const raw = JSON.parse(readFileSync41(join69(globDir, f), "utf8"));
+        const raw = JSON.parse(readFileSync42(join70(globDir, f), "utf8"));
         result.push({
           name,
           description: raw.description || "",
@@ -65291,12 +65827,12 @@ function listProfiles(projectDir) {
 }
 function loadProfile(name, password, projectDir) {
   const sanitized = name.replace(/[^a-zA-Z0-9_-]/g, "");
-  const projPath = join69(projectProfileDir(projectDir), `${sanitized}.json`);
-  const globPath = join69(globalProfileDir(), `${sanitized}.json`);
-  const filePath = existsSync52(projPath) ? projPath : existsSync52(globPath) ? globPath : null;
+  const projPath = join70(projectProfileDir(projectDir), `${sanitized}.json`);
+  const globPath = join70(globalProfileDir(), `${sanitized}.json`);
+  const filePath = existsSync53(projPath) ? projPath : existsSync53(globPath) ? globPath : null;
   if (!filePath)
     return null;
-  const raw = JSON.parse(readFileSync41(filePath, "utf8"));
+  const raw = JSON.parse(readFileSync42(filePath, "utf8"));
   if (raw.encrypted === true) {
     if (!password)
       return null;
@@ -65306,9 +65842,9 @@ function loadProfile(name, password, projectDir) {
 }
 function saveProfile(profile, password, scope = "global", projectDir) {
   const dir = scope === "project" ? projectProfileDir(projectDir) : globalProfileDir();
-  mkdirSync26(dir, { recursive: true });
+  mkdirSync27(dir, { recursive: true });
   const sanitized = profile.name.replace(/[^a-zA-Z0-9_-]/g, "");
-  const filePath = join69(dir, `${sanitized}.json`);
+  const filePath = join70(dir, `${sanitized}.json`);
   profile.modified = (/* @__PURE__ */ new Date()).toISOString();
   if (password) {
     const encrypted = encryptProfile(profile, password);
@@ -65321,8 +65857,8 @@ function saveProfile(profile, password, scope = "global", projectDir) {
 function deleteProfile(name, scope = "global", projectDir) {
   const sanitized = name.replace(/[^a-zA-Z0-9_-]/g, "");
   const dir = scope === "project" ? projectProfileDir(projectDir) : globalProfileDir();
-  const filePath = join69(dir, `${sanitized}.json`);
-  if (existsSync52(filePath)) {
+  const filePath = join70(dir, `${sanitized}.json`);
+  if (existsSync53(filePath)) {
     unlinkSync12(filePath);
     return true;
   }
@@ -65415,22 +65951,22 @@ import * as http from "node:http";
 import * as https from "node:https";
 import { createRequire as createRequire3 } from "node:module";
 import { fileURLToPath as fileURLToPath13 } from "node:url";
-import { dirname as dirname21, join as join70, resolve as resolve31 } from "node:path";
+import { dirname as dirname21, join as join71, resolve as resolve31 } from "node:path";
 import { spawn as spawn21 } from "node:child_process";
-import { mkdirSync as mkdirSync27, writeFileSync as writeFileSync26, readFileSync as readFileSync42, readdirSync as readdirSync21, existsSync as existsSync53 } from "node:fs";
-import { randomBytes as randomBytes16 } from "node:crypto";
+import { mkdirSync as mkdirSync28, writeFileSync as writeFileSync26, readFileSync as readFileSync43, readdirSync as readdirSync21, existsSync as existsSync54 } from "node:fs";
+import { randomBytes as randomBytes16, randomUUID as randomUUID4 } from "node:crypto";
 function getVersion3() {
   try {
     const require2 = createRequire3(import.meta.url);
     const thisDir = dirname21(fileURLToPath13(import.meta.url));
     const candidates = [
-      join70(thisDir, "..", "package.json"),
-      join70(thisDir, "..", "..", "package.json"),
-      join70(thisDir, "..", "..", "..", "package.json")
+      join71(thisDir, "..", "package.json"),
+      join71(thisDir, "..", "..", "package.json"),
+      join71(thisDir, "..", "..", "..", "package.json")
     ];
     for (const pkgPath of candidates) {
       try {
-        if (!existsSync53(pkgPath))
+        if (!existsSync54(pkgPath))
           continue;
         const pkg = require2(pkgPath);
         if (pkg.name === "open-agents-ai" || pkg.name === "@open-agents/cli" || pkg.name === "@open-agents/monorepo") {
@@ -65613,27 +66149,33 @@ function formatMetrics() {
 }
 function jsonResponse(res, status, body) {
   const payload = JSON.stringify(body);
-  res.writeHead(status, {
-    "Content-Type": "application/json",
-    "Access-Control-Allow-Origin": "*",
-    "Access-Control-Allow-Methods": "GET, POST, PUT, PATCH, DELETE, OPTIONS",
-    "Access-Control-Allow-Headers": "Content-Type, Authorization"
-  });
+  res.writeHead(status, { "Content-Type": "application/json" });
   res.end(payload);
 }
 function textResponse(res, status, body, contentType = "text/plain") {
-  res.writeHead(status, {
-    "Content-Type": contentType,
-    "Access-Control-Allow-Origin": "*",
-    "Access-Control-Allow-Methods": "GET, POST, PUT, PATCH, DELETE, OPTIONS",
-    "Access-Control-Allow-Headers": "Content-Type, Authorization"
-  });
+  res.writeHead(status, { "Content-Type": contentType });
   res.end(body);
 }
-function corsHeaders(res) {
-  res.setHeader("Access-Control-Allow-Origin", "*");
+function isOriginAllowed(origin) {
+  if (!origin)
+    return true;
+  if (_corsOrigins.includes("*"))
+    return true;
+  if (_corsLocalOnly)
+    return /^https?:\/\/(localhost|127\.0\.0\.1)(:\d+)?$/.test(origin);
+  return _corsOrigins.some((p) => origin === p || p.includes("*") && new RegExp("^" + p.replace(/\*/g, ".*") + "$").test(origin));
+}
+function corsHeaders(req, res) {
+  const origin = req.headers["origin"];
+  if (!isOriginAllowed(origin)) {
+    res.writeHead(403, { "Content-Type": "application/json" });
+    res.end(JSON.stringify({ error: "Forbidden", message: `Origin '${origin}' not allowed. Set OA_CORS_ORIGINS to allow.` }));
+    return false;
+  }
+  res.setHeader("Access-Control-Allow-Origin", origin || "*");
   res.setHeader("Access-Control-Allow-Methods", "GET, POST, PUT, PATCH, DELETE, OPTIONS");
-  res.setHeader("Access-Control-Allow-Headers", "Content-Type, Authorization");
+  res.setHeader("Access-Control-Allow-Headers", "Content-Type, Authorization, X-Request-ID, X-Working-Directory, X-Tool-Profile, X-Profile-Password");
+  return true;
 }
 function readBody(req) {
   return new Promise((resolve36, reject) => {
@@ -65725,29 +66267,29 @@ function ollamaStream(ollamaUrl, path, method, body, onData, onEnd, onError) {
 }
