open-agents-ai 0.187.227 → 0.187.229

package/dist/index.js

@@ -5470,6 +5470,98 @@ var init_git_info = __esm({
   }
 });
 
+// packages/execution/dist/tools/jibberlink.js
+import { createCipheriv, createDecipheriv, createHash, randomBytes as randomBytes4 } from "node:crypto";
+function crc16(bytes) {
+  let crc = 65535;
+  for (let i2 = 0; i2 < bytes.length; i2++) {
+    crc ^= bytes[i2] << 8;
+    for (let j = 0; j < 8; j++) {
+      crc = crc & 32768 ? (crc << 1 ^ 4129) & 65535 : crc << 1 & 65535;
+    }
+  }
+  return crc & 65535;
+}
+function deriveRoomKey(roomId, secret = "jibberlink-v1") {
+  const material = `${secret}\0${roomId}`;
+  return createHash("sha256").update(material).digest();
+}
+function aesGcmEncrypt(key, plaintext) {
+  if (key.length !== 32)
+    throw new Error("jibberlink: key must be 32 bytes");
+  const iv = randomBytes4(12);
+  const cipher = createCipheriv("aes-256-gcm", key, iv);
+  const ct = Buffer.concat([cipher.update(plaintext), cipher.final()]);
+  const tag = cipher.getAuthTag();
+  return Buffer.concat([iv, tag, ct]);
+}
+function bytesToBits(bytes) {
+  const out = new Uint8Array(bytes.length * 8);
+  for (let i2 = 0; i2 < bytes.length; i2++) {
+    const b = bytes[i2];
+    for (let j = 0; j < 8; j++)
+      out[i2 * 8 + j] = b >> j & 1;
+  }
+  return out;
+}
+function modulateFSK(bits) {
+  const out = new Float32Array(bits.length * JL_SAMPLES_PER_BIT);
+  let phase = 0;
+  for (let i2 = 0; i2 < bits.length; i2++) {
+    const freq = bits[i2] ? JL_MARK_HZ : JL_SPACE_HZ;
+    const phaseInc = 2 * Math.PI * freq / JL_SAMPLE_RATE;
+    for (let s2 = 0; s2 < JL_SAMPLES_PER_BIT; s2++) {
+      out[i2 * JL_SAMPLES_PER_BIT + s2] = Math.sin(phase) * 0.8;
+      phase += phaseInc;
+      if (phase > 2 * Math.PI)
+        phase -= 2 * Math.PI;
+    }
+  }
+  return out;
+}
+function encodeFrame(payload) {
+  if (payload.length > 65535)
+    throw new Error("jibberlink: payload too large");
+  const preamble = [];
+  for (let i2 = 0; i2 < JL_PREAMBLE_BITS; i2++)
+    preamble.push(i2 & 1);
+  const header = new Uint8Array([
+    JL_SYNC_BYTE,
+    payload.length >> 8 & 255,
+    payload.length & 255
+  ]);
+  const bodyBytes = new Uint8Array(header.length + payload.length + 2);
+  bodyBytes.set(header, 0);
+  bodyBytes.set(payload, header.length);
+  const crc = crc16(bodyBytes.subarray(0, header.length + payload.length));
+  bodyBytes[bodyBytes.length - 2] = crc >> 8 & 255;
+  bodyBytes[bodyBytes.length - 1] = crc & 255;
+  const bodyBits = bytesToBits(bodyBytes);
+  const allBits = new Uint8Array(preamble.length + bodyBits.length);
+  for (let i2 = 0; i2 < preamble.length; i2++)
+    allBits[i2] = preamble[i2];
+  allBits.set(bodyBits, preamble.length);
+  return modulateFSK(allBits);
+}
+function encodeEncrypted(roomId, payload, secret) {
+  const key = deriveRoomKey(roomId, secret);
+  const wrapped = aesGcmEncrypt(key, Buffer.from(payload));
+  return encodeFrame(wrapped);
+}
+var JL_SAMPLE_RATE, JL_MARK_HZ, JL_SPACE_HZ, JL_BAUD, JL_SAMPLES_PER_BIT, JL_SYNC_BYTE, JL_PREAMBLE_BITS;
+var init_jibberlink = __esm({
+  "packages/execution/dist/tools/jibberlink.js"() {
+    "use strict";
+    JL_SAMPLE_RATE = 16e3;
+    JL_MARK_HZ = 2200;
+    JL_SPACE_HZ = 1200;
+    JL_BAUD = 300;
+    JL_SAMPLES_PER_BIT = Math.floor(JL_SAMPLE_RATE / JL_BAUD);
+    JL_SYNC_BYTE = 126;
+    JL_PREAMBLE_BITS = 16;
+  }
+});
+
 // packages/execution/dist/tools/nexus.js
 var nexus_exports = {};
 __export(nexus_exports, {
@@ -5478,7 +5570,7 @@ __export(nexus_exports, {
 import { readFile as readFile8, writeFile as writeFile6, mkdir as mkdir3, chmod, unlink, readdir as readdir2, open as fsOpen, copyFile as copyFile2 } from "node:fs/promises";
 import { existsSync as existsSync11, readFileSync as readFileSync8, watch as fsWatchLocal } from "node:fs";
 import { resolve as resolve13, join as join14 } from "node:path";
-import { randomBytes as randomBytes4, createCipheriv, createDecipheriv, scryptSync, createHash } from "node:crypto";
+import { randomBytes as randomBytes5, createCipheriv as createCipheriv2, createDecipheriv as createDecipheriv2, scryptSync, createHash as createHash2 } from "node:crypto";
 import { execSync as execSync8, spawn as spawn2 } from "node:child_process";
 import { hostname, userInfo, homedir as homedir4 } from "node:os";
 function containsKeyMaterial(input) {
@@ -5492,6 +5584,7 @@ var DAEMON_SCRIPT, KEY_PATTERNS, NexusTool;
 var init_nexus = __esm({
   "packages/execution/dist/tools/nexus.js"() {
     "use strict";
+    init_jibberlink();
     DAEMON_SCRIPT = `#!/usr/bin/env node
 /**
  * nexus-daemon.mjs — Standalone nexus process with real TCP/UDP sockets.
@@ -5675,6 +5768,27 @@ var _natsConn = null;
 var _natsCodec = null;
 var _tokensByRequest = {};
 
+// ── Nexus voice subsystem (PCM + ASR) ─────────────────────────────────
+// Subscribes to nexus.rooms.audio, filters by the rooms this daemon has
+// joined, writes incoming voice frames to .oa/nexus/inbox/<room>/voice/
+// as JSON envelopes AND pipes decoded PCM16 into a whisper child process
+// so agents auto-receive transcripts of other agents' speech. Publishing
+// side: voice_publish action relays base64 PCM frames to the same subject.
+//
+// Transport contract (same as nexus frontend):
+//   subject: nexus.rooms.audio
+//   payload: JSON over StringCodec
+//   { type:'voice', roomId, peerId, agentName,
+//     sampleRate, encoding:'pcm16'|'float32'|'jibberlink', channels,
+//     seq, timestamp, data:<base64> }
+var VOICE_SUBJECT = 'nexus.rooms.audio';
+var _voiceSub = null;            // active NATS subscription object
+var _whisperProc = null;         // spawned live-whisper.py child process
+var _whisperPending = '';        // partial stdout line buffer
+var _voiceListenRooms = new Set(); // rooms actively piped to whisper
+var _voiceSeq = 0;
+var _voiceLastActivityMs = 0;
+
 // Check if an error is a connectivity/dial failure (should trigger NATS fallback)
 // vs an application-level error (auth rejected, capability not found — no point retrying via NATS)
 function isDialFailure(errMsg) {
@@ -5694,6 +5808,140 @@ function isDialFailure(errMsg) {
     lower.includes('connection refused');
 }
 
+// ── Voice helpers ────────────────────────────────────────────────────
+// Convert a base64 string to a Buffer of raw PCM bytes (browser-safe
+// atob is unavailable in Node, use Buffer directly).
+function _voiceB64ToBuf(b64) {
+  try { return Buffer.from(b64, 'base64'); } catch { return Buffer.alloc(0); }
+}
+function _voiceBufToB64(buf) {
+  try { return buf.toString('base64'); } catch { return ''; }
+}
+// Convert Int16 PCM little-endian Buffer → Float32Array in [-1, 1]
+function _voicePcm16ToF32(buf) {
+  var n = buf.length >> 1;
+  var out = new Float32Array(n);
+  for (var i = 0; i < n; i++) {
+    var s = buf.readInt16LE(i * 2);
+    out[i] = s / 32768;
+  }
+  return out;
+}
+// Convert Float32Array → Int16 PCM little-endian Buffer
+function _voiceF32ToPcm16(f32) {
+  var out = Buffer.alloc(f32.length * 2);
+  for (var i = 0; i < f32.length; i++) {
+    var s = Math.max(-1, Math.min(1, f32[i]));
+    out.writeInt16LE(s < 0 ? s * 32768 : s * 32767, i * 2);
+  }
+  return out;
+}
+// Ensure a whisper child process is running. Returns true on success.
+// Lazy-spawned on the first voice_listen_start call per daemon lifetime.
+function _voiceEnsureWhisper() {
+  if (_whisperProc && !_whisperProc.killed) return true;
+  try {
+    var cp = require('node:child_process');
+    var pathMod = require('node:path');
+    var fsMod = require('node:fs');
+    // Resolve live-whisper.py — ships inside the CLI bundle at dist/scripts
+    // relative to the currently-running daemon script.
+    var candidates = [
+      pathMod.resolve(pathMod.dirname(nexusDir), 'scripts', 'live-whisper.py'),
+      pathMod.resolve(process.cwd(), 'packages/execution/scripts/live-whisper.py'),
+      pathMod.resolve(process.cwd(), 'dist/scripts/live-whisper.py'),
+      pathMod.resolve(process.cwd(), 'scripts/live-whisper.py'),
+    ];
+    var whisperPy = null;
+    for (var i = 0; i < candidates.length; i++) {
+      if (fsMod.existsSync(candidates[i])) { whisperPy = candidates[i]; break; }
+    }
+    if (!whisperPy) {
+      dlog('voice: whisper script not found — searched ' + candidates.length + ' paths');
+      return false;
+    }
+    var pyBin = process.env.PYTHON || 'python3';
+    _whisperProc = cp.spawn(pyBin, [whisperPy, '--stdin', '--model', 'base', '--lang', 'en'], {
+      stdio: ['pipe', 'pipe', 'pipe'],
+    });
+    _whisperPending = '';
+    _whisperProc.stdout.on('data', function(chunk) {
+      _whisperPending += chunk.toString('utf8');
+      // DAEMON_SCRIPT is an outer template literal — any escape sequence
+      // in code we want to appear literally in the generated file must
+      // be double-escaped so the outer template doesn't consume it.
