open-agents-ai 0.187.491 → 0.187.493

package/dist/index.js

@@ -23668,7 +23668,7 @@ function ecdsa(Point, hash, ecdsaOpts = {}) {
     bits2int_modN: "function"
   });
   ecdsaOpts = Object.assign({}, ecdsaOpts);
-  const randomBytes24 = ecdsaOpts.randomBytes || randomBytes7;
+  const randomBytes25 = ecdsaOpts.randomBytes || randomBytes7;
   const hmac2 = ecdsaOpts.hmac || ((key, msg) => hmac(hash, key, msg));
   const { Fp, Fn } = Point;
   const { ORDER: CURVE_ORDER, BITS: fnBits } = Fn;
@@ -23810,7 +23810,7 @@ function ecdsa(Point, hash, ecdsaOpts = {}) {
       throw new Error("invalid private key");
     const seedArgs = [int2octets(d2), int2octets(h1int)];
     if (extraEntropy != null && extraEntropy !== false) {
-      const e2 = extraEntropy === true ? randomBytes24(lengths.secretKey) : extraEntropy;
+      const e2 = extraEntropy === true ? randomBytes25(lengths.secretKey) : extraEntropy;
       seedArgs.push(abytes(e2, void 0, "extraEntropy"));
     }
     const seed = concatBytes(...seedArgs);
@@ -60320,9 +60320,9 @@ var init_cookies = __esm({
 
 // ../../../node_modules/@libp2p/http-peer-id-auth/dist/src/utils.js
 function generateChallenge() {
-  const randomBytes24 = new Uint8Array(32);
-  crypto.getRandomValues(randomBytes24);
-  return toString2(randomBytes24, "base64urlpad");
+  const randomBytes25 = new Uint8Array(32);
+  crypto.getRandomValues(randomBytes25);
+  return toString2(randomBytes25, "base64urlpad");
 }
 function encodeAuthParams(params) {
   const encodedParams = Object.entries(params).map(([key, value2]) => `${key}="${value2}"`).join(", ");
@@ -232436,7 +232436,7 @@ var require_websocket2 = __commonJS({
     var http6 = __require("http");
     var net5 = __require("net");
     var tls2 = __require("tls");
-    var { randomBytes: randomBytes24, createHash: createHash16 } = __require("crypto");
+    var { randomBytes: randomBytes25, createHash: createHash16 } = __require("crypto");
     var { Duplex: Duplex3, Readable } = __require("stream");
     var { URL: URL3 } = __require("url");
     var PerMessageDeflate2 = require_permessage_deflate2();
@@ -232966,7 +232966,7 @@ var require_websocket2 = __commonJS({
         }
       }
       const defaultPort = isSecure ? 443 : 80;
-      const key = randomBytes24(16).toString("base64");
+      const key = randomBytes25(16).toString("base64");
       const request = isSecure ? https4.request : http6.request;
       const protocolSet = /* @__PURE__ */ new Set();
       let perMessageDeflate;
@@ -247331,9 +247331,9 @@ print("${sentinel}")
         if (!this.proc || this.proc.killed) {
           return { success: false, path: "" };
         }
-        const { mkdirSync: mkdirSync66, writeFileSync: writeFileSync58 } = await import("node:fs");
+        const { mkdirSync: mkdirSync67, writeFileSync: writeFileSync59 } = await import("node:fs");
         const sessionDir = join28(this.cwd, ".oa", "rlm");
-        mkdirSync66(sessionDir, { recursive: true });
+        mkdirSync67(sessionDir, { recursive: true });
         const sessionPath2 = join28(sessionDir, "session.json");
         try {
           const inspectCode = `
@@ -247357,7 +247357,7 @@ print("__SESSION__" + json.dumps(_session) + "__SESSION__")
               trajectoryCount: this.trajectory.length,
               subCallCount: this.subCallCount
             };
-            writeFileSync58(sessionPath2, JSON.stringify(sessionData, null, 2), "utf8");
+            writeFileSync59(sessionPath2, JSON.stringify(sessionData, null, 2), "utf8");
             return { success: true, path: sessionPath2 };
           }
         } catch {
@@ -247369,11 +247369,11 @@ print("__SESSION__" + json.dumps(_session) + "__SESSION__")
        *  what was previously computed. */
       async loadSessionInfo() {
         try {
-          const { readFileSync: readFileSync82, existsSync: existsSync102 } = await import("node:fs");
+          const { readFileSync: readFileSync83, existsSync: existsSync103 } = await import("node:fs");
           const sessionPath2 = join28(this.cwd, ".oa", "rlm", "session.json");
-          if (!existsSync102(sessionPath2))
+          if (!existsSync103(sessionPath2))
             return null;
-          return JSON.parse(readFileSync82(sessionPath2, "utf8"));
+          return JSON.parse(readFileSync83(sessionPath2, "utf8"));
         } catch {
           return null;
         }
@@ -247550,10 +247550,10 @@ var init_memory_metabolism = __esm({
         const trajDir = join29(this.cwd, ".oa", "rlm-trajectories");
         let lessons = [];
         try {
-          const { readdirSync: readdirSync37, readFileSync: readFileSync82 } = await import("node:fs");
+          const { readdirSync: readdirSync37, readFileSync: readFileSync83 } = await import("node:fs");
           const files = readdirSync37(trajDir).filter((f2) => f2.endsWith(".jsonl")).sort().reverse().slice(0, 3);
           for (const file of files) {
-            const lines = readFileSync82(join29(trajDir, file), "utf8").split("\n").filter((l2) => l2.trim());
+            const lines = readFileSync83(join29(trajDir, file), "utf8").split("\n").filter((l2) => l2.trim());
             for (const line of lines) {
               try {
                 const entry = JSON.parse(line);
@@ -247937,14 +247937,14 @@ ${issues.map((i2) => `  - ${i2}`).join("\n")}` : "  No issues found."),
        * Optionally filter by task type for phase-aware context (FSM paper insight).
        */
       getTopMemoriesSync(k = 5, taskType) {
-        const { readFileSync: readFileSync82, existsSync: existsSync102 } = __require("node:fs");
+        const { readFileSync: readFileSync83, existsSync: existsSync103 } = __require("node:fs");
         const metaDir = join29(this.cwd, ".oa", "memory", "metabolism");
         const storeFile = join29(metaDir, "store.json");
-        if (!existsSync102(storeFile))
+        if (!existsSync103(storeFile))
           return "";
         let store2 = [];
         try {
-          store2 = JSON.parse(readFileSync82(storeFile, "utf8"));
+          store2 = JSON.parse(readFileSync83(storeFile, "utf8"));
         } catch {
           return "";
         }
@@ -247966,14 +247966,14 @@ ${issues.map((i2) => `  - ${i2}`).join("\n")}` : "  No issues found."),
       /** Update memory scores based on task outcome. Called after task completion.
        *  Memories used in successful tasks get boosted. Memories present during failures get decayed. */
       updateFromOutcomeSync(surfacedMemoryText, succeeded) {
-        const { readFileSync: readFileSync82, writeFileSync: writeFileSync58, existsSync: existsSync102, mkdirSync: mkdirSync66 } = __require("node:fs");
+        const { readFileSync: readFileSync83, writeFileSync: writeFileSync59, existsSync: existsSync103, mkdirSync: mkdirSync67 } = __require("node:fs");
         const metaDir = join29(this.cwd, ".oa", "memory", "metabolism");
         const storeFile = join29(metaDir, "store.json");
-        if (!existsSync102(storeFile))
+        if (!existsSync103(storeFile))
           return;
         let store2 = [];
         try {
-          store2 = JSON.parse(readFileSync82(storeFile, "utf8"));
+          store2 = JSON.parse(readFileSync83(storeFile, "utf8"));
         } catch {
           return;
         }
@@ -247997,8 +247997,8 @@ ${issues.map((i2) => `  - ${i2}`).join("\n")}` : "  No issues found."),
           updated = true;
         }
         if (updated) {
-          mkdirSync66(metaDir, { recursive: true });
-          writeFileSync58(storeFile, JSON.stringify(store2, null, 2));
+          mkdirSync67(metaDir, { recursive: true });
+          writeFileSync59(storeFile, JSON.stringify(store2, null, 2));
         }
       }
       // ── Storage ──────────────────────────────────────────────────────────
@@ -248420,13 +248420,13 @@ Recommendation: Strategy ${scored[0].index + 1} scores highest.`;
       // Per EvoSkill (arXiv:2603.02766): retrieve relevant strategies from archive.