 function jobsDir() {
   const root = resolve31(process.cwd());
-  const dir = join70(root, ".oa", "jobs");
-  mkdirSync27(dir, { recursive: true });
+  const dir = join71(root, ".oa", "jobs");
+  mkdirSync28(dir, { recursive: true });
   return dir;
 }
 function loadJob(id) {
-  const file = join70(jobsDir(), `${id}.json`);
-  if (!existsSync53(file))
+  const file = join71(jobsDir(), `${id}.json`);
+  if (!existsSync54(file))
     return null;
   try {
-    return JSON.parse(readFileSync42(file, "utf-8"));
+    return JSON.parse(readFileSync43(file, "utf-8"));
   } catch {
     return null;
   }
 }
 function listJobs() {
   const dir = jobsDir();
-  if (!existsSync53(dir))
+  if (!existsSync54(dir))
     return [];
   const files = readdirSync21(dir).filter((f) => f.endsWith(".json")).sort();
   const jobs = [];
   for (const file of files) {
     try {
-      jobs.push(JSON.parse(readFileSync42(join70(dir, file), "utf-8")));
+      jobs.push(JSON.parse(readFileSync43(join71(dir, file), "utf-8")));
     } catch {
     }
   }
@@ -65874,10 +66416,7 @@ async function handleV1ChatCompletions(req, res, ollamaUrl) {
       res.writeHead(200, {
         "Content-Type": "text/event-stream",
         "Cache-Control": "no-cache",
-        "Connection": "keep-alive",
-        "Access-Control-Allow-Origin": "*",
-        "Access-Control-Allow-Methods": "GET, POST, PUT, PATCH, DELETE, OPTIONS",
-        "Access-Control-Allow-Headers": "Content-Type, Authorization"
+        "Connection": "keep-alive"
       });
       ollamaStream(targetUrl, "/v1/chat/completions", "POST", payload, (chunk) => {
         res.write(chunk);
@@ -65923,10 +66462,7 @@ async function handleV1ChatCompletions(req, res, ollamaUrl) {
     res.writeHead(200, {
       "Content-Type": "text/event-stream",
       "Cache-Control": "no-cache",
-      "Connection": "keep-alive",
-      "Access-Control-Allow-Origin": "*",
-      "Access-Control-Allow-Methods": "GET, POST, PUT, PATCH, DELETE, OPTIONS",
-      "Access-Control-Allow-Headers": "Content-Type, Authorization"
+      "Connection": "keep-alive"
     });
     const chatId = `chatcmpl-${randomBytes16(12).toString("hex")}`;
     let buffer = "";
@@ -66140,8 +66676,8 @@ async function handleV1Run(req, res) {
   if (workingDir) {
     cwd4 = resolve31(workingDir);
   } else if (isolate) {
-    const wsDir = join70(dir, "..", "workspaces", id);
-    mkdirSync27(wsDir, { recursive: true });
+    const wsDir = join71(dir, "..", "workspaces", id);
+    mkdirSync28(wsDir, { recursive: true });
     cwd4 = wsDir;
   } else {
     cwd4 = resolve31(process.cwd());
@@ -66213,16 +66749,13 @@ async function handleV1Run(req, res) {
   });
   child.unref();
   job.pid = child.pid ?? 0;
-  writeFileSync26(join70(dir, `${id}.json`), JSON.stringify(job, null, 2));
+  writeFileSync26(join71(dir, `${id}.json`), JSON.stringify(job, null, 2));
   runningProcesses.set(id, child);
   if (streamMode) {
     res.writeHead(200, {
       "Content-Type": "text/event-stream",
       "Cache-Control": "no-cache",
-      "Connection": "keep-alive",
-      "Access-Control-Allow-Origin": "*",
-      "Access-Control-Allow-Methods": "GET, POST, PUT, PATCH, DELETE, OPTIONS",
-      "Access-Control-Allow-Headers": "Content-Type, Authorization"
+      "Connection": "keep-alive"
     });
     res.write(`data: ${JSON.stringify({ type: "run_started", run_id: id, pid: job.pid })}
 
@@ -66243,7 +66776,7 @@ async function handleV1Run(req, res) {
       job.status = code === 0 ? "completed" : "failed";
       job.completedAt = (/* @__PURE__ */ new Date()).toISOString();
       try {
-        writeFileSync26(join70(dir, `${id}.json`), JSON.stringify(job, null, 2));
+        writeFileSync26(join71(dir, `${id}.json`), JSON.stringify(job, null, 2));
       } catch {
       }
       runningProcesses.delete(id);
@@ -66274,7 +66807,7 @@ async function handleV1Run(req, res) {
         job.completedAt = (/* @__PURE__ */ new Date()).toISOString();
       }
       try {
-        writeFileSync26(join70(dir, `${id}.json`), JSON.stringify(job, null, 2));
+        writeFileSync26(join71(dir, `${id}.json`), JSON.stringify(job, null, 2));
       } catch {
       }
       runningProcesses.delete(id);
@@ -66315,7 +66848,7 @@ function handleV1RunsDelete(res, id) {
     job.error = "Aborted via API";
     const dir = jobsDir();
     try {
-      writeFileSync26(join70(dir, `${id}.json`), JSON.stringify(job, null, 2));
+      writeFileSync26(join71(dir, `${id}.json`), JSON.stringify(job, null, 2));
     } catch {
     }
     runningProcesses.delete(id);
@@ -66459,17 +66992,23 @@ async function handleRequest(req, res, ollamaUrl, verbose) {
   const method = req.method ?? "GET";
   const urlObj = new URL(req.url ?? "/", `http://${req.headers.host ?? "localhost"}`);
   const pathname = urlObj.pathname;
+  const startMs = performance.now();
+  const requestId = req.headers["x-request-id"] || randomUUID4();
+  res.setHeader("X-Request-ID", requestId);
   if (verbose) {
     const ts = (/* @__PURE__ */ new Date()).toISOString().split("T")[1]?.slice(0, 8) ?? "";
-    process.stderr.write(`[${ts}] ${method} ${pathname}
+    process.stderr.write(`[${ts}] ${requestId.slice(0, 8)} ${method} ${pathname}
 `);
   }
   if (method === "OPTIONS") {
-    corsHeaders(res);
+    if (!corsHeaders(req, res))
+      return;
     res.writeHead(204);
     res.end();
     return;
   }
+  if (!corsHeaders(req, res))
+    return;
   let status = 200;
   try {
     if (pathname === "/health" && method === "GET") {
@@ -66492,6 +67031,11 @@ async function handleRequest(req, res, ollamaUrl, verbose) {
       handleMetrics(res);
       return;
     }
+    if (pathname === "/" && method === "GET" && req.headers.accept?.includes("text/html")) {
+      res.writeHead(200, { "Content-Type": "text/html; charset=utf-8" });
+      res.end(getWebUI());
+      return;
+    }
     if (pathname.startsWith("/v1/")) {
       const isWrite = method === "POST" || method === "PUT" || method === "PATCH" || method === "DELETE";
       const isRun = pathname === "/v1/run" || pathname.startsWith("/v1/runs");
@@ -66650,6 +67194,15 @@ async function handleRequest(req, res, ollamaUrl, verbose) {
       jsonResponse(res, deleted ? 200 : 404, deleted ? { status: "deleted", name } : { error: "Profile not found", name });
       return;
     }