+      var lines = _whisperPending.split('\\n');
+      _whisperPending = lines.pop() || '';
+      for (var li = 0; li < lines.length; li++) {
+        var ln = lines[li].trim();
+        if (!ln) continue;
+        try {
+          var msg = JSON.parse(ln);
+          if (msg && msg.type === 'transcript' && msg.text) {
+            // Write each transcript to every actively-listened room's inbox
+            for (var roomId of _voiceListenRooms) {
+              try {
+                var roomInbox = pathMod.join(inboxDir, roomId, 'voice');
+                fsMod.mkdirSync(roomInbox, { recursive: true });
+                var fname = 'transcript-' + Date.now() + '-' + Math.random().toString(36).slice(2, 8) + '.json';
+                fsMod.writeFileSync(pathMod.join(roomInbox, fname), JSON.stringify({
+                  type:      'voice.transcript',
+                  roomId:    roomId,
+                  text:      String(msg.text || '').trim(),
+                  isFinal:   !!msg.isFinal,
+                  timestamp: Date.now(),
+                }, null, 2));
+              } catch (we) {
+                dlog('voice: transcript write failed: ' + (we.message || we));
+              }
+            }
+          }
+        } catch { /* non-JSON whisper output — ignore */ }
+      }
+    });
+    _whisperProc.stderr.on('data', function(chunk) {
+      dlog('whisper stderr: ' + chunk.toString('utf8').slice(0, 200));
+    });
+    _whisperProc.on('exit', function(code) {
+      dlog('whisper exited code=' + code);
+      _whisperProc = null;
+    });
+    dlog('voice: whisper child spawned (pid=' + _whisperProc.pid + ')');
+    return true;
+  } catch (err) {
+    dlog('voice: whisper spawn failed: ' + (err.message || err));
+    _whisperProc = null;
+    return false;
+  }
+}
+// Feed a PCM16 byte buffer into the whisper stdin. No-op if whisper isn't running.
+function _voiceFeedWhisper(buf) {
+  if (!_whisperProc || !_whisperProc.stdin || _whisperProc.killed) return;
+  try { _whisperProc.stdin.write(buf); } catch (err) {
+    dlog('voice: whisper stdin write failed: ' + (err.message || err));
+  }
+}
+// Write a compact "voice activity" event to the room inbox so the agent
+// sees who just spoke even when whisper isn't transcribing (no mic drain
+// on the laptop doing pure listening).
+function _voiceEmitActivity(env) {
+  try {
+    var pathMod2 = require('node:path');
+    var fsMod2 = require('node:fs');
+    var roomInbox = pathMod2.join(inboxDir, env.roomId, 'voice');
+    fsMod2.mkdirSync(roomInbox, { recursive: true });
+    var fname = 'activity-' + Date.now() + '-' + Math.random().toString(36).slice(2, 6) + '.json';
+    fsMod2.writeFileSync(pathMod2.join(roomInbox, fname), JSON.stringify({
+      type:      'voice.activity',
+      roomId:    env.roomId,
+      peerId:    env.peerId || '',
+      agentName: env.agentName || '',
+      seq:       env.seq || 0,
+      timestamp: env.timestamp || Date.now(),
+    }, null, 2));
+  } catch {}
+}
+
 function writeStatus(extra = {}) {
   const caps = typeof nexus.getRegisteredCapabilities === 'function'
     ? nexus.getRegisteredCapabilities() : [];
@@ -5828,6 +6076,85 @@ async function handleCmd(cmd) {
         writeResp(id, { ok: true, output: 'Message sent (id: ' + msgId + ')' });
         break;
       }
+      // ── Voice: publish a PCM frame to a room ──
+      // args: { room_id, pcm_base64, sample_rate?, encoding?, channels? }
+      // Relays to nexus.rooms.audio with the same envelope the nexus
+      // frontend decodes. Agents can call this with raw PCM bytes from
+      // any source (TTS, mic, jibberlink modem output).
+      case 'voice_publish': {
+        if (!_natsConn || !_natsCodec) {
+          writeResp(id, { ok: false, output: 'NATS not connected' });
+          return;
+        }
+        if (!args || !args.room_id || !args.pcm_base64) {
+          writeResp(id, { ok: false, output: 'voice_publish requires room_id + pcm_base64' });
+          return;
+        }
+        if (!rooms.has(args.room_id)) {
+          writeResp(id, { ok: false, output: 'Not in room: ' + args.room_id + '. Join first.' });
+          return;
+        }
+        try {
+          var vpEnv = {
+            type:       'voice',
+            roomId:     args.room_id,
+            peerId:     nexus.peerId || '',
+            agentName:  agentName,
+            sampleRate: parseInt(args.sample_rate, 10) || 16000,
+            encoding:   args.encoding || 'pcm16',
+            channels:   parseInt(args.channels, 10) || 1,
+            seq:        _voiceSeq++,
+            timestamp:  Date.now(),
+            data:       String(args.pcm_base64),
+          };
+          _natsConn.publish(VOICE_SUBJECT, _natsCodec.encode(JSON.stringify(vpEnv)));
+          writeResp(id, { ok: true, output: 'Voice frame published to ' + args.room_id + ' (' + Math.round(args.pcm_base64.length * 0.75) + ' bytes)' });
+        } catch (vpErr) {
+          writeResp(id, { ok: false, output: 'voice_publish error: ' + (vpErr.message || vpErr) });
+        }
+        break;
+      }
+      // ── Voice: start/stop ASR pipeline for a joined room ──
+      case 'voice_listen_start': {
+        var vlsRoom = args && args.room_id;
+        if (!vlsRoom) { writeResp(id, { ok: false, output: 'voice_listen_start requires room_id' }); return; }
+        if (!rooms.has(vlsRoom)) { writeResp(id, { ok: false, output: 'Not in room: ' + vlsRoom }); return; }
+        _voiceListenRooms.add(vlsRoom);
+        var ok = _voiceEnsureWhisper();
+        if (!ok) {
+          _voiceListenRooms.delete(vlsRoom);
+          writeResp(id, { ok: false, output: 'Failed to start whisper — check Python + live-whisper.py path' });
+          return;
+        }
+        writeResp(id, { ok: true, output: 'Voice listen started for ' + vlsRoom + '. Transcripts will appear in inbox/' + vlsRoom + '/voice/' });
+        break;
+      }
+      case 'voice_listen_stop': {
+        var vlsRoom2 = args && args.room_id;
+        if (vlsRoom2) {
+          _voiceListenRooms.delete(vlsRoom2);
+          writeResp(id, { ok: true, output: 'Voice listen stopped for ' + vlsRoom2 });
+        } else {
+          _voiceListenRooms.clear();
+          writeResp(id, { ok: true, output: 'Voice listen stopped for all rooms' });
+        }
+        if (_voiceListenRooms.size === 0 && _whisperProc) {
+          try { _whisperProc.stdin.end(); } catch {}
+          try { _whisperProc.kill(); } catch {}
+          _whisperProc = null;
+        }
+        break;
+      }
+      // ── Voice: status of voice subsystem ──
+      case 'voice_status': {
+        writeResp(id, { ok: true, output: JSON.stringify({
+          subscribed: !!_voiceSub,
+          whisperRunning: !!_whisperProc,
+          listeningRooms: Array.from(_voiceListenRooms),
+          lastActivityMsAgo: _voiceLastActivityMs ? (Date.now() - _voiceLastActivityMs) : null,
+        }, null, 2) });
+        break;
+      }
       // ── Sponsor announcement via NATS ──
       case 'sponsor_announce': {
         // Publish sponsor metadata to NATS so other OA instances can discover it
@@ -8058,6 +8385,58 @@ process.on('unhandledRejection', (reason) => {
         var _natsInvSub = _nc.subscribe(_natsInvSubject);
         dlog('NATS invoke relay listening on ' + _natsInvSubject);
 
+        // ── Voice subscription: nexus.rooms.audio ─────────────────
+        // Filters incoming voice envelopes by the rooms this daemon
+        // has joined. Auto-emits voice.activity events to the room
+        // inbox; if voice_listen_start has been called for that
+        // room, PCM bytes are piped into the whisper child process
+        // for auto-transcription.
+        try {
+          _voiceSub = _nc.subscribe(VOICE_SUBJECT);
+          dlog('NATS voice subscription active on ' + VOICE_SUBJECT);
+          (async function _voiceLoop() {
+            for await (var _vm of _voiceSub) {
+              try {
+                var env = JSON.parse(_natsCodec.decode(_vm.data));
+                if (!env || env.type !== 'voice' || !env.roomId) continue;
+                // Only process audio for rooms this agent has joined —
+                // ignores everyone else's chatter and keeps CPU down.
+                if (!rooms.has(env.roomId)) continue;
+                // Skip our own echo
+                if (env.peerId && env.peerId === nexus.peerId) continue;
+                _voiceLastActivityMs = Date.now();
+                _voiceEmitActivity(env);
+                // If whisper is active for this room, decode and pipe
+                if (_voiceListenRooms.has(env.roomId) && _whisperProc && env.data) {
+                  var buf;
+                  if (env.encoding === 'float32') {
+                    // Float32 → PCM16 conversion so whisper gets a
+                    // consistent input format
+                    var raw = _voiceB64ToBuf(env.data);
+                    var f32 = new Float32Array(raw.buffer, raw.byteOffset, raw.byteLength / 4);
+                    buf = _voiceF32ToPcm16(f32);
+                  } else if (env.encoding === 'jibberlink') {
+                    // Jibberlink frames are encrypted data-over-audio
+                    // (see lib-jibberlink.ts). Skip whisper feeding —
+                    // those get demodulated + decrypted separately.