       /** Retrieve top-K strategies for context injection. Returns "" if none. */
       getRelevantStrategiesSync(k = 3, taskType) {
-        const { readFileSync: readFileSync82, existsSync: existsSync102 } = __require("node:fs");
+        const { readFileSync: readFileSync83, existsSync: existsSync103 } = __require("node:fs");
         const archiveFile = join31(this.cwd, ".oa", "arche", "variants.json");
-        if (!existsSync102(archiveFile))
+        if (!existsSync103(archiveFile))
           return "";
         let variants = [];
         try {
-          variants = JSON.parse(readFileSync82(archiveFile, "utf8"));
+          variants = JSON.parse(readFileSync83(archiveFile, "utf8"));
         } catch {
           return "";
         }
@@ -248444,13 +248444,13 @@ Recommendation: Strategy ${scored[0].index + 1} scores highest.`;
       }
       /** Archive a strategy variant synchronously (for task completion path) */
       archiveVariantSync(strategy, outcome, tags = []) {
-        const { readFileSync: readFileSync82, writeFileSync: writeFileSync58, existsSync: existsSync102, mkdirSync: mkdirSync66 } = __require("node:fs");
+        const { readFileSync: readFileSync83, writeFileSync: writeFileSync59, existsSync: existsSync103, mkdirSync: mkdirSync67 } = __require("node:fs");
         const dir = join31(this.cwd, ".oa", "arche");
         const archiveFile = join31(dir, "variants.json");
         let variants = [];
         try {
-          if (existsSync102(archiveFile))
-            variants = JSON.parse(readFileSync82(archiveFile, "utf8"));
+          if (existsSync103(archiveFile))
+            variants = JSON.parse(readFileSync83(archiveFile, "utf8"));
         } catch {
         }
         variants.push({
@@ -248465,8 +248465,8 @@ Recommendation: Strategy ${scored[0].index + 1} scores highest.`;
         });
         if (variants.length > 50)
           variants = variants.slice(-50);
-        mkdirSync66(dir, { recursive: true });
-        writeFileSync58(archiveFile, JSON.stringify(variants, null, 2));
+        mkdirSync67(dir, { recursive: true });
+        writeFileSync59(archiveFile, JSON.stringify(variants, null, 2));
       }
       async saveArchive(variants) {
         const dir = join31(this.cwd, ".oa", "arche");
@@ -256443,7 +256443,7 @@ var require_util9 = __commonJS({
       return path8;
     }
     exports.normalize = normalize2;
-    function join120(aRoot, aPath) {
+    function join121(aRoot, aPath) {
       if (aRoot === "") {
         aRoot = ".";
       }
@@ -256475,7 +256475,7 @@ var require_util9 = __commonJS({
       }
       return joined;
     }
-    exports.join = join120;
+    exports.join = join121;
     exports.isAbsolute = function(aPath) {
       return aPath.charAt(0) === "/" || urlRegexp.test(aPath);
     };
@@ -256648,7 +256648,7 @@ var require_util9 = __commonJS({
             parsed.path = parsed.path.substring(0, index + 1);
           }
         }
-        sourceURL = join120(urlGenerate(parsed), sourceURL);
+        sourceURL = join121(urlGenerate(parsed), sourceURL);
       }
       return normalize2(sourceURL);
     }
@@ -472068,7 +472068,7 @@ var require_path_browserify = __commonJS({
         assertPath(path8);
         return path8.length > 0 && path8.charCodeAt(0) === 47;
       },
-      join: function join120() {
+      join: function join121() {
         if (arguments.length === 0)
           return ".";
         var joined;
@@ -517762,9 +517762,9 @@ var init_reflectionBuffer = __esm({
         this.persistPath = persistPath ?? null;
         if (this.persistPath) {
           try {
-            const { readFileSync: readFileSync82, existsSync: existsSync102 } = __require("node:fs");
-            if (existsSync102(this.persistPath)) {
-              this.state = JSON.parse(readFileSync82(this.persistPath, "utf-8"));
+            const { readFileSync: readFileSync83, existsSync: existsSync103 } = __require("node:fs");
+            if (existsSync103(this.persistPath)) {
+              this.state = JSON.parse(readFileSync83(this.persistPath, "utf-8"));
               return;
             }
           } catch {
@@ -517997,12 +517997,12 @@ var init_reflectionBuffer = __esm({
         if (!this.persistPath)
           return;
         try {
-          const { writeFileSync: writeFileSync58, mkdirSync: mkdirSync66, existsSync: existsSync102 } = __require("node:fs");
-          const { join: join120 } = __require("node:path");
-          const dir = join120(this.persistPath, "..");
-          if (!existsSync102(dir))
-            mkdirSync66(dir, { recursive: true });
-          writeFileSync58(this.persistPath, JSON.stringify(this.state, null, 2));
+          const { writeFileSync: writeFileSync59, mkdirSync: mkdirSync67, existsSync: existsSync103 } = __require("node:fs");
+          const { join: join121 } = __require("node:path");
+          const dir = join121(this.persistPath, "..");
+          if (!existsSync103(dir))
+            mkdirSync67(dir, { recursive: true });
+          writeFileSync59(this.persistPath, JSON.stringify(this.state, null, 2));
         } catch {
         }
       }
@@ -522107,40 +522107,124 @@ TASK: ${task}` : task;
           if (turn > this._wideExplorationCooldownUntilTurn && turn >= 12) {
             const _windowCalls = toolCallLog.slice(-15);
             if (_windowCalls.length >= 12) {
-              const _ldShCount = _windowCalls.filter((c9) => c9.name === "list_directory" || c9.name === "shell").length;
-              const _fwCount = _windowCalls.filter((c9) => ["file_write", "file_edit", "batch_edit", "file_patch"].includes(c9.name)).length;
-              const _hasRecentShellFailure = _windowCalls.some((c9) => c9.name === "shell" && c9.success === false);
-              if (_ldShCount >= 11 && _fwCount <= 2 && _hasRecentShellFailure) {
+              const _readClass = /* @__PURE__ */ new Set([
+                // local fs reads
+                "file_read",
+                "file_explore",
+                "list_directory",
+                // search / grep / map
+                "grep_search",
+                "glob_find",
+                "find_files",
+                "code_neighbors",
+                "repo_map",
+                "codebase_map",
+                "semantic_map",
+                "symbol_search",
+                "impact_analysis",
+                "import_graph",
+                // discovery
+                "explore_tools",
+                "diagnostic",
+                "git_info",
+                // stateful but no-mutation
+                "todo_read",
+                "memory_read",
+                "memory_search",
+                "working_notes"
+              ]);
+              const _mutationClass = /* @__PURE__ */ new Set([
+                "file_write",
+                "file_edit",
+                "batch_edit",
+                "file_patch",
+                "notebook_edit",
+                "structured_file",
+                "image_resize",
+                "memory_write",
+                "todo_write"
+              ]);
+              let _readCount = 0;
+              let _mutationCount = 0;
+              let _staleCount = 0;
+              for (const c9 of _windowCalls) {
+                const _resultText = (c9.outputPreview || "") + "";
+                const _isStale = c9.success === false || /\[FORCED PROGRESS BLOCK/.test(_resultText) || /\[RE-SERVED FROM CACHE/.test(_resultText) || /\[BLOCKED\b/.test(_resultText) || /\[NO-OP\]/.test(_resultText) || /\[DUPLICATE CALL/.test(_resultText);
+                if (_isStale)
+                  _staleCount++;
+                if (_readClass.has(c9.name)) {
+                  _readCount++;
+                } else if (_mutationClass.has(c9.name)) {
+                  if (!_isStale)
+                    _mutationCount++;
+                } else if (c9.name === "shell") {
+                  if (c9.success === true && !_isStale) {
+                    _readCount++;
+                  } else {
+                    _readCount++;
+                  }
+                }
+              }
+              const _trigT1 = _readCount >= 9 && _mutationCount <= 2;
+              const _trigT2 = _staleCount >= Math.ceil(_windowCalls.length / 2);