+    if (pathname === "/v1/audit" && method === "GET") {
+      if (!checkAuth(req, res, "read"))
+        return;
+      const since = urlObj.searchParams.get("since") ?? void 0;
+      const user = urlObj.searchParams.get("user") ?? void 0;
+      const limit = parseInt(urlObj.searchParams.get("limit") ?? "100", 10);
+      jsonResponse(res, 200, { records: queryAudit({ since, user, limit }) });
+      return;
+    }
     status = 404;
     jsonResponse(res, 404, { error: "Not found", path: pathname });
   } catch (err) {
@@ -66661,6 +67214,17 @@ async function handleRequest(req, res, ollamaUrl, verbose) {
     });
   } finally {
     recordMetric(method, pathname, status);
+    recordAudit({
+      ts: (/* @__PURE__ */ new Date()).toISOString(),
+      requestId,
+      method,
+      path: pathname,
+      status,
+      user: req._authUser ?? "anonymous",
+      scope: req._authScope ?? "none",
+      latencyMs: Math.round(performance.now() - startMs),
+      ip: req.socket?.remoteAddress ?? ""
+    });
   }
 }
 function startApiServer(options = {}) {
@@ -66687,6 +67251,8 @@ function startApiServer(options = {}) {
   const verbose = options.verbose ?? false;
   const config = loadConfig();
   const ollamaUrl = options.ollamaUrl ?? config.backendUrl;
+  const cwd4 = process.cwd();
+  initAuditLog(join71(cwd4, ".oa"));
   const server = http.createServer((req, res) => {
     handleRequest(req, res, ollamaUrl, verbose).catch((err) => {
       metrics.totalErrors++;
@@ -66816,11 +67382,13 @@ async function apiServeCommand(opts, config) {
     server.on("close", resolve36);
   });
 }
-var endpointRegistry, modelRouteMap, endpointUsage, metrics, startedAt, runningProcesses;
+var endpointRegistry, modelRouteMap, endpointUsage, metrics, startedAt, _corsOrigins, _corsLocalOnly, runningProcesses;
 var init_serve = __esm({
   "packages/cli/dist/api/serve.js"() {
     "use strict";
     init_config();
+    init_audit_log();
+    init_web_ui();
     init_oa_directory();
     init_render();
     init_profiles();
@@ -66834,17 +67402,19 @@ var init_serve = __esm({
       totalErrors: 0
     };
     startedAt = Date.now();
+    _corsOrigins = (process.env["OA_CORS_ORIGINS"] || "").split(",").filter(Boolean);
+    _corsLocalOnly = _corsOrigins.length === 0;
     runningProcesses = /* @__PURE__ */ new Map();
   }
 });
 
 // packages/cli/dist/tui/interactive.js
 import { cwd } from "node:process";
-import { resolve as resolve32, join as join71, dirname as dirname22, extname as extname11 } from "node:path";
+import { resolve as resolve32, join as join72, dirname as dirname22, extname as extname11 } from "node:path";
 import { createRequire as createRequire4 } from "node:module";
 import { fileURLToPath as fileURLToPath14 } from "node:url";
-import { readFileSync as readFileSync43, writeFileSync as writeFileSync27, appendFileSync as appendFileSync4, rmSync as rmSync3, readdirSync as readdirSync22, mkdirSync as mkdirSync28 } from "node:fs";
-import { existsSync as existsSync54 } from "node:fs";
+import { readFileSync as readFileSync44, writeFileSync as writeFileSync27, appendFileSync as appendFileSync5, rmSync as rmSync3, readdirSync as readdirSync22, mkdirSync as mkdirSync29 } from "node:fs";
+import { existsSync as existsSync55 } from "node:fs";
 import { execSync as execSync35 } from "node:child_process";
 import { homedir as homedir19 } from "node:os";
 function formatTimeAgo(date) {
@@ -66865,12 +67435,12 @@ function getVersion4() {
     const require2 = createRequire4(import.meta.url);
     const thisDir = dirname22(fileURLToPath14(import.meta.url));
     const candidates = [
-      join71(thisDir, "..", "package.json"),
-      join71(thisDir, "..", "..", "package.json"),
-      join71(thisDir, "..", "..", "..", "package.json")
+      join72(thisDir, "..", "package.json"),
+      join72(thisDir, "..", "..", "package.json"),
+      join72(thisDir, "..", "..", "..", "package.json")
     ];
     for (const pkgPath of candidates) {
-      if (existsSync54(pkgPath)) {
+      if (existsSync55(pkgPath)) {
         const pkg = require2(pkgPath);
         if (pkg.name === "open-agents-ai" || pkg.name === "@open-agents/cli" || pkg.name === "@open-agents/monorepo") {
           return pkg.version ?? "0.0.0";
@@ -67109,15 +67679,15 @@ Use task_status("${taskId}") or task_output("${taskId}") to check progress.`
 function gatherMemorySnippets(root) {
   const snippets = [];
   const dirs = [
-    join71(root, ".oa", "memory"),
-    join71(root, ".open-agents", "memory")
+    join72(root, ".oa", "memory"),
+    join72(root, ".open-agents", "memory")
   ];
   for (const dir of dirs) {
-    if (!existsSync54(dir))
+    if (!existsSync55(dir))
       continue;
     try {
       for (const f of readdirSync22(dir).filter((f2) => f2.endsWith(".json"))) {
-        const data = JSON.parse(readFileSync43(join71(dir, f), "utf-8"));
+        const data = JSON.parse(readFileSync44(join72(dir, f), "utf-8"));
         for (const val of Object.values(data)) {
           const v = typeof val === "object" && val !== null && "value" in val ? String(val.value) : String(val);
           if (v.length > 10)
@@ -67274,9 +67844,9 @@ ${metabolismMemories}
   } catch {
   }
   try {
-    const archeFile = join71(repoRoot, ".oa", "arche", "variants.json");
-    if (existsSync54(archeFile)) {
-      const variants = JSON.parse(readFileSync43(archeFile, "utf8"));
+    const archeFile = join72(repoRoot, ".oa", "arche", "variants.json");
+    if (existsSync55(archeFile)) {
+      const variants = JSON.parse(readFileSync44(archeFile, "utf8"));
       if (variants.length > 0) {
         let filtered = variants;
         if (taskType) {
@@ -67445,9 +68015,9 @@ RULES:
   const compactionThreshold = modelTier === "small" ? 12e3 : modelTier === "medium" ? 24e3 : 4e4;
   let identityInjection = "";
   try {
-    const ikStateFile = join71(repoRoot, ".oa", "identity", "self-state.json");
-    if (existsSync54(ikStateFile)) {
-      const selfState = JSON.parse(readFileSync43(ikStateFile, "utf8"));
+    const ikStateFile = join72(repoRoot, ".oa", "identity", "self-state.json");
+    if (existsSync55(ikStateFile)) {
+      const selfState = JSON.parse(readFileSync44(ikStateFile, "utf8"));
       const lines = [
         `[Identity State v${selfState.version}]`,