+                    continue;
+                  } else {
+                    // Default pcm16 — pass straight through
+                    buf = _voiceB64ToBuf(env.data);
+                  }
+                  _voiceFeedWhisper(buf);
+                }
+              } catch (vErr) {
+                dlog('voice loop parse error: ' + (vErr.message || vErr));
+              }
+            }
+          })().catch(function(loopErr) {
+            dlog('voice loop fatal: ' + (loopErr.message || loopErr));
+          });
+        } catch (vsErr) {
+          dlog('voice subscribe failed: ' + (vsErr.message || vsErr));
+        }
+
         (async function _natsInvokeLoop() {
           for await (var _nm of _natsInvSub) {
             try {
@@ -10093,6 +10472,32 @@ process.on('SIGINT', () => process.emit('SIGTERM'));
                 confidence: String(args.confidence ?? "0.7")
               });
               break;
+            // ── Voice subsystem (nexus.rooms.audio transport) ──────────
+            case "voice_publish":
+              result = await this.sendDaemonCmd("voice_publish", {
+                room_id: String(args.room_id ?? ""),
+                pcm_base64: String(args.pcm_base64 ?? args.data ?? ""),
+                sample_rate: String(args.sample_rate ?? "16000"),
+                encoding: String(args.encoding ?? "pcm16"),
+                channels: String(args.channels ?? "1")
+              }, 1e4);
+              break;
+            case "voice_speak":
+              result = await this.doVoiceSpeak(args);
+              break;
+            case "voice_listen_start":
+              result = await this.sendDaemonCmd("voice_listen_start", { room_id: String(args.room_id ?? "") });
+              break;
+            case "voice_listen_stop":
+              result = await this.sendDaemonCmd("voice_listen_stop", { room_id: String(args.room_id ?? "") });
+              break;
+            case "voice_status":
+              result = await this.sendDaemonCmd("voice_status", {});
+              break;
+            // ── Jibberlink: encrypted data-over-audio between agents ───
+            case "jibberlink_send":
+              result = await this.doJibberlinkSend(args);
+              break;
             default:
               return { success: false, output: "", error: `Unknown nexus action: ${action}`, durationMs: Date.now() - start2 };
           }
@@ -10131,7 +10536,7 @@ process.on('SIGINT', () => process.emit('SIGTERM'));
           if (!pid)
             throw new Error("Nexus daemon not running. Use action 'connect' first.");
         }
-        const cmdId = randomBytes4(8).toString("hex");
+        const cmdId = randomBytes5(8).toString("hex");
         const cmdFile = join14(this.nexusDir, "cmd.json");
         const respFile = join14(this.nexusDir, "resp.json");
         if (existsSync11(respFile))
@@ -10242,7 +10647,7 @@ process.on('SIGINT', () => process.emit('SIGTERM'));
       // =========================================================================
       async doConnect(args) {
         await this.ensureDir();
-        const currentScriptHash = createHash("sha256").update(DAEMON_SCRIPT).digest("hex").slice(0, 16);
+        const currentScriptHash = createHash2("sha256").update(DAEMON_SCRIPT).digest("hex").slice(0, 16);
         const existingPid = this.getDaemonPid();
         if (existingPid) {
           let processAlive = false;
@@ -10614,6 +11019,134 @@ process.on('SIGINT', () => process.emit('SIGTERM'));
         }
         return this.sendDaemonCmd("send_message", args);
       }
+      /**
+       * Synthesize `text` to WAV via the system TTS (piper/espeak/ffmpeg
+       * sox fallback), decode to raw 16kHz mono PCM16, chunk into 20ms
+       * frames, and publish each frame to nexus.rooms.audio so other
+       * agents + the nexus frontend visitors hear the agent speak.
+       *
+       * This is the symmetry with the existing audio_playback.speak tool,
+       * but routes audio over the nexus voice subject instead of the
+       * local speakers.
+       */
+      async doVoiceSpeak(args) {
+        const text = String(args.text ?? "");
+        const roomId = String(args.room_id ?? "");
+        if (!text)
+          throw new Error("text is required");
+        if (!roomId)
+          throw new Error("room_id is required");
+        if (containsKeyMaterial(text)) {
+          return "BLOCKED: Text contains potential key material.";
+        }
+        const tmpWav = join14(this.nexusDir, `voice-${Date.now()}.wav`);
+        try {
+          const cp2 = await import("node:child_process");
+          const fsMod = await import("node:fs");
+          const path5 = await import("node:path");
+          let synthesized = false;
+          try {
+            cp2.execSync(`echo ${JSON.stringify(text)} | piper --model en_US-lessac-medium --output_file ${JSON.stringify(tmpWav)}`, {
+              stdio: "pipe",
+              timeout: 3e4
+            });
+            synthesized = fsMod.existsSync(tmpWav);
+          } catch {
+          }
+          if (!synthesized) {
+            try {
+              cp2.execSync(`espeak ${JSON.stringify(text)} -w ${JSON.stringify(tmpWav)} -s 160`, {
+                stdio: "pipe",
+                timeout: 15e3
+              });
+              synthesized = fsMod.existsSync(tmpWav);
+            } catch (err) {
+              throw new Error(`TTS synthesis failed: ${err.message || err}`);
+            }
+          }
+          const pcmPath = tmpWav.replace(/\.wav$/, ".pcm");
+          try {
+            cp2.execSync(`ffmpeg -y -i ${JSON.stringify(tmpWav)} -ac 1 -ar 16000 -f s16le ${JSON.stringify(pcmPath)}`, {
+              stdio: "pipe",
+              timeout: 15e3
+            });
+          } catch {
+            const raw = fsMod.readFileSync(tmpWav);
+            fsMod.writeFileSync(pcmPath, raw.slice(44));
+          }
+          const pcm = fsMod.readFileSync(pcmPath);
+          try {
+            fsMod.unlinkSync(tmpWav);
+          } catch {
+          }
+          try {
+            fsMod.unlinkSync(pcmPath);
+          } catch {
+          }
+          const SAMPLE_RATE = 16e3;
+          const FRAME_MS = 50;
+          const FRAME_BYTES = Math.floor(SAMPLE_RATE * FRAME_MS / 1e3 * 2);
+          const frameCount = Math.ceil(pcm.length / FRAME_BYTES);
+          let published = 0;
+          for (let i2 = 0; i2 < pcm.length; i2 += FRAME_BYTES) {
+            const chunk = pcm.subarray(i2, Math.min(i2 + FRAME_BYTES, pcm.length));
+            const b64 = chunk.toString("base64");
+            await this.sendDaemonCmd("voice_publish", {
+              room_id: roomId,
+              pcm_base64: b64,
+              sample_rate: String(SAMPLE_RATE),
+              encoding: "pcm16",
+              channels: "1"
+            }, 5e3);
+            published++;
+            await new Promise((r2) => setTimeout(r2, Math.floor(FRAME_MS * 0.5)));
+          }
+          return `Spoke ${frameCount} frames (${(pcm.length / 1024).toFixed(1)}KB) to ${roomId}`;
+        } catch (err) {
+          throw new Error(`voice_speak failed: ${err.message || err}`);
+        }
+      }
+      /**
+       * Encode a byte payload under AES-GCM (per-room key), modulate it as
+       * FSK over the jibberlink audio modem, and publish the resulting PCM
+       * samples to the room as a voice frame with encoding='jibberlink'.
+       *
+       * Other agents subscribed to nexus.rooms.audio can demodulate + decrypt
+       * it using the same roomId (shared key is derived from roomId + a
+       * caller-supplied `secret`). Visitors in the nexus frontend simply
+       * hear the characteristic chirp tones without decoding.