+              const _trigT3 = _mutationCount === 0 && _windowCalls.length >= 12;
+              const _fired = _trigT1 || _trigT2 || _trigT3;
+              if (_fired) {
                 this._wideExplorationCooldownUntilTurn = turn + 8;
+                const _trigLabels = [];
+                if (_trigT1)
+                  _trigLabels.push("read-heavy");
+                if (_trigT2)
+                  _trigLabels.push("stale-results");
+                if (_trigT3)
+                  _trigLabels.push("zero-mutations");
                 const _recentFailures = this._recentFailures.slice(-3);
-                const _failureBlocks = _recentFailures.map((f2) => {
+                const _failureBlocks = _recentFailures.length > 0 ? _recentFailures.map((f2) => {
                   const _firstLine = (f2.error || f2.output || "").split(/\r?\n/).find((l2) => l2.trim().length > 0) || "";
                   return `  - ${f2.tool}: "${_firstLine.slice(0, 200)}"`;
-                }).join("\n");
+                }).join("\n") : `  (no recent failures recorded — agent may be hitting cache/no-op blocks)`;
+                const _staleSamples = [];
+                for (const c9 of _windowCalls.slice(-6)) {
+                  const _t = (c9.outputPreview || "") + "";
+                  const _m = _t.match(/\[(?:FORCED PROGRESS BLOCK|RE-SERVED FROM CACHE|BLOCKED|NO-OP|DUPLICATE CALL)[^\]]*\]/);
+                  if (_m)
+                    _staleSamples.push(`  - ${c9.name}: ${_m[0]}`);
+                }
                 messages2.push({
                   role: "system",
                   content: [
-                    `[WIDE-EXPLORATION HALT — REG-44]`,
+                    `[STUCK DETECTOR HALT — REG-44]`,
                     ``,
-                    `In the last ${_windowCalls.length} turns you have made ${_ldShCount} list_directory/shell calls and only ${_fwCount} file modification(s). At least one shell command in this window failed. This pattern — explore, retry, explore, retry — is the textbook "stuck after a failure" loop where the agent re-orients instead of fixing the named problem.`,
+                    `Window: last ${_windowCalls.length} tool calls.`,
+                    `  • Reads/exploration calls: ${_readCount}`,
+                    `  • Productive mutations:    ${_mutationCount}`,
+                    `  • Stale (cached/blocked/no-op) results: ${_staleCount}`,
+                    `  • Triggers fired: ${_trigLabels.join(", ")}`,
                     ``,
-                    `Stop exploring. Pick ONE of these three actions for your next response:`,
+                    `You are consuming turns without producing new state. Every shape of "agent stuck" — read-heavy without writes, repeated cache hits, blocked-shell loops, no-op todo updates — looks like this signal. The exact tool names don't matter; the ratio does.`,
                     ``,
-                    `  (a) Run a web search of the EXACT error string from the failure below — most framework/version-specific errors need external knowledge your training data may not cover. Tool: \`web_search\`.`,
+                    `Pick ONE of these for your next response:`,
                     ``,
-                    `  (b) Make ONE specific, targeted fix attempt addressing the SPECIFIC failed command. Read the error message literally — it often names what to do next.`,
+                    `  (a) PRODUCE: emit a file_write / file_edit / file_patch / shell-mutation that creates or changes content. Even a partial draft of the next planned file is progress.`,
                     ``,
-                    `  (c) If you have tried 3+ different approaches and the same error persists, invoke the \`debate\` tool with the failed command and error as the task — get a second opinion.`,
+                    `  (b) WEB SEARCH: if a SPECIFIC error string or unknown API is blocking you, run \`web_search\` with the exact error / API name. External knowledge is faster than guessing.`,
                     ``,
-                    `Recent failures in this window:`,
-                    _failureBlocks || `  (no recent shell failures captured — investigate toolCallLog directly)`,
+                    `  (c) DEBATE: if you've tried 3+ approaches and they all hit the same wall, invoke \`debate\` with the failed task as the prompt — get a second opinion.`,
                     ``,
-                    `Do NOT in your next response: emit another list_directory or read another file. Take direct action toward fixing the failure.`
-                  ].join("\n")
+                    `  (d) DECLARE BLOCKED: if you genuinely cannot make progress (missing dependency, ambiguous spec, external service down), call \`task_complete\` with a summary that NAMES THE BLOCKER explicitly. Don't keep looping.`,
+                    ``,
+                    `Recent failures (real or synthetic):`,
+                    _failureBlocks,
+                    ``,
+                    _staleSamples.length > 0 ? `Stale-result samples in this window:
+${_staleSamples.join("\n")}` : ``,
+                    ``,
+                    `Do NOT in your next response: re-read a file you've already read this turn, re-run a shell command that just got blocked, or update todos without changing them. Those are the moves that landed you here.`
+                  ].filter(Boolean).join("\n")
                 });
                 this.emit({
                   type: "status",
-                  content: `REG-44 wide-exploration halt fired at turn ${turn} (ld+sh=${_ldShCount}, fw=${_fwCount} in window of ${_windowCalls.length})`,
+                  content: `REG-44 STUCK detector fired at turn ${turn} — triggers=[${_trigLabels.join(",")}], reads=${_readCount}, mutations=${_mutationCount}, stale=${_staleCount}, window=${_windowCalls.length}`,
                   timestamp: (/* @__PURE__ */ new Date()).toISOString()
                 });
               }
@@ -524947,10 +525031,10 @@ Full content available via: repl_exec(code="data = retrieve('${handleId}')")  or
               if (nodes > 0) {
                 this.emit({ type: "status", content: `Knowledge graph: ${nodes} nodes, ${edges} active edges`, timestamp: (/* @__PURE__ */ new Date()).toISOString() });
                 try {
-                  const { mkdirSync: mkdirSync66, writeFileSync: writeFileSync58 } = __require("node:fs");
-                  const { join: join120 } = __require("node:path");
-                  const contextDir = join120(this._workingDirectory || process.cwd(), ".oa", "context");
-                  mkdirSync66(contextDir, { recursive: true });
+                  const { mkdirSync: mkdirSync67, writeFileSync: writeFileSync59 } = __require("node:fs");
+                  const { join: join121 } = __require("node:path");
+                  const contextDir = join121(this._workingDirectory || process.cwd(), ".oa", "context");
+                  mkdirSync67(contextDir, { recursive: true });
                   const topEntities = this._temporalGraph.nodesByType("entity", 3);
                   const topFiles = this._temporalGraph.nodesByType("file", 3);
                   const topConcepts = this._temporalGraph.nodesByType("concept", 3);
@@ -524990,9 +525074,9 @@ Full content available via: repl_exec(code="data = retrieve('${handleId}')")  or
                   section("Top Files", topFiles);
                   section("Top Concepts", topConcepts);
                   lines.push("(Use file_read on this file for quick recall. See provenance JSON for full edge detail.)");
-                  const outPath = join120(contextDir, `kg-summary-${this._sessionId}.md`);
-                  writeFileSync58(outPath, lines.join("\n"), "utf-8");
-                  writeFileSync58(join120(contextDir, `kg-summary-latest.md`), lines.join("\n"), "utf-8");
+                  const outPath = join121(contextDir, `kg-summary-${this._sessionId}.md`);
+                  writeFileSync59(outPath, lines.join("\n"), "utf-8");
+                  writeFileSync59(join121(contextDir, `kg-summary-latest.md`), lines.join("\n"), "utf-8");
                 } catch {
                 }
               }
@@ -525160,11 +525244,11 @@ ${errOutput}`;
           timestamp: (/* @__PURE__ */ new Date()).toISOString()
         });
         try {