         `Self: ${selfState.narrative_summary}`,
@@ -68091,13 +68661,13 @@ When done, either call task_complete with your answer, or use FINAL_VAR(variable
           });
         }
         try {
-          const ikDir = join71(repoRoot, ".oa", "identity");
-          const ikFile = join71(ikDir, "self-state.json");
+          const ikDir = join72(repoRoot, ".oa", "identity");
+          const ikFile = join72(ikDir, "self-state.json");
           let ikState;
-          if (existsSync54(ikFile)) {
-            ikState = JSON.parse(readFileSync43(ikFile, "utf8"));
+          if (existsSync55(ikFile)) {
+            ikState = JSON.parse(readFileSync44(ikFile, "utf8"));
           } else {
-            mkdirSync28(ikDir, { recursive: true });
+            mkdirSync29(ikDir, { recursive: true });
             const machineId = Date.now().toString(36) + Math.random().toString(36).slice(2, 8);
             ikState = {
               self_id: `oa-${machineId}`,
@@ -68138,9 +68708,9 @@ When done, either call task_complete with your answer, or use FINAL_VAR(variable
       } else {
         renderTaskIncomplete(result.turns, result.toolCalls, result.durationMs, tokens);
         try {
-          const ikFile = join71(repoRoot, ".oa", "identity", "self-state.json");
-          if (existsSync54(ikFile)) {
-            const ikState = JSON.parse(readFileSync43(ikFile, "utf8"));
+          const ikFile = join72(repoRoot, ".oa", "identity", "self-state.json");
+          if (existsSync55(ikFile)) {
+            const ikState = JSON.parse(readFileSync44(ikFile, "utf8"));
             ikState.homeostasis.uncertainty = Math.min(1, ikState.homeostasis.uncertainty + 0.1);
             ikState.homeostasis.coherence = Math.max(0, ikState.homeostasis.coherence - 0.05);
             ikState.session_count = (ikState.session_count || 0) + 1;
@@ -68242,10 +68812,10 @@ async function startInteractive(config, repoPath) {
     process.stdin.pause();
   }
   try {
-    const oaDir = join71(repoRoot, ".oa");
-    const nexusPidFile = join71(oaDir, "nexus", "daemon.pid");
-    if (existsSync54(nexusPidFile)) {
-      const pid = parseInt(readFileSync43(nexusPidFile, "utf8").trim(), 10);
+    const oaDir = join72(repoRoot, ".oa");
+    const nexusPidFile = join72(oaDir, "nexus", "daemon.pid");
+    if (existsSync55(nexusPidFile)) {
+      const pid = parseInt(readFileSync44(nexusPidFile, "utf8").trim(), 10);
       if (pid > 0) {
         try {
           process.kill(pid, 0);
@@ -68582,7 +69152,7 @@ Review its full output in the [${id}] tab or via full_sub_agent(action='output',
   let p2pGateway = null;
   let peerMesh = null;
   let inferenceRouter = null;
-  const secretVault = new SecretVault(join71(repoRoot, ".oa", "vault.enc"));
+  const secretVault = new SecretVault(join72(repoRoot, ".oa", "vault.enc"));
   let adminSessionKey = null;
   const callSubAgents = /* @__PURE__ */ new Map();
   const streamRenderer = new StreamRenderer();
@@ -68805,13 +69375,13 @@ Rationale: ${proposal.rationale}${provenanceNote}`;
     const hits = allCompletions.filter((c3) => c3.toLowerCase().startsWith(lower));
     return [hits, line];
   }
-  const HISTORY_DIR = join71(homedir19(), ".open-agents");
-  const HISTORY_FILE = join71(HISTORY_DIR, "repl-history");
+  const HISTORY_DIR = join72(homedir19(), ".open-agents");
+  const HISTORY_FILE = join72(HISTORY_DIR, "repl-history");
   const MAX_HISTORY_LINES = 500;
   let savedHistory = [];
   try {
-    if (existsSync54(HISTORY_FILE)) {
-      const raw = readFileSync43(HISTORY_FILE, "utf8").trim();
+    if (existsSync55(HISTORY_FILE)) {
+      const raw = readFileSync44(HISTORY_FILE, "utf8").trim();
       if (raw)
         savedHistory = raw.split("\n").reverse();
     }
@@ -68914,10 +69484,10 @@ Rationale: ${proposal.rationale}${provenanceNote}`;
     if (!line.trim())
       return;
     try {
-      mkdirSync28(HISTORY_DIR, { recursive: true });
-      appendFileSync4(HISTORY_FILE, line + "\n", "utf8");
+      mkdirSync29(HISTORY_DIR, { recursive: true });
+      appendFileSync5(HISTORY_FILE, line + "\n", "utf8");
       if (Math.random() < 0.02) {
-        const all = readFileSync43(HISTORY_FILE, "utf8").trim().split("\n");
+        const all = readFileSync44(HISTORY_FILE, "utf8").trim().split("\n");
         if (all.length > MAX_HISTORY_LINES) {
           writeFileSync27(HISTORY_FILE, all.slice(-MAX_HISTORY_LINES).join("\n") + "\n", "utf8");
         }
@@ -69103,7 +69673,7 @@ Rationale: ${proposal.rationale}${provenanceNote}`;
     } catch {
     }
     try {
-      const oaDir = join71(repoRoot, ".oa");
+      const oaDir = join72(repoRoot, ".oa");
       const reconnected = await ExposeGateway.checkAndReconnect(oaDir, {
         onInfo: (msg) => writeContent(() => renderInfo(msg)),
         onError: (msg) => writeContent(() => renderWarning(msg))
@@ -69135,7 +69705,7 @@ Rationale: ${proposal.rationale}${provenanceNote}`;
     } catch {
     }
     try {
-      const oaDir = join71(repoRoot, ".oa");
+      const oaDir = join72(repoRoot, ".oa");
       const reconnectedP2P = await ExposeP2PGateway.checkAndReconnect(oaDir, new NexusTool(repoRoot), {
         onInfo: (msg) => writeContent(() => renderInfo(msg)),
         onError: (msg) => writeContent(() => renderWarning(msg))
@@ -69176,11 +69746,11 @@ Rationale: ${proposal.rationale}${provenanceNote}`;
     }
     try {
       const { homedir: _hd, hostname: _hn, userInfo: _ui } = await import("node:os");
-      const globalNamePath = join71(_hd(), ".open-agents", "agent-name");
+      const globalNamePath = join72(_hd(), ".open-agents", "agent-name");
       let agName = "";
       try {
-        if (existsSync54(globalNamePath))
-          agName = readFileSync43(globalNamePath, "utf8").trim();
+        if (existsSync55(globalNamePath))
+          agName = readFileSync44(globalNamePath, "utf8").trim();
       } catch {
       }
       if (!agName) {
@@ -70156,7 +70726,7 @@ Respond concisely and safely. Remember: you are talking to the general public.`;
           kind,
           targetUrl,
           authKey,
-          stateDir: join71(repoRoot, ".oa"),
+          stateDir: join72(repoRoot, ".oa"),
           passthrough: passthrough ?? false,
           loadbalance: loadbalance ?? false,
           endpointAuth: passthrough ? currentConfig.apiKey : void 0,