+       */
+      async doJibberlinkSend(args) {
+        const roomId = String(args.room_id ?? "");
+        const message2 = String(args.message ?? args.data ?? "");
+        const secret = args.secret != null ? String(args.secret) : void 0;
+        if (!roomId)
+          throw new Error("room_id is required");
+        if (!message2)
+          throw new Error("message is required");
+        if (containsKeyMaterial(message2)) {
+          return "BLOCKED: Message contains potential key material.";
+        }
+        const plaintext = Buffer.from(message2, "utf8");
+        if (plaintext.length > 1024) {
+          throw new Error("jibberlink payload > 1KB — split into multiple frames");
+        }
+        const pcmF32 = encodeEncrypted(roomId, plaintext, secret);
+        const pcm16 = Buffer.alloc(pcmF32.length * 2);
+        for (let i2 = 0; i2 < pcmF32.length; i2++) {
+          let s2 = Math.max(-1, Math.min(1, pcmF32[i2]));
+          pcm16.writeInt16LE(s2 < 0 ? s2 * 32768 : s2 * 32767, i2 * 2);
+        }
+        const b64 = pcm16.toString("base64");
+        await this.sendDaemonCmd("voice_publish", {
+          room_id: roomId,
+          pcm_base64: b64,
+          sample_rate: "16000",
+          encoding: "jibberlink",
+          channels: "1"
+        }, 1e4);
+        return `Jibberlink frame sent to ${roomId} (${plaintext.length}B plaintext → ${pcmF32.length} samples)`;
+      }
       async doSendDM(args) {
         const message2 = args.message;
         if (!message2)
@@ -10738,21 +11271,21 @@ process.on('SIGINT', () => process.emit('SIGTERM'));
         let privKeyHex;
         try {
           const { privateKeyToAccount } = await import("viem/accounts");
-          const privKey = randomBytes4(32);
+          const privKey = randomBytes5(32);
           privKeyHex = privKey.toString("hex");
           const account = privateKeyToAccount(`0x${privKeyHex}`);
           address = account.address;
           privKey.fill(0);
         } catch {
-          const privKey = randomBytes4(32);
+          const privKey = randomBytes5(32);
           privKeyHex = privKey.toString("hex");
-          address = "0x" + createHash("sha256").update(privKey).digest("hex").slice(0, 40);
+          address = "0x" + createHash2("sha256").update(privKey).digest("hex").slice(0, 40);
           privKey.fill(0);
         }
-        const salt = randomBytes4(32);
+        const salt = randomBytes5(32);
         const key = scryptSync(`${hostname()}:${userInfo().username}:nexus-wallet`, salt, 32, { N: 16384, r: 8, p: 1 });
-        const iv = randomBytes4(16);
-        const cipher = createCipheriv("aes-256-gcm", key, iv);
+        const iv = randomBytes5(16);
+        const cipher = createCipheriv2("aes-256-gcm", key, iv);
         let enc = cipher.update(privKeyHex, "utf8", "hex");
         enc += cipher.final("hex");
         const x402KeyPath = join14(this.nexusDir, "x402-wallet.key");
@@ -10800,21 +11333,21 @@ process.on('SIGINT', () => process.emit('SIGTERM'));
         let privKeyHex;
         try {
           const { privateKeyToAccount } = await import("viem/accounts");
-          const privKey = randomBytes4(32);
+          const privKey = randomBytes5(32);
           privKeyHex = privKey.toString("hex");
           const account = privateKeyToAccount(`0x${privKeyHex}`);
           address = account.address;
           privKey.fill(0);
         } catch {
-          const privKey = randomBytes4(32);
+          const privKey = randomBytes5(32);
           privKeyHex = privKey.toString("hex");
-          address = "0x" + createHash("sha256").update(privKey).digest("hex").slice(0, 40);
+          address = "0x" + createHash2("sha256").update(privKey).digest("hex").slice(0, 40);
           privKey.fill(0);
         }
-        const salt = randomBytes4(32);
+        const salt = randomBytes5(32);
         const key = scryptSync(`${hostname()}:${userInfo().username}:nexus-wallet`, salt, 32, { N: 16384, r: 8, p: 1 });
-        const iv = randomBytes4(16);
-        const cipher = createCipheriv("aes-256-gcm", key, iv);
+        const iv = randomBytes5(16);
+        const cipher = createCipheriv2("aes-256-gcm", key, iv);
         let enc = cipher.update(privKeyHex, "utf8", "hex");
         enc += cipher.final("hex");
         const x402KeyPath = join14(this.nexusDir, "x402-wallet.key");
@@ -11120,14 +11653,14 @@ process.on('SIGINT', () => process.emit('SIGTERM'));
           throw new Error("User-managed wallet cannot spend (no private key)");
         const salt = Buffer.from(w.salt, "hex");
         const key = scryptSync(`${hostname()}:${userInfo().username}:nexus-wallet`, salt, 32, { N: 16384, r: 8, p: 1 });
-        const decipher = createDecipheriv("aes-256-gcm", key, Buffer.from(w.iv, "hex"));
+        const decipher = createDecipheriv2("aes-256-gcm", key, Buffer.from(w.iv, "hex"));
         decipher.setAuthTag(Buffer.from(w.authTag, "hex"));
         let privKeyHex = decipher.update(w.encryptedKey, "hex", "utf8");
         privKeyHex += decipher.final("utf8");
         try {
           const { privateKeyToAccount } = await import("viem/accounts");
           const account = privateKeyToAccount(`0x${privKeyHex}`);
-          const nonce = "0x" + randomBytes4(32).toString("hex");
+          const nonce = "0x" + randomBytes5(32).toString("hex");
           const now = Math.floor(Date.now() / 1e3);
           const validAfter = now - 60;
           const validBefore = now + 3600;
@@ -11330,8 +11863,8 @@ process.on('SIGINT', () => process.emit('SIGTERM'));
             } catch {
             }
           }
-          const nonce = randomBytes4(16).toString("hex");
-          const hash = createHash("sha256").update(`${modelName}:${nonce}:${Date.now()}`).digest("hex");
+          const nonce = randomBytes5(16).toString("hex");
+          const hash = createHash2("sha256").update(`${modelName}:${nonce}:${Date.now()}`).digest("hex");
           const bar = (s2) => "█".repeat(Math.round(s2 / 5)) + "░".repeat(20 - Math.round(s2 / 5));
           const mem = vramMb > 24e3 ? 95 : vramMb > 16e3 ? 80 : vramMb > 8e3 ? 60 : vramMb > 0 ? 40 : 20;
           await this.ensureDir();
@@ -19865,7 +20398,7 @@ function createHasher(hashCons, info = {}) {
   Object.assign(hashC, info);
   return Object.freeze(hashC);
 }
-function randomBytes5(bytesLength = 32) {
+function randomBytes6(bytesLength = 32) {
   const cr = typeof globalThis === "object" ? globalThis.crypto : null;
   if (typeof cr?.getRandomValues !== "function")
     throw new Error("crypto.getRandomValues must be defined");
@@ -19889,11 +20422,11 @@ var init_utils3 = __esm({
 });
 
 // ../node_modules/@libp2p/crypto/dist/src/random-bytes.js
-function randomBytes6(length4) {
+function randomBytes7(length4) {
   if (isNaN(length4) || length4 <= 0) {
     throw new InvalidParametersError("random bytes length must be a Number bigger than 0");
   }
-  return randomBytes5(length4);
+  return randomBytes6(length4);
 }
 var init_random_bytes = __esm({
   "../node_modules/@libp2p/crypto/dist/src/random-bytes.js"() {
@@ -22082,7 +22615,7 @@ function getWLengths(Fp, Fn) {
 }
 function ecdh(Point, ecdhOpts = {}) {
   const { Fn } = Point;
-  const randomBytes_ = ecdhOpts.randomBytes || randomBytes5;
+  const randomBytes_ = ecdhOpts.randomBytes || randomBytes6;
   const lengths = Object.assign(getWLengths(Point.Fp, Fn), { seed: getMinHashLength(Fn.ORDER) });
   function isValidSecretKey(secretKey) {
     try {
@@ -22147,7 +22680,7 @@ function ecdsa(Point, hash, ecdsaOpts = {}) {
     bits2int_modN: "function"
   });
   ecdsaOpts = Object.assign({}, ecdsaOpts);
-  const randomBytes22 = ecdsaOpts.randomBytes || randomBytes5;
+  const randomBytes23 = ecdsaOpts.randomBytes || randomBytes6;
   const hmac2 = ecdsaOpts.hmac || ((key, msg) => hmac(hash, key, msg));
   const { Fp, Fn } = Point;
   const { ORDER: CURVE_ORDER, BITS: fnBits } = Fn;
@@ -22289,7 +22822,7 @@ function ecdsa(Point, hash, ecdsaOpts = {}) {
       throw new Error("invalid private key");
     const seedArgs = [int2octets(d2), int2octets(h1int)];
     if (extraEntropy != null && extraEntropy !== false) {
-      const e2 = extraEntropy === true ? randomBytes22(lengths.secretKey) : extraEntropy;
+      const e2 = extraEntropy === true ? randomBytes23(lengths.secretKey) : extraEntropy;
       seedArgs.push(abytes(e2, void 0, "extraEntropy"));
     }
     const seed = concatBytes(...seedArgs);
@@ -46871,7 +47404,7 @@ var init_connection_monitor = __esm({
                 const bs = byteStream(stream);
                 start2 = Date.now();
                 await Promise.all([
-                  bs.write(randomBytes6(PING_LENGTH), {
+                  bs.write(randomBytes7(PING_LENGTH), {
                     signal
                   }),
                   bs.read({
@@ -47383,7 +47916,7 @@ var init_random_walk = __esm({
           this.log("start walk");
           while (this.walkers > 0) {
             try {
-              const data = randomBytes6(32);
+              const data = randomBytes7(32);
               let s2 = Date.now();
               for await (const peer of this.peerRouting.getClosestPeers(data, { signal })) {
                 if (signal.aborted) {
@@ -53070,12 +53603,12 @@ async function exportToPem(privateKey, password) {
   });
   const keyBuf = keyWrapper.toBER();
   const keyArr = new Uint8Array(keyBuf, 0, keyBuf.byteLength);
-  const salt = randomBytes6(SALT_LENGTH);
+  const salt = randomBytes7(SALT_LENGTH);
   const encryptionKey = await pbkdf2Async(sha5122, password, salt, {
     c: ITERATIONS,
     dkLen: KEY_SIZE
   });
-  const iv = randomBytes6(16);
+  const iv = randomBytes7(16);
   const cryptoKey = await crypto14.subtle.importKey("raw", encryptionKey, "AES-CBC", false, ["encrypt"]);
   const encrypted = await crypto14.subtle.encrypt({
     name: "AES-CBC",
@@ -53373,7 +53906,7 @@ var init_keychain = __esm({
         const options2 = Object.assign({}, this.options);
         const saltLength = Math.ceil(NIST.minSaltLength / 3) * 3;
         if (options2.dek != null) {
-          options2.dek.salt = toString2(randomBytes6(saltLength), "base64");
+          options2.dek.salt = toString2(randomBytes7(saltLength), "base64");
         }
         return options2;
       }
@@ -54864,7 +55397,7 @@ function montgomery(curveDef) {
   const is25519 = type === "x25519";
   if (!is25519 && type !== "x448")
     throw new Error("invalid type");
-  const randomBytes_ = rand || randomBytes5;
+  const randomBytes_ = rand || randomBytes6;
   const montgomeryBits = is25519 ? 255 : 448;
   const fieldLen = is25519 ? 32 : 56;
   const Gu = is25519 ? BigInt(9) : BigInt(5);
@@ -58799,9 +59332,9 @@ var init_cookies = __esm({
 
 // ../node_modules/@libp2p/http-peer-id-auth/dist/src/utils.js
 function generateChallenge() {
-  const randomBytes22 = new Uint8Array(32);
-  crypto.getRandomValues(randomBytes22);
-  return toString2(randomBytes22, "base64urlpad");
+  const randomBytes23 = new Uint8Array(32);
+  crypto.getRandomValues(randomBytes23);
+  return toString2(randomBytes23, "base64urlpad");
 }
 function encodeAuthParams(params) {
   const encodedParams = Object.entries(params).map(([key, value2]) => `${key}="${value2}"`).join(", ");
@@ -87999,7 +88532,7 @@ var require_auto = __commonJS({
 // ../node_modules/acme-client/src/client.js
 var require_client = __commonJS({
   "../node_modules/acme-client/src/client.js"(exports, module) {
-    var { createHash: createHash9 } = __require("crypto");
+    var { createHash: createHash10 } = __require("crypto");
     var { getPemBodyAsB64u } = require_crypto();
     var { log: log22 } = require_logger();
     var HttpClient = require_http();
@@ -88310,14 +88843,14 @@ var require_client = __commonJS({
        */
       async getChallengeKeyAuthorization(challenge) {
         const jwk = this.http.getJwk();
-        const keysum = createHash9("sha256").update(JSON.stringify(jwk));
+        const keysum = createHash10("sha256").update(JSON.stringify(jwk));
         const thumbprint = keysum.digest("base64url");
         const result = `${challenge.token}.${thumbprint}`;
         if (challenge.type === "http-01") {
           return result;
         }
         if (challenge.type === "dns-01") {
-          return createHash9("sha256").update(result).digest("base64url");
+          return createHash10("sha256").update(result).digest("base64url");
         }
         if (challenge.type === "tls-alpn-01") {
           return result;
@@ -206664,7 +207197,7 @@ var init_refresh = __esm({
         if (this.routingTable.kb.localPeer == null) {
           throw new Error("Local peer not set");
         }
-        const randomData = randomBytes6(2);
+        const randomData = randomBytes7(2);
         const randomUint16 = (randomData[1] << 8) + randomData[0];
         const key = this._makePeerId(this.routingTable.kb.localPeer.kadId, randomUint16, targetCommonPrefixLength);
         const multihash = decode7(key);
@@ -210841,7 +211374,7 @@ var init_ping2 = __esm({
        * Ping a given peer and wait for its response, getting the operation latency.