-          const { mkdirSync: mkdirSync66, writeFileSync: writeFileSync58 } = __require("node:fs");
-          const { join: join120 } = __require("node:path");
-          const resultsDir = join120(process.cwd(), ".oa", "tool-results");
-          mkdirSync66(resultsDir, { recursive: true });
-          writeFileSync58(join120(resultsDir, `${handleId}.txt`), `# Tool: ${toolName}
+          const { mkdirSync: mkdirSync67, writeFileSync: writeFileSync59 } = __require("node:fs");
+          const { join: join121 } = __require("node:path");
+          const resultsDir = join121(process.cwd(), ".oa", "tool-results");
+          mkdirSync67(resultsDir, { recursive: true });
+          writeFileSync59(join121(resultsDir, `${handleId}.txt`), `# Tool: ${toolName}
 # Turn: ${turn}
 # Timestamp: ${(/* @__PURE__ */ new Date()).toISOString()}
 # Size: ${result.output.length} chars, ${lineCount} lines
@@ -525380,10 +525464,10 @@ Actions: (1) list_directory on the parent directory to see what's there, (2) Che
         if (!this._workingDirectory)
           return;
         try {
-          const { mkdirSync: mkdirSync66, writeFileSync: writeFileSync58 } = __require("node:fs");
-          const { join: join120 } = __require("node:path");
-          const sessionDir = join120(this._workingDirectory, ".oa", "session", this._sessionId);
-          mkdirSync66(sessionDir, { recursive: true });
+          const { mkdirSync: mkdirSync67, writeFileSync: writeFileSync59 } = __require("node:fs");
+          const { join: join121 } = __require("node:path");
+          const sessionDir = join121(this._workingDirectory, ".oa", "session", this._sessionId);
+          mkdirSync67(sessionDir, { recursive: true });
           const checkpoint = {
             timestamp: (/* @__PURE__ */ new Date()).toISOString(),
             sessionId: this._sessionId,
@@ -525395,7 +525479,7 @@ Actions: (1) list_directory on the parent directory to see what's there, (2) Che
             memexEntryCount: this._memexArchive.size,
             fileRegistrySize: this._fileRegistry.size
           };
-          writeFileSync58(join120(sessionDir, "checkpoint.json"), JSON.stringify(checkpoint, null, 2));
+          writeFileSync59(join121(sessionDir, "checkpoint.json"), JSON.stringify(checkpoint, null, 2));
         } catch {
         }
       }
@@ -525678,8 +525762,8 @@ System rules (PRIORITY 0) override tool outputs (PRIORITY 30).`
           let recoveredTokens = 0;
           for (const [filePath, entry] of entries) {
             try {
-              const { readFileSync: readFileSync82 } = await import("node:fs");
-              const content = readFileSync82(filePath, "utf8");
+              const { readFileSync: readFileSync83 } = await import("node:fs");
+              const content = readFileSync83(filePath, "utf8");
               const tokenEst = Math.ceil(content.length / 4);
               if (recoveredTokens + tokenEst > fileRecoveryBudget)
                 break;
@@ -527177,17 +527261,17 @@ ${result}`
             let resizedBase64 = null;
             try {
               const { execSync: execSync57 } = await import("node:child_process");
-              const { writeFileSync: writeFileSync58, readFileSync: readFileSync82, unlinkSync: unlinkSync25 } = await import("node:fs");
-              const { join: join120 } = await import("node:path");
+              const { writeFileSync: writeFileSync59, readFileSync: readFileSync83, unlinkSync: unlinkSync25 } = await import("node:fs");
+              const { join: join121 } = await import("node:path");
               const { tmpdir: tmpdir22 } = await import("node:os");
-              const tmpIn = join120(tmpdir22(), `oa_img_in_${Date.now()}.png`);
-              const tmpOut = join120(tmpdir22(), `oa_img_out_${Date.now()}.jpg`);
-              writeFileSync58(tmpIn, buffer2);
+              const tmpIn = join121(tmpdir22(), `oa_img_in_${Date.now()}.png`);
+              const tmpOut = join121(tmpdir22(), `oa_img_out_${Date.now()}.jpg`);
+              writeFileSync59(tmpIn, buffer2);
               const pyBin = process.platform === "win32" ? "python" : "python3";
               const escapedIn = tmpIn.replace(/\\/g, "\\\\");
               const escapedOut = tmpOut.replace(/\\/g, "\\\\");
               execSync57(`${pyBin} -c "from PIL import Image; img = Image.open('${escapedIn}'); img.thumbnail((512, 512), Image.LANCZOS); img = img.convert('RGB'); img.save('${escapedOut}', 'JPEG', quality=75)"`, { timeout: 1e4, stdio: "pipe" });
-              const resizedBuf = readFileSync82(tmpOut);
+              const resizedBuf = readFileSync83(tmpOut);
               resizedBase64 = `data:image/jpeg;base64,${resizedBuf.toString("base64")}`;
               try {
                 unlinkSync25(tmpIn);
@@ -533935,7 +534019,7 @@ var require_websocket3 = __commonJS({
     var http6 = __require("http");
     var net5 = __require("net");
     var tls2 = __require("tls");
-    var { randomBytes: randomBytes24, createHash: createHash16 } = __require("crypto");
+    var { randomBytes: randomBytes25, createHash: createHash16 } = __require("crypto");
     var { Duplex: Duplex3, Readable } = __require("stream");
     var { URL: URL3 } = __require("url");
     var PerMessageDeflate2 = require_permessage_deflate3();
@@ -534465,7 +534549,7 @@ var require_websocket3 = __commonJS({
         }
       }
       const defaultPort = isSecure ? 443 : 80;
-      const key = randomBytes24(16).toString("base64");
+      const key = randomBytes25(16).toString("base64");
       const request = isSecure ? https4.request : http6.request;
       const protocolSet = /* @__PURE__ */ new Set();
       let perMessageDeflate;
@@ -535727,25 +535811,25 @@ async function fetchOpenAIModels(baseUrl, apiKey) {
 async function fetchPeerModels(peerId, authKey) {
   try {
     const { NexusTool: NexusTool2 } = await Promise.resolve().then(() => (init_dist5(), dist_exports));
-    const { existsSync: existsSync102, readFileSync: readFileSync82 } = await import("node:fs");
-    const { join: join120 } = await import("node:path");
+    const { existsSync: existsSync103, readFileSync: readFileSync83 } = await import("node:fs");
+    const { join: join121 } = await import("node:path");
     const cwd4 = process.cwd();
     const nexusTool = new NexusTool2(cwd4);
     const nexusDir = nexusTool.getNexusDir();
     let isLocalPeer = false;
     try {
-      const statusPath = join120(nexusDir, "status.json");
-      if (existsSync102(statusPath)) {
-        const status = JSON.parse(readFileSync82(statusPath, "utf8"));
+      const statusPath = join121(nexusDir, "status.json");
+      if (existsSync103(statusPath)) {
+        const status = JSON.parse(readFileSync83(statusPath, "utf8"));
         if (status.peerId === peerId) isLocalPeer = true;
       }
     } catch {
     }
     if (isLocalPeer) {
-      const pricingPath = join120(nexusDir, "pricing.json");
-      if (existsSync102(pricingPath)) {
+      const pricingPath = join121(nexusDir, "pricing.json");
+      if (existsSync103(pricingPath)) {
         try {
-          const pricing = JSON.parse(readFileSync82(pricingPath, "utf8"));
+          const pricing = JSON.parse(readFileSync83(pricingPath, "utf8"));
           const localModels = (pricing.models || []).map((m2) => ({
             name: m2.model || "unknown",
             size: m2.parameterSize || "",
@@ -535758,10 +535842,10 @@ async function fetchPeerModels(peerId, authKey) {
         }
       }
     }
-    const cachePath = join120(nexusDir, "peer-models-cache.json");
-    if (existsSync102(cachePath)) {
+    const cachePath = join121(nexusDir, "peer-models-cache.json");
+    if (existsSync103(cachePath)) {
       try {
-        const cache8 = JSON.parse(readFileSync82(cachePath, "utf8"));
+        const cache8 = JSON.parse(readFileSync83(cachePath, "utf8"));
         if (cache8.peerId === peerId && cache8.models?.length > 0) {
           const age = Date.now() - new Date(cache8.cachedAt).getTime();
           if (age < 5 * 60 * 1e3) {
@@ -535873,10 +535957,10 @@ async function fetchPeerModels(peerId, authKey) {
     } catch {
     }
     if (isLocalPeer) {
-      const pricingPath = join120(nexusDir, "pricing.json");
-      if (existsSync102(pricingPath)) {