@@ -70202,7 +70772,7 @@ Respond concisely and safely. Remember: you are talking to the general public.`;
         await tunnelGateway.stop();
         tunnelGateway = null;
       }
-      const newTunnel = new ExposeGateway({ kind, targetUrl, authKey, fullAccess, stateDir: join71(repoRoot, ".oa") });
+      const newTunnel = new ExposeGateway({ kind, targetUrl, authKey, fullAccess, stateDir: join72(repoRoot, ".oa") });
       newTunnel.on("stats", (stats) => {
         statusBar.setExposeStatus({
           status: stats.status,
@@ -70291,9 +70861,9 @@ Respond concisely and safely. Remember: you are talking to the general public.`;
       if (!result.success)
         throw new Error(result.error || "Connect failed");
       try {
-        const nexusPidFile = join71(repoRoot, ".oa", "nexus", "daemon.pid");
-        if (existsSync54(nexusPidFile)) {
-          const pid = parseInt(readFileSync43(nexusPidFile, "utf8").trim(), 10);
+        const nexusPidFile = join72(repoRoot, ".oa", "nexus", "daemon.pid");
+        if (existsSync55(nexusPidFile)) {
+          const pid = parseInt(readFileSync44(nexusPidFile, "utf8").trim(), 10);
           if (pid > 0) {
             registry.register({
               name: "Nexus",
@@ -70489,10 +71059,10 @@ Respond concisely and safely. Remember: you are talking to the general public.`;
         writeContent(() => renderInfo(`Killed ${bgKilled} background task(s).`));
       }
       try {
-        const nexusDir = join71(repoRoot, OA_DIR, "nexus");
-        const pidFile = join71(nexusDir, "daemon.pid");
-        if (existsSync54(pidFile)) {
-          const pid = parseInt(readFileSync43(pidFile, "utf8").trim(), 10);
+        const nexusDir = join72(repoRoot, OA_DIR, "nexus");
+        const pidFile = join72(nexusDir, "daemon.pid");
+        if (existsSync55(pidFile)) {
+          const pid = parseInt(readFileSync44(pidFile, "utf8").trim(), 10);
           if (pid > 0) {
             try {
               if (process.platform === "win32") {
@@ -70514,13 +71084,13 @@ Respond concisely and safely. Remember: you are talking to the general public.`;
       } catch {
       }
       try {
-        const voiceDir2 = join71(homedir19(), ".open-agents", "voice");
+        const voiceDir2 = join72(homedir19(), ".open-agents", "voice");
         const voicePidFiles = ["luxtts-daemon.pid", "piper-daemon.pid"];
         for (const pf of voicePidFiles) {
-          const pidPath = join71(voiceDir2, pf);
-          if (existsSync54(pidPath)) {
+          const pidPath = join72(voiceDir2, pf);
+          if (existsSync55(pidPath)) {
             try {
-              const pid = parseInt(readFileSync43(pidPath, "utf8").trim(), 10);
+              const pid = parseInt(readFileSync44(pidPath, "utf8").trim(), 10);
               if (pid > 0) {
                 if (process.platform === "win32") {
                   try {
@@ -70544,8 +71114,8 @@ Respond concisely and safely. Remember: you are talking to the general public.`;
         execSync35(process.platform === "win32" ? "timeout /t 1 /nobreak >nul" : "sleep 0.5", { timeout: 3e3, stdio: "ignore" });
       } catch {
       }
-      const oaPath = join71(repoRoot, OA_DIR);
-      if (existsSync54(oaPath)) {
+      const oaPath = join72(repoRoot, OA_DIR);
+      if (existsSync55(oaPath)) {
         let deleted = false;
         for (let attempt = 0; attempt < 3; attempt++) {
           try {
@@ -70628,19 +71198,19 @@ Respond concisely and safely. Remember: you are talking to the general public.`;
   try {
     const { isPersonaPlexRunning: isPersonaPlexRunning2 } = await Promise.resolve().then(() => (init_personaplex(), personaplex_exports));
     if (isPersonaPlexRunning2()) {
-      const ppPidFile = join71(homedir19(), ".open-agents", "voice", "personaplex", "daemon.pid");
-      const ppPortFile = join71(homedir19(), ".open-agents", "voice", "personaplex", "daemon.port");
-      if (existsSync54(ppPidFile)) {
-        const ppPid = parseInt(readFileSync43(ppPidFile, "utf8").trim(), 10);
-        const ppPort = existsSync54(ppPortFile) ? parseInt(readFileSync43(ppPortFile, "utf8").trim(), 10) : void 0;
+      const ppPidFile = join72(homedir19(), ".open-agents", "voice", "personaplex", "daemon.pid");
+      const ppPortFile = join72(homedir19(), ".open-agents", "voice", "personaplex", "daemon.port");
+      if (existsSync55(ppPidFile)) {
+        const ppPid = parseInt(readFileSync44(ppPidFile, "utf8").trim(), 10);
+        const ppPort = existsSync55(ppPortFile) ? parseInt(readFileSync44(ppPortFile, "utf8").trim(), 10) : void 0;
         if (ppPid > 0 && !registry.daemons.has("PersonaPlex")) {
           registry.register({ name: "PersonaPlex", pid: ppPid, port: ppPort, startedAt: Date.now(), status: "running" });
         }
       }
     }
-    const nexusPidFile = join71(repoRoot, ".oa", "nexus", "daemon.pid");
-    if (existsSync54(nexusPidFile)) {
-      const nPid = parseInt(readFileSync43(nexusPidFile, "utf8").trim(), 10);
+    const nexusPidFile = join72(repoRoot, ".oa", "nexus", "daemon.pid");
+    if (existsSync55(nexusPidFile)) {
+      const nPid = parseInt(readFileSync44(nexusPidFile, "utf8").trim(), 10);
       if (nPid > 0 && !registry.daemons.has("Nexus")) {
         try {
           process.kill(nPid, 0);
@@ -70982,8 +71552,8 @@ Execute this skill now. Follow the behavioral guidance above.`;
       }
     }
     const cleanPath = input.replace(/^['"]|['"]$/g, "").trim();
-    const isImage = isImagePath(cleanPath) && existsSync54(resolve32(repoRoot, cleanPath));
-    const isMedia = !isImage && isTranscribablePath(cleanPath) && existsSync54(resolve32(repoRoot, cleanPath));
+    const isImage = isImagePath(cleanPath) && existsSync55(resolve32(repoRoot, cleanPath));
+    const isMedia = !isImage && isTranscribablePath(cleanPath) && existsSync55(resolve32(repoRoot, cleanPath));
     if (activeTask) {
       if (activeTask.runner.isPaused) {
         activeTask.runner.resume();
@@ -70992,7 +71562,7 @@ Execute this skill now. Follow the behavioral guidance above.`;
       if (isImage) {
         try {
           const imgPath = resolve32(repoRoot, cleanPath);
-          const imgBuffer = readFileSync43(imgPath);
+          const imgBuffer = readFileSync44(imgPath);
           const base64 = imgBuffer.toString("base64");