        */
       async ping(peer, options2 = {}) {
-        const data = randomBytes6(PING_LENGTH2);
+        const data = randomBytes7(PING_LENGTH2);
         const stream = await this.components.connectionManager.openStream(peer, this.protocol, {
           runOnLimitedConnection: this.runOnLimitedConnection,
           ...options2
@@ -230997,7 +231530,7 @@ var require_websocket2 = __commonJS({
     var http6 = __require("http");
     var net5 = __require("net");
     var tls2 = __require("tls");
-    var { randomBytes: randomBytes22, createHash: createHash9 } = __require("crypto");
+    var { randomBytes: randomBytes23, createHash: createHash10 } = __require("crypto");
     var { Duplex: Duplex3, Readable } = __require("stream");
     var { URL: URL3 } = __require("url");
     var PerMessageDeflate2 = require_permessage_deflate2();
@@ -231527,7 +232060,7 @@ var require_websocket2 = __commonJS({
         }
       }
       const defaultPort = isSecure ? 443 : 80;
-      const key = randomBytes22(16).toString("base64");
+      const key = randomBytes23(16).toString("base64");
       const request = isSecure ? https4.request : http6.request;
       const protocolSet = /* @__PURE__ */ new Set();
       let perMessageDeflate;
@@ -231657,7 +232190,7 @@ var require_websocket2 = __commonJS({
           abortHandshake(websocket, socket, "Invalid Upgrade header");
           return;
         }
-        const digest3 = createHash9("sha1").update(key + GUID).digest("base64");
+        const digest3 = createHash10("sha1").update(key + GUID).digest("base64");
         if (res.headers["sec-websocket-accept"] !== digest3) {
           abortHandshake(websocket, socket, "Invalid Sec-WebSocket-Accept header");
           return;
@@ -232024,7 +232557,7 @@ var require_websocket_server = __commonJS({
     var EventEmitter10 = __require("events");
     var http6 = __require("http");
     var { Duplex: Duplex3 } = __require("stream");
-    var { createHash: createHash9 } = __require("crypto");
+    var { createHash: createHash10 } = __require("crypto");
     var extension2 = require_extension2();
     var PerMessageDeflate2 = require_permessage_deflate2();
     var subprotocol2 = require_subprotocol();
@@ -232325,7 +232858,7 @@ var require_websocket_server = __commonJS({
           );
         }
         if (this._state > RUNNING) return abortHandshake(socket, 503);
-        const digest3 = createHash9("sha1").update(key + GUID).digest("base64");
+        const digest3 = createHash10("sha1").update(key + GUID).digest("base64");
         const headers = [
           "HTTP/1.1 101 Switching Protocols",
           "Upgrade: websocket",
@@ -245132,13 +245665,13 @@ Justification: ${justification || "(none provided)"}`,
         }
         const snapshot = JSON.stringify(this.selfState, null, 2);
         try {
-          const { createHash: createHash9 } = await import("node:crypto");
+          const { createHash: createHash10 } = await import("node:crypto");
           const snapshotDir = join23(this.cwd, ".oa", "identity", "snapshots");
           await mkdir6(snapshotDir, { recursive: true });
           const version4 = this.selfState.version;
           const snapshotPath = join23(snapshotDir, `v${version4}.json`);
           await writeFile11(snapshotPath, snapshot, "utf8");
-          const hash = createHash9("sha256").update(snapshot).digest("hex");
+          const hash = createHash10("sha256").update(snapshot).digest("hex");
           await writeFile11(join23(this.cwd, ".oa", "identity", "latest-hash.txt"), hash, "utf8");
           let ipfsCid = "";
           try {
@@ -245271,8 +245804,8 @@ New: ${newNarrative.slice(0, 200)}...`,
       }
       // ── Helpers ──────────────────────────────────────────────────────────────
       createDefaultState() {
-        const { createHash: createHash9 } = __require("node:crypto");
-        const machineId = createHash9("sha256").update(this.cwd).digest("hex").slice(0, 12);
+        const { createHash: createHash10 } = __require("node:crypto");
+        const machineId = createHash10("sha256").update(this.cwd).digest("hex").slice(0, 12);
         return {
           self_id: `oa-${machineId}`,
           version: 1,
@@ -245354,9 +245887,9 @@ New: ${newNarrative.slice(0, 200)}...`,
         let cid;
         if (this.selfState.version > prevVersion) {
           try {
-            const { createHash: createHash9 } = await import("node:crypto");
+            const { createHash: createHash10 } = await import("node:crypto");
             const stateJson = JSON.stringify(this.selfState);
-            const hash = createHash9("sha256").update(stateJson).digest("hex").slice(0, 32);
+            const hash = createHash10("sha256").update(stateJson).digest("hex").slice(0, 32);
             const cidsPath = join23(this.cwd, ".oa", "identity", "cids.json");
             const cidsData = { latest: "", hash, version: this.selfState.version };
             try {
@@ -245400,7 +245933,7 @@ import { spawn as spawn7 } from "node:child_process";
 import { createServer as createServer2 } from "node:net";
 import { join as join24 } from "node:path";
 import { tmpdir as tmpdir4 } from "node:os";
-import { randomBytes as randomBytes8 } from "node:crypto";
+import { randomBytes as randomBytes9 } from "node:crypto";
 import { unlinkSync as unlinkSync3 } from "node:fs";
 var ReplTool;
 var init_repl = __esm({
@@ -245468,7 +246001,7 @@ var init_repl = __esm({
         if (!this.proc || this.proc.killed || this.proc.exitCode !== null) {
           await this.startProcess();
         }
-        const tempFile = join24(tmpdir4(), `oa-repl-ctx-${randomBytes8(6).toString("hex")}.txt`);
+        const tempFile = join24(tmpdir4(), `oa-repl-ctx-${randomBytes9(6).toString("hex")}.txt`);
         const { writeFileSync: writeFs, unlinkSync: unlinkFs } = await import("node:fs");
         writeFs(tempFile, content, "utf8");
         const result = await this.executeCode(`with open(${JSON.stringify(tempFile)}, "r") as _f:
@@ -245668,7 +246201,7 @@ print("__OA_REPL_READY__")
       async startIpcServer() {
         if (this.ipcServer)
           return;
-        const sockId = randomBytes8(8).toString("hex");
+        const sockId = randomBytes9(8).toString("hex");
         this.ipcPath = join24(tmpdir4(), `oa-repl-ipc-${sockId}.sock`);
         return new Promise((resolve39, reject) => {
           this.ipcServer = createServer2((conn) => {
@@ -245754,7 +246287,7 @@ print("__OA_REPL_READY__")
             resolve39({ success: false, output: "REPL process not available", error: "No process", durationMs: 0 });
             return;
           }
-          const sentinel = `__OA_SENTINEL_${randomBytes8(6).toString("hex")}__`;
+          const sentinel = `__OA_SENTINEL_${randomBytes9(6).toString("hex")}__`;
           let stdout = "";
           let stderr = "";
           let resolved = false;
@@ -250817,7 +251350,7 @@ import { execSync as execSync22, exec as execCb } from "node:child_process";
 import { readFile as readFile15, writeFile as writeFile17, mkdir as mkdir12 } from "node:fs/promises";
 import { resolve as resolve24, join as join37 } from "node:path";
 import { homedir as homedir10 } from "node:os";
-import { randomBytes as randomBytes9 } from "node:crypto";
+import { randomBytes as randomBytes10 } from "node:crypto";
 function isValidCron(expr) {
   const parts = expr.trim().split(/\s+/);
   if (parts.length !== 5)
@@ -251085,7 +251618,7 @@ var init_scheduler = __esm({
             durationMs: performance.now() - start2
           };
         }
-        const id = `sched-${randomBytes9(4).toString("hex")}`;
+        const id = `sched-${randomBytes10(4).toString("hex")}`;
         const oneShot = Boolean(args["one_shot"]);
         const maxRuns = typeof args["max_runs"] === "number" ? args["max_runs"] : void 0;
         const scope = String(args["scope"] ?? "local");
@@ -251244,7 +251777,7 @@ ${truncated}`, durationMs: performance.now() - start2 };
 // packages/execution/dist/tools/reminder.js
 import { readFile as readFile16, writeFile as writeFile18, mkdir as mkdir13 } from "node:fs/promises";
 import { resolve as resolve25, join as join38 } from "node:path";
-import { randomBytes as randomBytes10 } from "node:crypto";
+import { randomBytes as randomBytes11 } from "node:crypto";
 function parseDueTime(due) {
   const lower = due.toLowerCase().trim();
   const now = /* @__PURE__ */ new Date();
@@ -251441,7 +251974,7 @@ var init_reminder = __esm({
           dueAt = parsed.isoDate;