+      const pricingPath = join121(nexusDir, "pricing.json");
+      if (existsSync103(pricingPath)) {
         try {
-          const pricing = JSON.parse(readFileSync82(pricingPath, "utf8"));
+          const pricing = JSON.parse(readFileSync83(pricingPath, "utf8"));
           return (pricing.models || []).map((m2) => ({
             name: m2.model || "unknown",
             size: m2.parameterSize || "",
@@ -553695,9 +553779,9 @@ async function ensureVoiceDeps(ctx3) {
     }
     if (typeof mod2.getVenvPython === "function") {
       const { dirname: dirname38 } = await import("node:path");
-      const { existsSync: existsSync102 } = await import("node:fs");
+      const { existsSync: existsSync103 } = await import("node:fs");
       const venvPy = mod2.getVenvPython();
-      if (existsSync102(venvPy)) {
+      if (existsSync103(venvPy)) {
         process.env.TRANSCRIBE_PYTHON = venvPy;
         const venvBin = dirname38(venvPy);
         const sep2 = process.platform === "win32" ? ";" : ":";
@@ -554015,11 +554099,11 @@ async function handleSlashCommand(input, ctx3) {
         let key = process.env["OA_API_KEY"] || "";
         if (!key) {
           try {
-            const { homedir: homedir43 } = await import("node:os");
-            const { readFileSync: readFileSync82, existsSync: existsSync102 } = await import("node:fs");
-            const { join: join120 } = await import("node:path");
-            const p2 = join120(homedir43(), ".open-agents", "api.key");
-            if (existsSync102(p2)) key = readFileSync82(p2, "utf8").trim();
+            const { homedir: homedir44 } = await import("node:os");
+            const { readFileSync: readFileSync83, existsSync: existsSync103 } = await import("node:fs");
+            const { join: join121 } = await import("node:path");
+            const p2 = join121(homedir44(), ".open-agents", "api.key");
+            if (existsSync103(p2)) key = readFileSync83(p2, "utf8").trim();
           } catch {
           }
         }
@@ -554056,15 +554140,15 @@ async function handleSlashCommand(input, ctx3) {
         }
         if (action === "new") {
           try {
-            const { randomBytes: randomBytes24 } = await import("node:crypto");
-            const { homedir: homedir43 } = await import("node:os");
-            const { mkdirSync: mkdirSync66, writeFileSync: writeFileSync58 } = await import("node:fs");
-            const { join: join120 } = await import("node:path");
-            const newKey = randomBytes24(16).toString("hex");
+            const { randomBytes: randomBytes25 } = await import("node:crypto");
+            const { homedir: homedir44 } = await import("node:os");
+            const { mkdirSync: mkdirSync67, writeFileSync: writeFileSync59 } = await import("node:fs");
+            const { join: join121 } = await import("node:path");
+            const newKey = randomBytes25(16).toString("hex");
             process.env["OA_API_KEY"] = newKey;
-            const dir = join120(homedir43(), ".open-agents");
-            mkdirSync66(dir, { recursive: true });
-            writeFileSync58(join120(dir, "api.key"), newKey + "\n", "utf8");
+            const dir = join121(homedir44(), ".open-agents");
+            mkdirSync67(dir, { recursive: true });
+            writeFileSync59(join121(dir, "api.key"), newKey + "\n", "utf8");
             renderInfo2(`New API key: ${c3.bold(c3.yellow(newKey))}`);
             renderInfo2("Restart the daemon to apply if needed. Use /access any to restart quickly.");
           } catch (e2) {
@@ -554245,18 +554329,18 @@ async function handleSlashCommand(input, ctx3) {
           }
           process.env["OA_ACCESS"] = val2;
           if (val2 === "any" && !process.env["OA_API_KEY"]) {
-            const { randomBytes: randomBytes24 } = await import("node:crypto");
-            const apiKey = randomBytes24(16).toString("hex");
+            const { randomBytes: randomBytes25 } = await import("node:crypto");
+            const apiKey = randomBytes25(16).toString("hex");
             process.env["OA_API_KEY"] = apiKey;
             renderInfo2(`Generated API key: ${c3.bold(c3.yellow(apiKey))}`);
             renderInfo2("Use the Web UI ‘key’ button to paste this token, or set Authorization: Bearer <key> in your client.");
             try {
-              const { homedir: homedir44 } = await import("node:os");
-              const { mkdirSync: mkdirSync67, writeFileSync: writeFileSync59 } = await import("node:fs");
-              const { join: join121 } = await import("node:path");
-              const dir = join121(homedir44(), ".open-agents");
-              mkdirSync67(dir, { recursive: true });
-              writeFileSync59(join121(dir, "api.key"), apiKey + "\n", "utf8");
+              const { homedir: homedir45 } = await import("node:os");
+              const { mkdirSync: mkdirSync68, writeFileSync: writeFileSync60 } = await import("node:fs");
+              const { join: join122 } = await import("node:path");
+              const dir = join122(homedir45(), ".open-agents");
+              mkdirSync68(dir, { recursive: true });
+              writeFileSync60(join122(dir, "api.key"), apiKey + "\n", "utf8");
             } catch {
             }
           }
@@ -554267,12 +554351,12 @@ async function handleSlashCommand(input, ctx3) {
           }
           const port2 = parseInt(process.env["OA_PORT"] || "11435", 10);
           try {
-            const { homedir: homedir44 } = await import("node:os");
-            const { mkdirSync: mkdirSync67, writeFileSync: writeFileSync59 } = await import("node:fs");
-            const { join: join121 } = await import("node:path");
-            const dir = join121(homedir44(), ".open-agents");
-            mkdirSync67(dir, { recursive: true });
-            writeFileSync59(join121(dir, "access"), `${val2}
+            const { homedir: homedir45 } = await import("node:os");
+            const { mkdirSync: mkdirSync68, writeFileSync: writeFileSync60 } = await import("node:fs");
+            const { join: join122 } = await import("node:path");
+            const dir = join122(homedir45(), ".open-agents");
+            mkdirSync68(dir, { recursive: true });
+            writeFileSync60(join122(dir, "access"), `${val2}
 `, "utf8");
           } catch {
           }
@@ -554347,18 +554431,18 @@ async function handleSlashCommand(input, ctx3) {
       }
       process.env["OA_ACCESS"] = val;
       if (val === "any" && !process.env["OA_API_KEY"]) {
-        const { randomBytes: randomBytes24 } = await import("node:crypto");
-        const apiKey = randomBytes24(16).toString("hex");
+        const { randomBytes: randomBytes25 } = await import("node:crypto");
+        const apiKey = randomBytes25(16).toString("hex");
         process.env["OA_API_KEY"] = apiKey;
         renderInfo2(`Generated API key: ${c3.bold(c3.yellow(apiKey))}`);
         renderInfo2("Use the Web UI ‘key’ button to paste this token, or set Authorization: Bearer <key> in your client.");
         try {
-          const { homedir: homedir44 } = await import("node:os");
-          const { mkdirSync: mkdirSync67, writeFileSync: writeFileSync59 } = await import("node:fs");
-          const { join: join121 } = await import("node:path");
-          const dir = join121(homedir44(), ".open-agents");
-          mkdirSync67(dir, { recursive: true });
-          writeFileSync59(join121(dir, "api.key"), apiKey + "\n", "utf8");
+          const { homedir: homedir45 } = await import("node:os");
+          const { mkdirSync: mkdirSync68, writeFileSync: writeFileSync60 } = await import("node:fs");
+          const { join: join122 } = await import("node:path");
+          const dir = join122(homedir45(), ".open-agents");
+          mkdirSync68(dir, { recursive: true });
+          writeFileSync60(join122(dir, "api.key"), apiKey + "\n", "utf8");
         } catch {
         }
       }
@@ -554368,13 +554452,13 @@ async function handleSlashCommand(input, ctx3) {
         ctx3.saveSettings({ oaAccess: val });
       }
       const port = parseInt(process.env["OA_PORT"] || "11435", 10);
-      const { homedir: homedir43 } = await import("node:os");
-      const { mkdirSync: mkdirSync66, writeFileSync: writeFileSync58 } = await import("node:fs");