           const ext = extname11(cleanPath).toLowerCase();
           const mime = ext === ".png" ? "image/png" : ext === ".gif" ? "image/gif" : ext === ".webp" ? "image/webp" : "image/jpeg";
@@ -71207,7 +71777,7 @@ Summarize or analyze this transcription as appropriate.`;
 
 NEW TASK: ${fullInput}`;
       restoredSessionContext = null;
-    } else if (existsSync54(join71(repoRoot, ".oa", "context", "session-diary.md"))) {
+    } else if (existsSync55(join72(repoRoot, ".oa", "context", "session-diary.md"))) {
       taskInput = `[Previous sessions exist \u2014 file_read(".oa/context/session-diary.md") to recall]
 
 ${fullInput}`;
@@ -71524,13 +72094,13 @@ async function runWithTUI(task, config, repoPath) {
     const handle = startTask(task, config, repoRoot);
     await handle.promise;
     try {
-      const ikDir = join71(repoRoot, ".oa", "identity");
-      const ikFile = join71(ikDir, "self-state.json");
+      const ikDir = join72(repoRoot, ".oa", "identity");
+      const ikFile = join72(ikDir, "self-state.json");
       let ikState;
-      if (existsSync54(ikFile)) {
-        ikState = JSON.parse(readFileSync43(ikFile, "utf8"));
+      if (existsSync55(ikFile)) {
+        ikState = JSON.parse(readFileSync44(ikFile, "utf8"));
       } else {
-        mkdirSync28(ikDir, { recursive: true });
+        mkdirSync29(ikDir, { recursive: true });
         ikState = {
           self_id: `oa-${Date.now().toString(36)}`,
           version: 1,
@@ -71561,12 +72131,12 @@ async function runWithTUI(task, config, repoPath) {
       ec.archiveVariantSync(`Task: ${task.slice(0, 200)}`, "success \u2014 completed", ["general"]);
     } catch {
       try {
-        const archeDir = join71(repoRoot, ".oa", "arche");
-        const archeFile = join71(archeDir, "variants.json");
+        const archeDir = join72(repoRoot, ".oa", "arche");
+        const archeFile = join72(archeDir, "variants.json");
         let variants = [];
         try {
-          if (existsSync54(archeFile))
-            variants = JSON.parse(readFileSync43(archeFile, "utf8"));
+          if (existsSync55(archeFile))
+            variants = JSON.parse(readFileSync44(archeFile, "utf8"));
         } catch {
         }
         variants.push({
@@ -71581,15 +72151,15 @@ async function runWithTUI(task, config, repoPath) {
         });
         if (variants.length > 50)
           variants = variants.slice(-50);
-        mkdirSync28(archeDir, { recursive: true });
+        mkdirSync29(archeDir, { recursive: true });
         writeFileSync27(archeFile, JSON.stringify(variants, null, 2));
       } catch {
       }
     }
     try {
-      const metaFile = join71(repoRoot, ".oa", "memory", "metabolism", "store.json");
-      if (existsSync54(metaFile)) {
-        const store = JSON.parse(readFileSync43(metaFile, "utf8"));
+      const metaFile = join72(repoRoot, ".oa", "memory", "metabolism", "store.json");
+      if (existsSync55(metaFile)) {
+        const store = JSON.parse(readFileSync44(metaFile, "utf8"));
         const surfaced = store.filter((m) => m.type !== "quarantine" && m.scores?.confidence > 0.15).sort((a, b) => b.scores.utility * b.scores.confidence - a.scores.utility * a.scores.confidence).slice(0, 5);
         let updated = false;
         for (const item of surfaced) {
@@ -71653,9 +72223,9 @@ Rules:
           try {
             const { initDb: initDb2 } = __require("@open-agents/memory");
             const { ProceduralMemoryStore: ProceduralMemoryStore2 } = __require("@open-agents/memory");
-            const dbDir = join71(repoRoot, ".oa", "memory");
-            mkdirSync28(dbDir, { recursive: true });
-            const db = initDb2(join71(dbDir, "structured.db"));
+            const dbDir = join72(repoRoot, ".oa", "memory");
+            mkdirSync29(dbDir, { recursive: true });
+            const db = initDb2(join72(dbDir, "structured.db"));
             const memStore = new ProceduralMemoryStore2(db);
             memStore.createWithEmbedding({
               content: content.slice(0, 600),
@@ -71670,12 +72240,12 @@ Rules:
             db.close();
           } catch {
           }
-          const metaDir = join71(repoRoot, ".oa", "memory", "metabolism");
-          const storeFile = join71(metaDir, "store.json");
+          const metaDir = join72(repoRoot, ".oa", "memory", "metabolism");
+          const storeFile = join72(metaDir, "store.json");
           let store = [];
           try {
-            if (existsSync54(storeFile))
-              store = JSON.parse(readFileSync43(storeFile, "utf8"));
+            if (existsSync55(storeFile))
+              store = JSON.parse(readFileSync44(storeFile, "utf8"));
           } catch {
           }
           store.push({
@@ -71691,26 +72261,26 @@ Rules:
           });
           if (store.length > 100)
             store = store.slice(-100);
-          mkdirSync28(metaDir, { recursive: true });
+          mkdirSync29(metaDir, { recursive: true });
           writeFileSync27(storeFile, JSON.stringify(store, null, 2));
         }
       }
     } catch {
     }
     try {
-      const cohereSettingsFile = join71(repoRoot, ".oa", "settings.json");
+      const cohereSettingsFile = join72(repoRoot, ".oa", "settings.json");
       let cohereActive = false;
       try {
-        if (existsSync54(cohereSettingsFile)) {
-          const settings = JSON.parse(readFileSync43(cohereSettingsFile, "utf8"));
+        if (existsSync55(cohereSettingsFile)) {
+          const settings = JSON.parse(readFileSync44(cohereSettingsFile, "utf8"));
           cohereActive = settings.cohere === true;
         }
       } catch {
       }
       if (cohereActive) {
-        const metaFile = join71(repoRoot, ".oa", "memory", "metabolism", "store.json");
-        if (existsSync54(metaFile)) {
-          const store = JSON.parse(readFileSync43(metaFile, "utf8"));
+        const metaFile = join72(repoRoot, ".oa", "memory", "metabolism", "store.json");
+        if (existsSync55(metaFile)) {
+          const store = JSON.parse(readFileSync44(metaFile, "utf8"));
           const latest = store.filter((m) => m.sourceTrace === "trajectory-extraction" || m.sourceTrace === "llm-trajectory-extraction").slice(-1)[0];
           if (latest && latest.scores?.confidence >= 0.6) {
             try {
@@ -71735,18 +72305,18 @@ Rules:
     }
   } catch (err) {
     try {