           dueDescription = parsed.description;
         }
-        const id = `rem-${randomBytes10(4).toString("hex")}`;
+        const id = `rem-${randomBytes11(4).toString("hex")}`;
         const entry = {
           id,
           message: message2,
@@ -251557,7 +252090,7 @@ var init_reminder = __esm({
 // packages/execution/dist/tools/agenda.js
 import { readFile as readFile17, writeFile as writeFile19, mkdir as mkdir14 } from "node:fs/promises";
 import { resolve as resolve26, join as join39 } from "node:path";
-import { randomBytes as randomBytes11 } from "node:crypto";
+import { randomBytes as randomBytes12 } from "node:crypto";
 async function loadAttentionStore(workingDir) {
   const storePath = resolve26(workingDir, ".oa", "scheduled", "attention.json");
   try {
@@ -251760,7 +252293,7 @@ ${sections.join("\n")}`,
             expiresAt = target.toISOString();
           }
         }
-        const id = `attn-${randomBytes11(4).toString("hex")}`;
+        const id = `attn-${randomBytes12(4).toString("hex")}`;
         const item = {
           id,
           title,
@@ -252466,7 +252999,7 @@ import { execSync as execSync25 } from "node:child_process";
 import { readFile as readFile18, writeFile as writeFile20, mkdir as mkdir15 } from "node:fs/promises";
 import { resolve as resolve28, join as join42 } from "node:path";
 import { homedir as homedir11 } from "node:os";
-import { randomBytes as randomBytes12 } from "node:crypto";
+import { randomBytes as randomBytes13 } from "node:crypto";
 function isValidCron2(expr) {
   const parts = expr.trim().split(/\s+/);
   if (parts.length !== 5)
@@ -252756,7 +253289,7 @@ var init_cron_agent = __esm({
             durationMs: performance.now() - start2
           };
         }
-        const id = `cron-${randomBytes12(4).toString("hex")}`;
+        const id = `cron-${randomBytes13(4).toString("hex")}`;
         const verifyCommand = args["verify_command"] ? String(args["verify_command"]) : void 0;
         const maxRuns = typeof args["max_runs"] === "number" ? args["max_runs"] : 0;
         const tags = Array.isArray(args["tags"]) ? args["tags"] : [];
@@ -253557,7 +254090,7 @@ var init_working_notes = __esm({
 import { existsSync as existsSync27, readFileSync as readFileSync20, writeFileSync as writeFileSync11, mkdirSync as mkdirSync10, renameSync, unlinkSync as unlinkSync5, readdirSync as readdirSync6 } from "node:fs";
 import { join as join43 } from "node:path";
 import { homedir as homedir12 } from "node:os";
-import { randomBytes as randomBytes13 } from "node:crypto";
+import { randomBytes as randomBytes14 } from "node:crypto";
 function setTodoEventPublisher(pub) {
   _eventPublisher = pub;
 }
@@ -253593,7 +254126,7 @@ function writeTodos(sessionId, incoming) {
   const oldById = new Map(old.map((t2) => [t2.id, t2]));
   const now = Date.now();
   const newTodos = incoming.map((t2) => {
-    const id = t2.id || `todo-${randomBytes13(4).toString("hex")}`;
+    const id = t2.id || `todo-${randomBytes14(4).toString("hex")}`;
     const existing = oldById.get(id);
     const next = {
       id,
@@ -259166,7 +259699,7 @@ Audio file: ${audioFile}`,
 
 // packages/execution/dist/tools/full-sub-agent.js
 import { spawn as spawn14, ChildProcess } from "node:child_process";
-import { randomBytes as randomBytes14 } from "node:crypto";
+import { randomBytes as randomBytes15 } from "node:crypto";
 function buildSubProcessArgs(opts) {
   const args = [];
   args.push(opts.task);
@@ -259194,7 +259727,7 @@ function findOaBinary3() {
   return "oa";
 }
 function spawnFullSubAgent(task, opts, onOutput, onComplete) {
-  const id = `oa-fl-${randomBytes14(2).toString("hex")}`;
+  const id = `oa-fl-${randomBytes15(2).toString("hex")}`;
   const oaBin = findOaBinary3();
   const cliArgs = buildSubProcessArgs({
     task,
@@ -261619,7 +262152,7 @@ var init_environment_snapshot = __esm({
 import { execSync as execSync42 } from "node:child_process";
 import { existsSync as existsSync43, mkdirSync as mkdirSync22, writeFileSync as writeFileSync20, readFileSync as readFileSync33, readdirSync as readdirSync10, unlinkSync as unlinkSync10 } from "node:fs";
 import { join as join57, basename as basename11 } from "node:path";
-import { createHash as createHash2 } from "node:crypto";
+import { createHash as createHash3 } from "node:crypto";
 function isYouTubeUrl2(url) {
   return /(?:youtube\.com\/(?:watch|shorts|live|embed|v\/)|youtu\.be\/)/i.test(url);
 }
@@ -261647,7 +262180,7 @@ function ensureFfmpeg() {
 function imageHash(imagePath) {
   try {
     const data = readFileSync33(imagePath);
-    return createHash2("md5").update(data).digest("hex").slice(0, 12);
+    return createHash3("md5").update(data).digest("hex").slice(0, 12);
   } catch {
     return "unknown";
   }
@@ -266900,7 +267433,7 @@ var init_toolPatternStore = __esm({
 import { join as join64 } from "node:path";
 import { mkdirSync as mkdirSync25, existsSync as existsSync48 } from "node:fs";
 import { randomUUID as randomUUID7 } from "node:crypto";
-import { createHash as createHash3 } from "node:crypto";
+import { createHash as createHash4 } from "node:crypto";
 function sanitizeImportance(raw, fallback = 5) {
   if (typeof raw !== "number" || !Number.isFinite(raw))
     return fallback;
@@ -267008,7 +267541,7 @@ var init_episodeStore = __esm({
       insert(ep) {
         const id = randomUUID7();
         const now = Date.now();
-        const contentHash = createHash3("sha256").update(ep.content).digest("hex").slice(0, 16);
+        const contentHash = createHash4("sha256").update(ep.content).digest("hex").slice(0, 16);
         const modality = ep.modality ?? "text";
         const rawImportance = ep.importance ?? autoImportance(ep.toolName ?? null, modality, ep.content);
         const importance = sanitizeImportance(rawImportance);
@@ -273920,7 +274453,7 @@ import { existsSync as existsSync50, statSync as statSync14, openSync, readSync,
 import { watch as fsWatch } from "node:fs";
 import { join as join66 } from "node:path";
 import { tmpdir as tmpdir17 } from "node:os";
-import { randomBytes as randomBytes15 } from "node:crypto";
+import { randomBytes as randomBytes16 } from "node:crypto";
 var NexusAgenticBackend;
 var init_nexusBackend = __esm({
   "packages/orchestrator/dist/nexusBackend.js"() {
@@ -274068,7 +274601,7 @@ var init_nexusBackend = __esm({
        * Falls back to unary + word-split if streaming setup fails.
        */
       async *chatCompletionStream(request) {
-        const streamFile = join66(tmpdir17(), `nexus-stream-${randomBytes15(6).toString("hex")}.jsonl`);
+        const streamFile = join66(tmpdir17(), `nexus-stream-${randomBytes16(6).toString("hex")}.jsonl`);
         writeFileSync23(streamFile, "", "utf8");
         const daemonArgs = {
           model: this.model,
@@ -274167,7 +274700,7 @@ var init_nexusBackend = __esm({
                 }
                 yield {
                   type: "tool_call_delta",
-                  toolCallId: tc.id || `call_${randomBytes15(8).toString("hex")}`,
+                  toolCallId: tc.id || `call_${randomBytes16(8).toString("hex")}`,
                   toolCallName: fn.name,
                   toolCallArgs: JSON.stringify(args)
                 };
@@ -274263,7 +274796,7 @@ var init_nexusBackend = __esm({
                           yield {
                             type: "tool_call_delta",
                             toolCallIndex: i2,
-                            toolCallId: tc.id || `call_${randomBytes15(8).toString("hex")}`,
+                            toolCallId: tc.id || `call_${randomBytes16(8).toString("hex")}`,
                             toolCallName: fn.name,
                             toolCallArgs: JSON.stringify(args)
                           };
@@ -279367,7 +279900,7 @@ var require_websocket3 = __commonJS({
     var http6 = __require("http");
     var net5 = __require("net");
     var tls2 = __require("tls");
-    var { randomBytes: randomBytes22, createHash: createHash9 } = __require("crypto");
+    var { randomBytes: randomBytes23, createHash: createHash10 } = __require("crypto");
     var { Duplex: Duplex3, Readable } = __require("stream");
     var { URL: URL3 } = __require("url");
     var PerMessageDeflate2 = require_permessage_deflate3();
@@ -279897,7 +280430,7 @@ var require_websocket3 = __commonJS({
         }
       }
       const defaultPort = isSecure ? 443 : 80;
-      const key = randomBytes22(16).toString("base64");
+      const key = randomBytes23(16).toString("base64");