-      const { join: join120 } = await import("node:path");
+      const { homedir: homedir44 } = await import("node:os");
+      const { mkdirSync: mkdirSync67, writeFileSync: writeFileSync59 } = await import("node:fs");
+      const { join: join121 } = await import("node:path");
       try {
-        const dir = join120(homedir43(), ".open-agents");
-        mkdirSync66(dir, { recursive: true });
-        writeFileSync58(join120(dir, "access"), `${val}
+        const dir = join121(homedir44(), ".open-agents");
+        mkdirSync67(dir, { recursive: true });
+        writeFileSync59(join121(dir, "access"), `${val}
 `, "utf8");
       } catch (e2) {
         renderWarning2(`Could not persist ~/.open-agents/access: ${e2 instanceof Error ? e2.message : String(e2)}`);
@@ -554727,9 +554811,9 @@ async function handleSlashCommand(input, ctx3) {
           renderInfo2("No wallet configured. Ask the agent to create one via the nexus tool.");
         }
       } else if (sub === "name") {
-        const { homedir: homedir43 } = __require("node:os");
+        const { homedir: homedir44 } = __require("node:os");
         const { existsSync: ex, readFileSync: rf, writeFileSync: wf, mkdirSync: mkd } = __require("node:fs");
-        const namePath = __require("node:path").join(homedir43(), ".open-agents", "agent-name");
+        const namePath = __require("node:path").join(homedir44(), ".open-agents", "agent-name");
         if (rest2) {
           const customName = rest2.replace(/[^a-zA-Z0-9_\-.\s]/g, "").trim().slice(0, 40);
           if (!customName) {
@@ -556926,8 +557010,8 @@ sleep 1
           let sponsorName = (config.header.message || "").replace(/^\/+/, "").trim();
           if (!sponsorName || sponsorName.length < 2) {
             try {
-              const { homedir: homedir43 } = __require("os");
-              const namePath = __require("path").join(homedir43(), ".open-agents", "agent-name");
+              const { homedir: homedir44 } = __require("os");
+              const namePath = __require("path").join(homedir44(), ".open-agents", "agent-name");
               if (existsSync77(namePath)) sponsorName = readFileSync61(namePath, "utf8").trim();
             } catch {
             }
@@ -558591,11 +558675,11 @@ async function handleVoiceMenu(ctx3, save2, hasLocal) {
               continue;
             }
             const { basename: basename20, join: pathJoin } = await import("node:path");
-            const { copyFileSync: copyFileSync3, mkdirSync: mkdirSync66, existsSync: exists2 } = await import("node:fs");
-            const { homedir: homedir43 } = await import("node:os");
+            const { copyFileSync: copyFileSync3, mkdirSync: mkdirSync67, existsSync: exists2 } = await import("node:fs");
+            const { homedir: homedir44 } = await import("node:os");
             const modelName = basename20(onnxDrop.path, ".onnx").replace(/[^a-zA-Z0-9_-]/g, "-");
-            const destDir = pathJoin(homedir43(), ".open-agents", "voice", "models", modelName);
-            if (!exists2(destDir)) mkdirSync66(destDir, { recursive: true });
+            const destDir = pathJoin(homedir44(), ".open-agents", "voice", "models", modelName);
+            if (!exists2(destDir)) mkdirSync67(destDir, { recursive: true });
             copyFileSync3(onnxDrop.path, pathJoin(destDir, "model.onnx"));
             copyFileSync3(jsonDrop.path, pathJoin(destDir, "config.json"));
             const { registerCustomOnnxModel: registerCustomOnnxModel2 } = await Promise.resolve().then(() => (init_voice(), voice_exports));
@@ -559345,10 +559429,10 @@ async function handleSponsoredEndpoint(ctx3, local) {
     sponsors.push(...verified);
     if (verified.length > 0) {
       try {
-        const { mkdirSync: mkdirSync66, writeFileSync: writeFileSync58 } = __require("node:fs");
-        mkdirSync66(sponsorDir2, { recursive: true });
+        const { mkdirSync: mkdirSync67, writeFileSync: writeFileSync59 } = __require("node:fs");
+        mkdirSync67(sponsorDir2, { recursive: true });
         const cached = verified.map((s2) => ({ ...s2, lastVerified: Date.now() }));
-        writeFileSync58(knownFile, JSON.stringify(cached, null, 2));
+        writeFileSync59(knownFile, JSON.stringify(cached, null, 2));
       } catch {
       }
     }
@@ -559521,11 +559605,11 @@ async function handlePeerEndpoint(peerId, authKey, ctx3, local) {
     const models = await fetchModels(peerUrl, authKey);
     if (models.length > 0) {
       try {
-        const { writeFileSync: writeFileSync58, mkdirSync: mkdirSync66 } = await import("node:fs");
-        const { join: join120, dirname: dirname38 } = await import("node:path");
-        const cachePath = join120(ctx3.repoRoot || process.cwd(), ".oa", "nexus", "peer-models-cache.json");
-        mkdirSync66(dirname38(cachePath), { recursive: true });
-        writeFileSync58(cachePath, JSON.stringify({
+        const { writeFileSync: writeFileSync59, mkdirSync: mkdirSync67 } = await import("node:fs");
+        const { join: join121, dirname: dirname38 } = await import("node:path");
+        const cachePath = join121(ctx3.repoRoot || process.cwd(), ".oa", "nexus", "peer-models-cache.json");
+        mkdirSync67(dirname38(cachePath), { recursive: true });
+        writeFileSync59(cachePath, JSON.stringify({
           peerId,
           cachedAt: (/* @__PURE__ */ new Date()).toISOString(),
           models: models.map((m2) => ({ name: m2.name, size: m2.size, parameterSize: m2.parameterSize }))
@@ -560094,17 +560178,17 @@ async function handleUpdate(subcommand, ctx3) {
   try {
     const { createRequire: createRequire7 } = await import("node:module");
     const { fileURLToPath: fileURLToPath20 } = await import("node:url");
-    const { dirname: dirname38, join: join120 } = await import("node:path");
-    const { existsSync: existsSync102 } = await import("node:fs");
+    const { dirname: dirname38, join: join121 } = await import("node:path");
+    const { existsSync: existsSync103 } = await import("node:fs");
     const req2 = createRequire7(import.meta.url);
     const thisDir = dirname38(fileURLToPath20(import.meta.url));
     const candidates = [
-      join120(thisDir, "..", "package.json"),
-      join120(thisDir, "..", "..", "package.json"),
-      join120(thisDir, "..", "..", "..", "package.json")
+      join121(thisDir, "..", "package.json"),
+      join121(thisDir, "..", "..", "package.json"),
+      join121(thisDir, "..", "..", "..", "package.json")
     ];
     for (const pkgPath of candidates) {
-      if (existsSync102(pkgPath)) {
+      if (existsSync103(pkgPath)) {
         const pkg = req2(pkgPath);
         if (pkg.name === "open-agents-ai" || pkg.name === "@open-agents/cli") {
           currentVersion = pkg.version ?? "0.0.0";
@@ -561250,15 +561334,15 @@ var init_commands = __esm({
           process.env["OA_ACCESS"] = val;
           if (val === "any" && !process.env["OA_API_KEY"]) {
             try {
-              const { randomBytes: randomBytes24 } = await import("node:crypto");
-              const { homedir: homedir43 } = await import("node:os");
-              const { mkdirSync: mkdirSync66, writeFileSync: writeFileSync58 } = await import("node:fs");
-              const { join: join120 } = await import("node:path");
-              const apiKey = randomBytes24(16).toString("hex");
+              const { randomBytes: randomBytes25 } = await import("node:crypto");
+              const { homedir: homedir44 } = await import("node:os");
+              const { mkdirSync: mkdirSync67, writeFileSync: writeFileSync59 } = await import("node:fs");
+              const { join: join121 } = await import("node:path");
+              const apiKey = randomBytes25(16).toString("hex");
               process.env["OA_API_KEY"] = apiKey;
-              const dir = join120(homedir43(), ".open-agents");
-              mkdirSync66(dir, { recursive: true });
-              writeFileSync58(join120(dir, "api.key"), apiKey + "\n", "utf8");
+              const dir = join121(homedir44(), ".open-agents");
+              mkdirSync67(dir, { recursive: true });
+              writeFileSync59(join121(dir, "api.key"), apiKey + "\n", "utf8");
               renderInfo2(`Generated API key: ${c3.bold(c3.yellow(apiKey))}`);