-      const ikFile = join71(repoRoot, ".oa", "identity", "self-state.json");
-      if (existsSync54(ikFile)) {
-        const ikState = JSON.parse(readFileSync43(ikFile, "utf8"));
+      const ikFile = join72(repoRoot, ".oa", "identity", "self-state.json");
+      if (existsSync55(ikFile)) {
+        const ikState = JSON.parse(readFileSync44(ikFile, "utf8"));
         ikState.homeostasis.uncertainty = Math.min(1, ikState.homeostasis.uncertainty + 0.1);
         ikState.homeostasis.coherence = Math.max(0, ikState.homeostasis.coherence - 0.05);
         ikState.session_count = (ikState.session_count || 0) + 1;
         ikState.updated_at = (/* @__PURE__ */ new Date()).toISOString();
         writeFileSync27(ikFile, JSON.stringify(ikState, null, 2));
       }
-      const metaFile = join71(repoRoot, ".oa", "memory", "metabolism", "store.json");
-      if (existsSync54(metaFile)) {
-        const store = JSON.parse(readFileSync43(metaFile, "utf8"));
+      const metaFile = join72(repoRoot, ".oa", "memory", "metabolism", "store.json");
+      if (existsSync55(metaFile)) {
+        const store = JSON.parse(readFileSync44(metaFile, "utf8"));
         const surfaced = store.filter((m) => m.type !== "quarantine" && m.scores?.confidence > 0.15).sort((a, b) => b.scores.utility * b.scores.confidence - a.scores.utility * a.scores.confidence).slice(0, 5);
         for (const item of surfaced) {
           item.accessCount = (item.accessCount || 0) + 1;
@@ -71757,12 +72327,12 @@ Rules:
         writeFileSync27(metaFile, JSON.stringify(store, null, 2));
       }
       try {
-        const archeDir = join71(repoRoot, ".oa", "arche");
-        const archeFile = join71(archeDir, "variants.json");
+        const archeDir = join72(repoRoot, ".oa", "arche");
+        const archeFile = join72(archeDir, "variants.json");
         let variants = [];
         try {
-          if (existsSync54(archeFile))
-            variants = JSON.parse(readFileSync43(archeFile, "utf8"));
+          if (existsSync55(archeFile))
+            variants = JSON.parse(readFileSync44(archeFile, "utf8"));
         } catch {
         }
         variants.push({
@@ -71777,7 +72347,7 @@ Rules:
         });
         if (variants.length > 50)
           variants = variants.slice(-50);
-        mkdirSync28(archeDir, { recursive: true });
+        mkdirSync29(archeDir, { recursive: true });
         writeFileSync27(archeFile, JSON.stringify(variants, null, 2));
       } catch {
       }
@@ -71848,13 +72418,13 @@ __export(run_exports, {
 });
 import { resolve as resolve33 } from "node:path";
 import { spawn as spawn22 } from "node:child_process";
-import { mkdirSync as mkdirSync29, writeFileSync as writeFileSync28, readFileSync as readFileSync44, readdirSync as readdirSync23, existsSync as existsSync55 } from "node:fs";
+import { mkdirSync as mkdirSync30, writeFileSync as writeFileSync28, readFileSync as readFileSync45, readdirSync as readdirSync23, existsSync as existsSync56 } from "node:fs";
 import { randomBytes as randomBytes17 } from "node:crypto";
-import { join as join72 } from "node:path";
+import { join as join73 } from "node:path";
 function jobsDir2(repoPath) {
   const root = resolve33(repoPath ?? process.cwd());
-  const dir = join72(root, ".oa", "jobs");
-  mkdirSync29(dir, { recursive: true });
+  const dir = join73(root, ".oa", "jobs");
+  mkdirSync30(dir, { recursive: true });
   return dir;
 }
 async function runCommand(opts, config) {
@@ -71939,7 +72509,7 @@ async function runBackground(task, config, opts) {
   });
   child.unref();
   job.pid = child.pid ?? 0;
-  writeFileSync28(join72(dir, `${id}.json`), JSON.stringify(job, null, 2));
+  writeFileSync28(join73(dir, `${id}.json`), JSON.stringify(job, null, 2));
   let output = "";
   child.stdout?.on("data", (chunk) => {
     output += chunk.toString();
@@ -71955,7 +72525,7 @@ async function runBackground(task, config, opts) {
       job.summary = result.summary;
       job.durationMs = result.durationMs;
       job.error = result.error;
-      writeFileSync28(join72(dir, `${id}.json`), JSON.stringify(job, null, 2));
+      writeFileSync28(join73(dir, `${id}.json`), JSON.stringify(job, null, 2));
     } catch {
     }
   });
@@ -71971,13 +72541,13 @@ async function runBackground(task, config, opts) {
 }
 function statusCommand(jobId, repoPath) {
   const dir = jobsDir2(repoPath);
-  const file = join72(dir, `${jobId}.json`);
-  if (!existsSync55(file)) {
+  const file = join73(dir, `${jobId}.json`);
+  if (!existsSync56(file)) {
     console.error(`Job not found: ${jobId}`);
     console.log(`Available jobs: oa jobs`);
     process.exit(1);
   }
-  const job = JSON.parse(readFileSync44(file, "utf-8"));
+  const job = JSON.parse(readFileSync45(file, "utf-8"));
   const runtime = job.completedAt ? `${((new Date(job.completedAt).getTime() - new Date(job.startedAt).getTime()) / 1e3).toFixed(0)}s` : `${((Date.now() - new Date(job.startedAt).getTime()) / 1e3).toFixed(0)}s`;
   const icon = job.status === "completed" ? "\u2713" : job.status === "failed" ? "\u2717" : "\u25CF";
   console.log(`${icon} ${job.id} [${job.status}] ${runtime}`);
@@ -72000,7 +72570,7 @@ function jobsCommand(repoPath) {
   console.log("Jobs:");
   for (const file of files) {
     try {
-      const job = JSON.parse(readFileSync44(join72(dir, file), "utf-8"));
+      const job = JSON.parse(readFileSync45(join73(dir, file), "utf-8"));
       const icon = job.status === "completed" ? "\u2713" : job.status === "failed" ? "\u2717" : "\u25CF";
       const runtime = job.completedAt ? `${((new Date(job.completedAt).getTime() - new Date(job.startedAt).getTime()) / 1e3).toFixed(0)}s` : `${((Date.now() - new Date(job.startedAt).getTime()) / 1e3).toFixed(0)}s`;
       console.log(`  ${icon} ${job.id} [${job.status}] ${runtime} \u2014 ${job.task.slice(0, 60)}`);
@@ -72020,7 +72590,7 @@ import { glob } from "glob";
 import ignore from "ignore";
 import { readFile as readFile23, stat as stat4 } from "node:fs/promises";
 import { createHash as createHash6 } from "node:crypto";
-import { join as join73, relative as relative4, extname as extname12, basename as basename17 } from "node:path";
+import { join as join74, relative as relative4, extname as extname12, basename as basename17 } from "node:path";
 var DEFAULT_EXCLUDE, LANGUAGE_MAP, CodebaseIndexer;