       const request = isSecure ? https4.request : http6.request;
       const protocolSet = /* @__PURE__ */ new Set();
       let perMessageDeflate;
@@ -280027,7 +280560,7 @@ var require_websocket3 = __commonJS({
           abortHandshake(websocket, socket, "Invalid Upgrade header");
           return;
         }
-        const digest3 = createHash9("sha1").update(key + GUID).digest("base64");
+        const digest3 = createHash10("sha1").update(key + GUID).digest("base64");
         if (res.headers["sec-websocket-accept"] !== digest3) {
           abortHandshake(websocket, socket, "Invalid Sec-WebSocket-Accept header");
           return;
@@ -280394,7 +280927,7 @@ var require_websocket_server2 = __commonJS({
     var EventEmitter10 = __require("events");
     var http6 = __require("http");
     var { Duplex: Duplex3 } = __require("stream");
-    var { createHash: createHash9 } = __require("crypto");
+    var { createHash: createHash10 } = __require("crypto");
     var extension2 = require_extension3();
     var PerMessageDeflate2 = require_permessage_deflate3();
     var subprotocol2 = require_subprotocol2();
@@ -280695,7 +281228,7 @@ var require_websocket_server2 = __commonJS({
           );
         }
         if (this._state > RUNNING) return abortHandshake(socket, 503);
-        const digest3 = createHash9("sha1").update(key + GUID).digest("base64");
+        const digest3 = createHash10("sha1").update(key + GUID).digest("base64");
         const headers = [
           "HTTP/1.1 101 Switching Protocols",
           "Upgrade: websocket",
@@ -283209,7 +283742,7 @@ var init_voice_session = __esm({
 import { createServer as createServer4, request as httpRequest } from "node:http";
 import { spawn as spawn20, exec as exec2 } from "node:child_process";
 import { EventEmitter as EventEmitter5 } from "node:events";
-import { randomBytes as randomBytes16 } from "node:crypto";
+import { randomBytes as randomBytes17 } from "node:crypto";
 import { URL as URL2 } from "node:url";
 import { loadavg, cpus as cpus2, totalmem as totalmem2, freemem as freemem2 } from "node:os";
 import { existsSync as existsSync53, readFileSync as readFileSync39, writeFileSync as writeFileSync26, unlinkSync as unlinkSync13, mkdirSync as mkdirSync29, readdirSync as readdirSync13, statSync as statSync15 } from "node:fs";
@@ -283409,7 +283942,7 @@ var init_expose = __esm({
         this._stateDir = options2.stateDir ?? null;
         this._fullAccess = options2.fullAccess ?? false;
         if (options2.authKey === void 0 || options2.authKey === "") {
-          this._authKey = randomBytes16(24).toString("base64url");
+          this._authKey = randomBytes17(24).toString("base64url");
         } else {
           this._authKey = options2.authKey;
         }
@@ -284321,7 +284854,7 @@ ${this.formatConnectionInfo()}`);
         this._onInfo = options2.onInfo;
         this._onError = options2.onError;
         if (options2.authKey === void 0 || options2.authKey === "") {
-          this._authKey = randomBytes16(24).toString("base64url");
+          this._authKey = randomBytes17(24).toString("base64url");
         } else {
           this._authKey = options2.authKey;
         }
@@ -284764,7 +285297,7 @@ var init_types = __esm({
 });
 
 // packages/cli/src/tui/p2p/secret-vault.ts
-import { createCipheriv as createCipheriv2, createDecipheriv as createDecipheriv2, randomBytes as randomBytes17, scryptSync as scryptSync2, createHash as createHash4 } from "node:crypto";
+import { createCipheriv as createCipheriv3, createDecipheriv as createDecipheriv3, randomBytes as randomBytes18, scryptSync as scryptSync2, createHash as createHash5 } from "node:crypto";
 import { readFileSync as readFileSync40, writeFileSync as writeFileSync27, existsSync as existsSync54, mkdirSync as mkdirSync30 } from "node:fs";
 import { dirname as dirname18 } from "node:path";
 var PLACEHOLDER_PREFIX, PLACEHOLDER_SUFFIX, CIPHER_ALGO, SALT_LEN, IV_LEN, KEY_LEN, SecretVault;
@@ -284965,10 +285498,10 @@ var init_secret_vault = __esm({
             createdAt: s2.createdAt
           }))
         );
-        const salt = randomBytes17(SALT_LEN);
+        const salt = randomBytes18(SALT_LEN);
         const key = scryptSync2(passphrase, salt, KEY_LEN);
-        const iv = randomBytes17(IV_LEN);
-        const cipher = createCipheriv2(CIPHER_ALGO, key, iv);
+        const iv = randomBytes18(IV_LEN);
+        const cipher = createCipheriv3(CIPHER_ALGO, key, iv);
         const encrypted = Buffer.concat([cipher.update(data, "utf8"), cipher.final()]);
         const tag = cipher.getAuthTag();
         const blob = Buffer.concat([salt, iv, tag, encrypted]);
@@ -284991,7 +285524,7 @@ var init_secret_vault = __esm({
         const tag = blob.subarray(SALT_LEN + IV_LEN, SALT_LEN + IV_LEN + 16);
         const encrypted = blob.subarray(SALT_LEN + IV_LEN + 16);
         const key = scryptSync2(passphrase, salt, KEY_LEN);
-        const decipher = createDecipheriv2(CIPHER_ALGO, key, iv);
+        const decipher = createDecipheriv3(CIPHER_ALGO, key, iv);
         decipher.setAuthTag(tag);
         let data;
         try {
@@ -285008,7 +285541,7 @@ var init_secret_vault = __esm({
       /** Generate a deterministic fingerprint of vault contents (for sync verification) */
       fingerprint() {
         const names = Array.from(this.secrets.keys()).sort();
-        const hash = createHash4("sha256");
+        const hash = createHash5("sha256");
         for (const name10 of names) {
           hash.update(name10 + ":");
           hash.update(this.secrets.get(name10).value);
@@ -285023,7 +285556,7 @@ var init_secret_vault = __esm({
 // packages/cli/src/tui/p2p/peer-mesh.ts
 import { EventEmitter as EventEmitter6 } from "node:events";
 import { createServer as createServer5 } from "node:http";
-import { randomBytes as randomBytes18, createHash as createHash5, generateKeyPairSync } from "node:crypto";
+import { randomBytes as randomBytes19, createHash as createHash6, generateKeyPairSync } from "node:crypto";
 var PING_INTERVAL_MS, PEER_TIMEOUT_MS, GOSSIP_INTERVAL_MS, MAX_PEERS, PeerMesh;
 var init_peer_mesh = __esm({
   "packages/cli/src/tui/p2p/peer-mesh.ts"() {
@@ -285040,10 +285573,10 @@ var init_peer_mesh = __esm({
         const { publicKey: publicKey2, privateKey } = generateKeyPairSync("ed25519");
         this.publicKey = publicKey2.export({ type: "spki", format: "der" });
         this.privateKey = privateKey.export({ type: "pkcs8", format: "der" });
-        this.peerId = createHash5("sha256").update(this.publicKey).digest("base64url").slice(0, 22);
+        this.peerId = createHash6("sha256").update(this.publicKey).digest("base64url").slice(0, 22);
         this.capabilities = options2.capabilities;
         this.displayName = options2.displayName;
-        this._authKey = options2.authKey ?? randomBytes18(24).toString("base64url");
+        this._authKey = options2.authKey ?? randomBytes19(24).toString("base64url");
       }
       /** This node's unique peer ID (hash of public key) */
       peerId;
@@ -285236,7 +285769,7 @@ var init_peer_mesh = __esm({
         if (!ws || ws.readyState !== import_websocket5.default.OPEN) {
           throw new Error(`Peer ${peerId} not connected`);
         }
-        const msgId = randomBytes18(8).toString("hex");
+        const msgId = randomBytes19(8).toString("hex");
         return new Promise((resolve39, reject) => {
           const timeout2 = setTimeout(() => {
             this.pendingRequests.delete(msgId);
@@ -285452,7 +285985,7 @@ var init_peer_mesh = __esm({
         const msg = {
           type,
           from: this.peerId,
-          msgId: msgId ?? randomBytes18(8).toString("hex"),
+          msgId: msgId ?? randomBytes19(8).toString("hex"),
           ts: (/* @__PURE__ */ new Date()).toISOString(),
           payload
         };
@@ -289057,6 +289590,14 @@ var init_status_bar = __esm({
       _contentScrollOffset = 0;
       // 0 = live (bottom), >0 = scrolled back
       _contentMaxLines = 1e4;
+      // Partial-line accumulator for the buffered-write layer. Stream output
+      // arrives in chunks (one per syntax-highlighted token) and a single
+      // logical line can span many writes. If we naively push each chunk to
+      // _contentLines, scroll-back replay fragments the line across rows and
+      // "injects" extra newlines between pieces. Instead, everything up to the
+      // last \n goes into _contentLines (as complete lines), and the trailing
+      // partial stays in _inProgressLine until the next \n arrives.