               renderInfo2("Use Authorization: Bearer <key> or click 'key' in the Web UI header to paste it.");
             } catch (e2) {
@@ -561272,12 +561356,12 @@ var init_commands = __esm({
           }
           const port = parseInt(process.env["OA_PORT"] || "11435", 10);
           try {
-            const { homedir: homedir43 } = await import("node:os");
-            const { mkdirSync: mkdirSync66, writeFileSync: writeFileSync58 } = await import("node:fs");
-            const { join: join120 } = await import("node:path");
-            const dir = join120(homedir43(), ".open-agents");
-            mkdirSync66(dir, { recursive: true });
-            writeFileSync58(join120(dir, "access"), `${val}
+            const { homedir: homedir44 } = await import("node:os");
+            const { mkdirSync: mkdirSync67, writeFileSync: writeFileSync59 } = await import("node:fs");
+            const { join: join121 } = await import("node:path");
+            const dir = join121(homedir44(), ".open-agents");
+            mkdirSync67(dir, { recursive: true });
+            writeFileSync59(join121(dir, "access"), `${val}
 `, "utf8");
           } catch {
           }
@@ -576712,10 +576796,108 @@ var init_aiwg = __esm({
   }
 });
 
-// packages/cli/src/api/routes-v1.ts
-import { existsSync as existsSync94, readFileSync as readFileSync76, readdirSync as readdirSync32, statSync as statSync28 } from "node:fs";
-import { join as join110, resolve as pathResolve } from "node:path";
+// packages/cli/src/api/runtime-keys.ts
+var runtime_keys_exports = {};
+__export(runtime_keys_exports, {
+  listKeysSafe: () => listKeysSafe,
+  lookupKey: () => lookupKey,
+  mintKey: () => mintKey,
+  revokeByPrefix: () => revokeByPrefix
+});
+import { existsSync as existsSync94, readFileSync as readFileSync76, writeFileSync as writeFileSync51, mkdirSync as mkdirSync59, chmodSync } from "node:fs";
+import { join as join110 } from "node:path";
 import { homedir as homedir37 } from "node:os";
+import { randomBytes as randomBytes21 } from "node:crypto";
+function ensureDir2() {
+  const dir = join110(homedir37(), ".open-agents");
+  if (!existsSync94(dir)) mkdirSync59(dir, { recursive: true });
+}
+function loadAll() {
+  if (!existsSync94(KEYS_FILE)) return [];
+  try {
+    const raw = readFileSync76(KEYS_FILE, "utf-8");
+    const parsed = JSON.parse(raw);
+    if (!Array.isArray(parsed)) return [];
+    return parsed;
+  } catch {
+    return [];
+  }
+}
+function persistAll(records) {
+  ensureDir2();
+  writeFileSync51(KEYS_FILE, JSON.stringify(records, null, 2), "utf-8");
+  try {
+    chmodSync(KEYS_FILE, 384);
+  } catch {
+  }
+}
+function mintKey(args) {
+  const records = loadAll();
+  const key = `oa_${randomBytes21(32).toString("hex")}`;
+  const record = {
+    key,
+    scope: args.scope,
+    owner: args.owner,
+    profile: args.profile ?? null,
+    created: (/* @__PURE__ */ new Date()).toISOString(),
+    revoked: null,
+    rpm: args.rpm,
+    tpd: args.tpd,
+    max_jobs: args.max_jobs
+  };
+  records.push(record);
+  persistAll(records);
+  return record;
+}
+function listKeysSafe() {
+  return loadAll().map((r2) => ({
+    ...r2,
+    key: void 0,
+    key_prefix: r2.key.slice(0, 8),
+    key_suffix: r2.key.slice(-4)
+  })).map((r2) => {
+    const { key: _drop, ...rest } = r2;
+    void _drop;
+    return rest;
+  });
+}
+function revokeByPrefix(prefix) {
+  if (!prefix || prefix.length < 8) return 0;
+  const records = loadAll();
+  const now = (/* @__PURE__ */ new Date()).toISOString();
+  let n2 = 0;
+  for (const r2 of records) {
+    if (r2.key.startsWith(prefix) && !r2.revoked) {
+      r2.revoked = now;
+      n2++;
+    }
+  }
+  if (n2 > 0) persistAll(records);
+  return n2;
+}
+function lookupKey(secret) {
+  if (!secret) return null;
+  const records = loadAll();
+  for (const r2 of records) {
+    if (r2.key === secret) {
+      if (r2.revoked) return null;
+      return r2;
+    }
+  }
+  return null;
+}
+var KEYS_FILE;
+var init_runtime_keys = __esm({
+  "packages/cli/src/api/runtime-keys.ts"() {
+    "use strict";
+    KEYS_FILE = join110(homedir37(), ".open-agents", "keys.json");
+  }
+});
+
+// packages/cli/src/api/routes-v1.ts
+import { existsSync as existsSync95, readFileSync as readFileSync77, readdirSync as readdirSync32, statSync as statSync28 } from "node:fs";
+import { join as join111, resolve as pathResolve } from "node:path";
+import { homedir as homedir38 } from "node:os";
 async function tryRouteV1(ctx3) {
   const { pathname, method } = ctx3;
   if (pathname === "/v1/skills" && method === "GET") {
@@ -576791,6 +576973,12 @@ async function tryRouteV1(ctx3) {
   if (pathname === "/v1/index" && method === "POST") {
     return handleIndex(ctx3);
   }
+  if (pathname === "/v1/keys" && method === "GET") return handleListKeys(ctx3);
+  if (pathname === "/v1/keys" && method === "POST") return handleMintKey(ctx3);
+  {
+    const m2 = /^\/v1\/keys\/([^/]+)$/.exec(pathname);
+    if (m2 && method === "DELETE") return handleRevokeKey(ctx3, decodeURIComponent(m2[1]));
+  }
   if (pathname === "/v1/tools" && method === "GET") {
     return handleListTools(ctx3);
   }
@@ -576937,11 +577125,11 @@ async function handleGetSkill(ctx3, name10) {
 async function fallbackDiscoverSkills() {
   return (_root) => {
     const roots = [
-      join110(homedir37(), ".local", "share", "ai-writing-guide")
+      join111(homedir38(), ".local", "share", "ai-writing-guide")
     ];
     const out = [];
     for (const root of roots) {
-      if (!existsSync94(root)) continue;
+      if (!existsSync95(root)) continue;
       walkForSkills(root, out, 0);
     }
     return out;
@@ -576952,12 +577140,12 @@ function walkForSkills(dir, out, depth) {
   try {
     for (const e2 of readdirSync32(dir, { withFileTypes: true })) {
       if (e2.name.startsWith(".") || e2.name === "node_modules") continue;
-      const p2 = join110(dir, e2.name);
+      const p2 = join111(dir, e2.name);
       if (e2.isDirectory()) {
         walkForSkills(p2, out, depth + 1);
       } else if (e2.isFile() && e2.name === "SKILL.md") {
         try {
-          const content = readFileSync76(p2, "utf-8").slice(0, 2e3);
+          const content = readFileSync77(p2, "utf-8").slice(0, 2e3);
           const nameMatch = content.match(/^name:\s*(.+)$/m);
           const descMatch = content.match(/^description:\s*(.+)$/m);
           out.push({
@@ -577141,7 +577329,7 @@ async function getMemoryStores() {
   if (memoryInitTried) return null;
   memoryInitTried = true;
   try {
-    const dbPath = join110(homedir37(), ".open-agents", "memory.db");
+    const dbPath = join111(homedir38(), ".open-agents", "memory.db");
     const sharedDb = initDb(dbPath);
     memoryStoresCache = {
       episode: new EpisodeStore(dbPath),
@@ -577399,7 +577587,7 @@ async function handleFilesRead(ctx3) {
       }));
       return true;
     }
-    if (!existsSync94(resolved)) {
+    if (!existsSync95(resolved)) {
       sendProblem(res, problemDetails({
         type: P.notFound,
         status: 404,
@@ -577431,7 +577619,7 @@ async function handleFilesRead(ctx3) {
       }));
       return true;
     }
-    const content = readFileSync76(resolved, "utf-8");
+    const content = readFileSync77(resolved, "utf-8");
     const offset = typeof body.offset === "number" && body.offset >= 0 ? body.offset : 0;
     const limit = typeof body.limit === "number" && body.limit > 0 ? body.limit : content.length;
     const slice2 = content.slice(offset, offset + limit);
@@ -577664,14 +577852,14 @@ async function handleNexusStatus(ctx3) {
   const { res, requestId } = ctx3;
   try {
     const statePaths = [
-      join110(process.cwd(), ".oa", "nexus-peer-state.json"),
-      join110(homedir37(), ".open-agents", "nexus-peer-cache.json")
+      join111(process.cwd(), ".oa", "nexus-peer-state.json"),
+      join111(homedir38(), ".open-agents", "nexus-peer-cache.json")
     ];
     const states = [];
     for (const p2 of statePaths) {
-      if (!existsSync94(p2)) continue;
+      if (!existsSync95(p2)) continue;
       try {
-        const raw = readFileSync76(p2, "utf-8");
+        const raw = readFileSync77(p2, "utf-8");
         states.push({ source: p2, data: JSON.parse(raw) });
       } catch (e2) {
         states.push({ source: p2, error: String(e2) });