 var init_codebase_indexer = __esm({
   "packages/indexer/dist/codebase-indexer.js"() {
@@ -72064,7 +72634,7 @@ var init_codebase_indexer = __esm({
         const ig = ignore.default();
         if (this.config.respectGitignore) {
           try {
-            const gitignoreContent = await readFile23(join73(this.config.rootDir, ".gitignore"), "utf-8");
+            const gitignoreContent = await readFile23(join74(this.config.rootDir, ".gitignore"), "utf-8");
             ig.add(gitignoreContent);
           } catch {
           }
@@ -72079,7 +72649,7 @@ var init_codebase_indexer = __esm({
         for (const relativePath of files) {
           if (ig.ignores(relativePath))
             continue;
-          const fullPath = join73(this.config.rootDir, relativePath);
+          const fullPath = join74(this.config.rootDir, relativePath);
           try {
             const fileStat = await stat4(fullPath);
             if (fileStat.size > this.config.maxFileSize)
@@ -72125,7 +72695,7 @@ var init_codebase_indexer = __esm({
               if (!child) {
                 child = {
                   name: part,
-                  path: join73(current.path, part),
+                  path: join74(current.path, part),
                   type: "directory",
                   children: []
                 };
@@ -72208,13 +72778,13 @@ __export(index_repo_exports, {
   indexRepoCommand: () => indexRepoCommand
 });
 import { resolve as resolve34 } from "node:path";
-import { existsSync as existsSync56, statSync as statSync17 } from "node:fs";
+import { existsSync as existsSync57, statSync as statSync17 } from "node:fs";
 import { cwd as cwd2 } from "node:process";
 async function indexRepoCommand(opts, _config) {
   const repoRoot = resolve34(opts.repoPath ?? cwd2());
   printHeader("Index Repository");
   printInfo(`Indexing: ${repoRoot}`);
-  if (!existsSync56(repoRoot)) {
+  if (!existsSync57(repoRoot)) {
     printError(`Path does not exist: ${repoRoot}`);
     process.exit(1);
   }
@@ -72466,7 +73036,7 @@ var config_exports2 = {};
 __export(config_exports2, {
   configCommand: () => configCommand
 });
-import { join as join74, resolve as resolve35 } from "node:path";
+import { join as join75, resolve as resolve35 } from "node:path";
 import { homedir as homedir20 } from "node:os";
 import { cwd as cwd3 } from "node:process";
 function redactIfSensitive(key, value) {
@@ -72549,7 +73119,7 @@ function handleShow(opts, config) {
     }
   }
   printSection("Config File");
-  printInfo(`~/.open-agents/config.json (${join74(homedir20(), ".open-agents", "config.json")})`);
+  printInfo(`~/.open-agents/config.json (${join75(homedir20(), ".open-agents", "config.json")})`);
   printSection("Priority Chain");
   printInfo("  1. CLI flags (--model, --backend-url, etc.)");
   printInfo("  2. Project .oa/settings.json (--local)");
@@ -72588,7 +73158,7 @@ function handleSet(opts, _config) {
       const coerced = coerceForSettings(key, value);
       saveProjectSettings(repoRoot, { [key]: coerced });
       printSuccess(`Project override set: ${key} = ${redactIfSensitive(key, value)}`);
-      printInfo(`Saved to ${join74(repoRoot, ".oa", "settings.json")}`);
+      printInfo(`Saved to ${join75(repoRoot, ".oa", "settings.json")}`);
       printInfo("This override applies only when running in this workspace.");
     } catch (err) {
       printError(`Failed to save: ${err instanceof Error ? err.message : String(err)}`);
@@ -72731,8 +73301,8 @@ __export(eval_exports, {
   evalCommand: () => evalCommand
 });
 import { tmpdir as tmpdir10 } from "node:os";
-import { mkdirSync as mkdirSync30, writeFileSync as writeFileSync29 } from "node:fs";
-import { join as join75 } from "node:path";
+import { mkdirSync as mkdirSync31, writeFileSync as writeFileSync29 } from "node:fs";
+import { join as join76 } from "node:path";
 async function evalCommand(opts, config) {
   const suiteName = opts.suite ?? "basic";
   const suite = SUITES[suiteName];
@@ -72857,9 +73427,9 @@ async function evalCommand(opts, config) {
   process.exit(failed > 0 ? 1 : 0);
 }
 function createTempEvalRepo() {
-  const dir = join75(tmpdir10(), `open-agents-eval-${Date.now()}`);
-  mkdirSync30(dir, { recursive: true });
-  writeFileSync29(join75(dir, "package.json"), JSON.stringify({ name: "eval-repo", version: "0.0.0" }, null, 2) + "\n", "utf8");
+  const dir = join76(tmpdir10(), `open-agents-eval-${Date.now()}`);
+  mkdirSync31(dir, { recursive: true });
+  writeFileSync29(join76(dir, "package.json"), JSON.stringify({ name: "eval-repo", version: "0.0.0" }, null, 2) + "\n", "utf8");
   return dir;
 }
 var BASIC_SUITE, FULL_SUITE, SUITES;
@@ -72919,7 +73489,7 @@ init_updater();
 import { parseArgs as nodeParseArgs2 } from "node:util";
 import { createRequire as createRequire5 } from "node:module";
 import { fileURLToPath as fileURLToPath15 } from "node:url";
-import { dirname as dirname23, join as join76 } from "node:path";
+import { dirname as dirname23, join as join77 } from "node:path";
 
 // packages/cli/dist/cli.js
 import { createInterface } from "node:readline";
@@ -73026,7 +73596,7 @@ init_output();
 function getVersion5() {
   try {
     const require2 = createRequire5(import.meta.url);
-    const pkgPath = join76(dirname23(fileURLToPath15(import.meta.url)), "..", "package.json");
+    const pkgPath = join77(dirname23(fileURLToPath15(import.meta.url)), "..", "package.json");
     const pkg = require2(pkgPath);
     return pkg.version;
   } catch {
@@ -73301,12 +73871,12 @@ function crashLog(label, err) {
   const logLine = `[${timestamp}] ${label}: ${msg}
 `;
   try {
-    const { appendFileSync: appendFileSync5, mkdirSync: mkdirSync31 } = __require("node:fs");
-    const { join: join77 } = __require("node:path");
+    const { appendFileSync: appendFileSync6, mkdirSync: mkdirSync32 } = __require("node:fs");
+    const { join: join78 } = __require("node:path");
     const { homedir: homedir21 } = __require("node:os");
-    const logDir = join77(homedir21(), ".open-agents");
-    mkdirSync31(logDir, { recursive: true });
-    appendFileSync5(join77(logDir, "crash.log"), logLine);
+    const logDir = join78(homedir21(), ".open-agents");
+    mkdirSync32(logDir, { recursive: true });
+    appendFileSync6(join78(logDir, "crash.log"), logLine);
   } catch {
   }
   try {