+      _inProgressLine = "";
       /** Auto-scroll to live when new content arrives (disabled when user scrolls back) */
       _autoScroll = true;
       /** Cached click region for the spacer button */
@@ -290247,8 +290788,15 @@ var init_status_bar = __esm({
         const fh = this._currentFooterHeight;
         const footerStart = termRows() - fh + 1;
         if (row >= footerStart) return;
-        if (type === "press" || type === "drag") {
-          this.disableMouseTracking();
+        if (type === "press") {
+          this._textSelection.onMousePress(row, col);
+          this.repaintContent();
+        } else if (type === "drag") {
+          this._textSelection.onMouseDrag(row, col);
+          this.repaintContent();
+        } else if (type === "release") {
+          this._textSelection.onMouseRelease(row, col);
+          this.repaintContent();
         }
       }
       /** Copy current selection to clipboard. Returns true if copied. */
@@ -290590,11 +291138,21 @@ var init_status_bar = __esm({
             if (typeof chunk === "string") text = chunk;
             else if (Buffer.isBuffer(chunk)) text = chunk.toString();
             else text = String(chunk);
-            const lines = text.split("\n");
             if (self2._bufferContent && !isOverlayActive()) {
-              for (const line of lines) {
-                const visible = line.replace(/\x1B\[[0-9;]*[A-Za-z]/g, "");
-                if (visible.trim().length > 0) self2.bufferContentLine(line);
+              const combined = self2._inProgressLine + text;
+              const lastNl = combined.lastIndexOf("\n");
+              if (lastNl < 0) {
+                self2._inProgressLine = combined;
+              } else {
+                const completed = combined.slice(0, lastNl);
+                self2._inProgressLine = combined.slice(lastNl + 1);
+                const completeLines = completed.split("\n");
+                for (const line of completeLines) {
+                  const visible = line.replace(/\x1B\[[0-9;]*[A-Za-z]/g, "");
+                  if (line.length === 0 || visible.length > 0) {
+                    self2.bufferContentLine(line);
+                  }
+                }
               }
             }
             if (typeof chunk === "string") {
@@ -290627,6 +291185,11 @@ ${CONTENT_BG_SEQ}`);
         if (!this.active) return;
         this.writeDepth = Math.max(0, this.writeDepth - 1);
         if (this.writeDepth === 0) {
+          if (this._inProgressLine.length > 0) {
+            const visible = this._inProgressLine.replace(/\x1B\[[0-9;]*[A-Za-z]/g, "");
+            if (visible.length > 0) this.bufferContentLine(this._inProgressLine);
+            this._inProgressLine = "";
+          }
           this._bufferContent = false;
           if (this._origWrite) {
             try {
@@ -290783,12 +291346,19 @@ ${CONTENT_BG_SEQ}`);
         let buf = "\x1B[?2026h";
         buf += "\x1B7";
         buf += "\x1B[?25l";
+        const selRanges = this._textSelection.hasSelection ? this._textSelection.getSelectedRanges() : [];
+        const selByBufferIdx = /* @__PURE__ */ new Map();
+        for (const r2 of selRanges) selByBufferIdx.set(r2.bufferIdx, { startCol: r2.startCol, endCol: r2.endCol });
         for (let row = 0; row < h; row++) {
           const lineIdx = startIdx + row;
           let line = lineIdx < totalLines ? this._contentLines[lineIdx] : "";
           const screenRow = this.scrollRegionTop + row;
           if (screenRow < headerSafeFloor) continue;
           line = line.replace(/\x1B\[0m/g, `\x1B[0m${CONTENT_BG_SEQ}`);
+          const sel = selByBufferIdx.get(lineIdx);
+          if (sel) {
+            line = TextSelection.applyHighlight(line, sel.startCol, sel.endCol);
+          }
           buf += `\x1B[${screenRow};1H${CONTENT_BG_SEQ}\x1B[2K${line}`;
         }
         const L = layout();
@@ -314607,7 +315177,7 @@ var init_disk_task_output = __esm({
 });
 
 // packages/cli/src/api/http.ts
-import { createHash as createHash6 } from "node:crypto";
+import { createHash as createHash7 } from "node:crypto";
 function problemDetails(opts) {
   const p2 = {
     type: opts.type ?? "about:blank",
@@ -314670,7 +315240,7 @@ function paginated(items, page2, total) {
 }
 function computeEtag(payload) {
   const json = typeof payload === "string" ? payload : JSON.stringify(payload);
-  const hash = createHash6("sha1").update(json).digest("hex").slice(0, 16);
+  const hash = createHash7("sha1").update(json).digest("hex").slice(0, 16);
   return `W/"${hash}"`;
 }
 function checkNotModified(req2, res, etag) {
@@ -317237,11 +317807,11 @@ async function handleAimsIncidentPost(ctx3) {
       }));
       return true;
     }
-    const { randomBytes: randomBytes22 } = await import("node:crypto");
+    const { randomBytes: randomBytes23 } = await import("node:crypto");
     const record = await withAimsLock("incidents.json", () => {
       const existing = readAimsFile("incidents.json", []);
       const rec = {
-        id: `INC-${Date.now()}-${randomBytes22(4).toString("hex")}`,
+        id: `INC-${Date.now()}-${randomBytes23(4).toString("hex")}`,
         ts: (/* @__PURE__ */ new Date()).toISOString(),
         raised_by: user ?? "anonymous",
         status: "open",
@@ -321419,7 +321989,7 @@ var init_usage_tracker = __esm({
 import { existsSync as existsSync80, readFileSync as readFileSync63, writeFileSync as writeFileSync41, mkdirSync as mkdirSync48, readdirSync as readdirSync27, unlinkSync as unlinkSync21 } from "node:fs";
 import { join as join96 } from "node:path";
 import { homedir as homedir34 } from "node:os";
-import { createCipheriv as createCipheriv3, createDecipheriv as createDecipheriv3, randomBytes as randomBytes19, scryptSync as scryptSync3 } from "node:crypto";
+import { createCipheriv as createCipheriv4, createDecipheriv as createDecipheriv4, randomBytes as randomBytes20, scryptSync as scryptSync3 } from "node:crypto";
 function globalProfileDir() {
   return join96(homedir34(), ".open-agents", "profiles");
 }
@@ -321503,10 +322073,10 @@ function deleteProfile(name10, scope = "global", projectDir) {
   return false;
 }
 function encryptProfile(profile, password) {
-  const salt = randomBytes19(32);
+  const salt = randomBytes20(32);
   const key = scryptSync3(password, salt, 32);
-  const iv = randomBytes19(16);
-  const cipher = createCipheriv3("aes-256-gcm", key, iv);
+  const iv = randomBytes20(16);
+  const cipher = createCipheriv4("aes-256-gcm", key, iv);
   const plaintext = JSON.stringify(profile);
   const encrypted = Buffer.concat([cipher.update(plaintext, "utf8"), cipher.final()]);
   const tag = cipher.getAuthTag();
@@ -321525,7 +322095,7 @@ function decryptProfile(enc, password) {
     const salt = Buffer.from(enc.salt, "hex");
     const key = scryptSync3(password, salt, 32);
     const iv = Buffer.from(enc.iv, "hex");
-    const decipher = createDecipheriv3("aes-256-gcm", key, iv);
+    const decipher = createDecipheriv4("aes-256-gcm", key, iv);
     decipher.setAuthTag(Buffer.from(enc.tag, "hex"));
     const decrypted = Buffer.concat([
       decipher.update(Buffer.from(enc.data, "hex")),
@@ -321918,7 +322488,7 @@ import { dirname as dirname28, join as join98, resolve as resolve34 } from "node
 import { homedir as homedir36 } from "node:os";
 import { spawn as spawn25, execSync as execSync55 } from "node:child_process";
 import { mkdirSync as mkdirSync50, readFileSync as readFileSync64, readdirSync as readdirSync28, existsSync as existsSync82, watch as fsWatch3 } from "node:fs";
-import { randomBytes as randomBytes20, randomUUID as randomUUID11 } from "node:crypto";
+import { randomBytes as randomBytes21, randomUUID as randomUUID11 } from "node:crypto";
 function getVersion3() {
   try {
     const require3 = createRequire4(import.meta.url);
@@ -322781,7 +323351,7 @@ async function handleV1ChatCompletions(req2, res, ollamaUrl) {
       "Cache-Control": "no-cache",
       "Connection": "keep-alive"
     });
-    const chatId = `chatcmpl-${randomBytes20(12).toString("hex")}`;
+    const chatId = `chatcmpl-${randomBytes21(12).toString("hex")}`;
     let buffer2 = "";
     ollamaStream(
       targetUrl,
@@ -322891,7 +323461,7 @@ async function handleV1ChatCompletions(req2, res, ollamaUrl) {
       if (ollamaResp.eval_count) metrics.totalTokensOut += ollamaResp.eval_count;
       if (ollamaResp.prompt_eval_count) metrics.totalTokensIn += ollamaResp.prompt_eval_count;
       trackTokens("local", ollamaResp.prompt_eval_count ?? 0, ollamaResp.eval_count ?? 0);
-      const chatId = `chatcmpl-${randomBytes20(12).toString("hex")}`;
+      const chatId = `chatcmpl-${randomBytes21(12).toString("hex")}`;
       const responseMessage = {
         role: ollamaResp.message?.role ?? "assistant",
         content: ollamaResp.message?.content ?? ""
@@ -323623,7 +324193,7 @@ async function handleV1Run(req2, res) {
       return;
     }
   }
-  const id = `job-${randomBytes20(8).toString("hex")}`;
+  const id = `job-${randomBytes21(8).toString("hex")}`;
   const dir = jobsDir();
   const workingDir = requestBody["working_directory"] || req2.headers["x-working-directory"];
   const isolate = requestBody["isolate"] === true;
@@ -328626,7 +329196,17 @@ Rationale: ${proposal.rationale}${provenanceNote}`;
           statusBar.setNexusStatus("disconnected");
         }
       };
-      _tryNexusConnect(1);
+      _tryNexusConnect(1).catch((err) => {
+        try {
+          statusBar.setNexusStatus("disconnected");
+        } catch {
+        }
+        try {
+          const msg = err?.message || String(err);
+          writeContent(() => renderWarning(`Nexus startup: ${msg.slice(0, 160)}`));
+        } catch {
+        }
+      });
     } catch {
     }
     try {
@@ -330810,13 +331390,13 @@ ${fullInput}`;
       writeContent(() => renderError(errMsg));
       if (failureStore) {
         try {
-          const { createHash: createHash9 } = await import("node:crypto");
+          const { createHash: createHash10 } = await import("node:crypto");
           failureStore.insert({
             taskId: "",
             sessionId: `${Date.now()}`,
             repoRoot,
             failureType: "runtime-error",
-            fingerprint: createHash9("sha256").update(errMsg.slice(0, 200)).digest("hex").slice(0, 16),
+            fingerprint: createHash10("sha256").update(errMsg.slice(0, 200)).digest("hex").slice(0, 16),
             filePath: null,
             errorMessage: errMsg.slice(0, 500),
             context: null,
@@ -331444,7 +332024,7 @@ __export(run_exports, {
 import { resolve as resolve36 } from "node:path";
 import { spawn as spawn26 } from "node:child_process";
 import { mkdirSync as mkdirSync52, writeFileSync as writeFileSync45, readFileSync as readFileSync66, readdirSync as readdirSync30, existsSync as existsSync84 } from "node:fs";
-import { randomBytes as randomBytes21 } from "node:crypto";
+import { randomBytes as randomBytes22 } from "node:crypto";
 import { join as join100 } from "node:path";
 function jobsDir2(repoPath) {
   const root = resolve36(repoPath ?? process.cwd());
@@ -331539,7 +332119,7 @@ function extractSummary(captured) {
   return lines.slice(-3).join(" ").slice(0, 200);
 }
 async function runBackground(task, config, opts) {
-  const id = `job-${randomBytes21(3).toString("hex")}`;
+  const id = `job-${randomBytes22(3).toString("hex")}`;
   const dir = jobsDir2(opts.repoPath);
   const repoRoot = resolve36(opts.repoPath ?? process.cwd());
   const job = {
@@ -331648,7 +332228,7 @@ var init_run = __esm({
 import { glob as glob2 } from "glob";
 import ignore from "ignore";
 import { readFile as readFile23, stat as stat5 } from "node:fs/promises";
-import { createHash as createHash8 } from "node:crypto";
+import { createHash as createHash9 } from "node:crypto";
 import { join as join101, relative as relative5, extname as extname12, basename as basename18 } from "node:path";
 var DEFAULT_EXCLUDE, LANGUAGE_MAP, CodebaseIndexer;
 var init_codebase_indexer = __esm({
@@ -331714,7 +332294,7 @@ var init_codebase_indexer = __esm({
             if (fileStat.size > this.config.maxFileSize)
               continue;
             const content = await readFile23(fullPath);
-            const hash = createHash8("sha256").update(content).digest("hex");
+            const hash = createHash9("sha256").update(content).digest("hex");
             const ext = extname12(relativePath);
             indexed.push({
               path: fullPath,