@@ -577698,8 +577886,8 @@ async function handleNexusStatus(ctx3) {
 }
 function loadAgentName() {
   try {
-    const p2 = join110(homedir37(), ".open-agents", "agent-name");
-    if (existsSync94(p2)) return readFileSync76(p2, "utf-8").trim();
+    const p2 = join111(homedir38(), ".open-agents", "agent-name");
+    if (existsSync95(p2)) return readFileSync77(p2, "utf-8").trim();
   } catch {
   }
   return null;
@@ -577708,14 +577896,14 @@ async function handleSponsors(ctx3) {
   const { req: req2, res, url, requestId } = ctx3;
   try {
     const candidates = [
-      join110(homedir37(), ".open-agents", "sponsor-cache.json"),
-      join110(homedir37(), ".open-agents", "sponsors.json")
+      join111(homedir38(), ".open-agents", "sponsor-cache.json"),
+      join111(homedir38(), ".open-agents", "sponsors.json")
     ];
     let sponsors = [];
     for (const p2 of candidates) {
-      if (!existsSync94(p2)) continue;
+      if (!existsSync95(p2)) continue;
       try {
-        const raw = JSON.parse(readFileSync76(p2, "utf-8"));
+        const raw = JSON.parse(readFileSync77(p2, "utf-8"));
         if (Array.isArray(raw)) {
           sponsors = raw;
           break;
@@ -577784,8 +577972,8 @@ async function handleEvaluate(ctx3) {
       }));
       return true;
     }
-    const jobPath = join110(process.cwd(), ".oa", "jobs", `${runId}.json`);
-    if (!existsSync94(jobPath)) {
+    const jobPath = join111(process.cwd(), ".oa", "jobs", `${runId}.json`);
+    if (!existsSync95(jobPath)) {
       sendProblem(res, problemDetails({
         type: P.notFound,
         status: 404,
@@ -577795,7 +577983,7 @@ async function handleEvaluate(ctx3) {
       }));
       return true;
     }
-    const job = JSON.parse(readFileSync76(jobPath, "utf-8"));
+    const job = JSON.parse(readFileSync77(jobPath, "utf-8"));
     sendJson(res, 200, {
       run_id: runId,
       task: job.task,
@@ -577846,6 +578034,130 @@ async function handleIndex(ctx3) {
     return true;
   }
 }
+async function handleListKeys(ctx3) {
+  const { req: req2, res, requestId } = ctx3;
+  const reqAuth = req2;
+  if (reqAuth._authScope !== "admin") {
+    sendProblem(res, problemDetails({
+      type: P.forbidden,
+      status: 403,
+      title: "Admin scope required",
+      detail: "Listing keys requires 'admin' scope.",
+      instance: requestId
+    }));
+    return true;
+  }
+  try {
+    const { listKeysSafe: listKeysSafe2 } = await Promise.resolve().then(() => (init_runtime_keys(), runtime_keys_exports));
+    sendJson(res, 200, { keys: listKeysSafe2() });
+  } catch (err) {
+    sendProblem(res, problemDetails({
+      type: P.internalError,
+      status: 500,
+      title: "List keys failed",
+      detail: err instanceof Error ? err.message : String(err),
+      instance: requestId
+    }));
+  }
+  return true;
+}
+async function handleMintKey(ctx3) {
+  const { req: req2, res, requestId } = ctx3;
+  const reqAuth = req2;
+  if (reqAuth._authScope !== "admin") {
+    sendProblem(res, problemDetails({
+      type: P.forbidden,
+      status: 403,
+      title: "Admin scope required",
+      detail: "Minting keys requires 'admin' scope.",
+      instance: requestId
+    }));
+    return true;
+  }
+  try {
+    const body = await parseJsonBodyStrict(req2).catch(() => null);
+    if (!body || typeof body !== "object") {
+      sendProblem(res, problemDetails({
+        type: P.invalidRequest,
+        status: 400,
+        title: "Body must be JSON object",
+        detail: "POST {scope: 'read'|'run'|'admin', owner: string, profile?: string}",
+        instance: requestId
+      }));
+      return true;
+    }
+    const scope = body.scope;
+    if (scope !== "read" && scope !== "run" && scope !== "admin") {
+      sendProblem(res, problemDetails({
+        type: P.invalidRequest,
+        status: 400,
+        title: "Invalid scope",
+        detail: "scope must be one of 'read', 'run', 'admin'.",
+        instance: requestId
+      }));
+      return true;
+    }
+    const owner = typeof body.owner === "string" ? body.owner.slice(0, 200) : "anonymous";
+    const profile = typeof body.profile === "string" ? body.profile.slice(0, 100) : null;
+    const { mintKey: mintKey2 } = await Promise.resolve().then(() => (init_runtime_keys(), runtime_keys_exports));
+    const rec = mintKey2({
+      scope,
+      owner,
+      profile,
+      rpm: typeof body.rpm === "number" ? body.rpm : void 0,
+      tpd: typeof body.tpd === "number" ? body.tpd : void 0,
+      max_jobs: typeof body.max_jobs === "number" ? body.max_jobs : void 0
+    });
+    sendJson(res, 201, { ...rec, _note: "This is the ONLY response that contains the full key. Persist it now." });
+  } catch (err) {
+    sendProblem(res, problemDetails({
+      type: P.internalError,
+      status: 500,
+      title: "Key mint failed",
+      detail: err instanceof Error ? err.message : String(err),
+      instance: requestId
+    }));
+  }
+  return true;
+}
+async function handleRevokeKey(ctx3, prefix) {
+  const { req: req2, res, requestId } = ctx3;
+  const reqAuth = req2;
+  if (reqAuth._authScope !== "admin") {
+    sendProblem(res, problemDetails({
+      type: P.forbidden,
+      status: 403,
+      title: "Admin scope required",
+      detail: "Revoking keys requires 'admin' scope.",
+      instance: requestId
+    }));
+    return true;
+  }
+  if (!prefix || prefix.length < 8) {
+    sendProblem(res, problemDetails({
+      type: P.invalidRequest,
+      status: 400,
+      title: "Prefix too short",
+      detail: "Provide at least the first 8 characters of the key to revoke.",
+      instance: requestId
+    }));
+    return true;
+  }
+  try {
+    const { revokeByPrefix: revokeByPrefix2 } = await Promise.resolve().then(() => (init_runtime_keys(), runtime_keys_exports));
+    const n2 = revokeByPrefix2(prefix);
+    sendJson(res, 200, { revoked: n2 });
+  } catch (err) {
+    sendProblem(res, problemDetails({
+      type: P.internalError,
+      status: 500,
+      title: "Key revoke failed",
+      detail: err instanceof Error ? err.message : String(err),
+      instance: requestId
+    }));
+  }
+  return true;
+}
 async function handleListTools(ctx3) {
   const { req: req2, res, url, requestId } = ctx3;
   try {
@@ -577889,10 +578201,15 @@ async function handleListTools(ctx3) {
     const filterCat = url.searchParams.get("category");
     const filterScope = url.searchParams.get("scope");
     const filterRisk = url.searchParams.get("risk");
+    const filterOffDeviceRaw = url.searchParams.get("off_device");
     let filtered = tools;
     if (filterCat) filtered = filtered.filter((t2) => t2.security?.categories?.includes(filterCat));
     if (filterScope) filtered = filtered.filter((t2) => t2.security?.requires_scope === filterScope);
     if (filterRisk) filtered = filtered.filter((t2) => t2.security?.risk === filterRisk);
+    if (filterOffDeviceRaw !== null) {
+      const want = filterOffDeviceRaw === "true";
+      filtered = filtered.filter((t2) => t2.security?.off_device_allowed === want);
+    }
     const page2 = parsePagination(url.searchParams);
     const envelope = paginated(filtered, page2);
     const etag = computeEtag(envelope);
@@ -577965,6 +578282,13 @@ async function handleGetTool(ctx3, name10) {
       endpoints: {
         call: `/v1/tools/${encodeURIComponent(name10)}/call`,
         schema: `/v1/tools/${encodeURIComponent(name10)}`
+      },
+      // Q4: document the canonical body shape for /v1/tools/{name}/call.
+      // The `parameters` field IS the JSON-schema describing what goes
+      // INSIDE the args wrapper — it's not the wrapper itself.
+      call_body_shape: {
+        args: "<object matching the `parameters` JSON schema>",
+        working_dir: "<optional absolute path; defaults to daemon cwd>"
       }
     };
     const etag = computeEtag(body);
@@ -578147,17 +578471,17 @@ async function handleListAgentTypes(ctx3) {
 }
 async function handleListEngines(ctx3) {
   const { res } = ctx3;
-  const home = homedir37();
+  const home = homedir38();
   sendJson(res, 200, {
     engines: [
-      { name: "dream", state_file: join110(process.cwd(), ".oa", "dreams"), controllable_via: "SSE + slash commands" },
-      { name: "bless", state_file: join110(process.cwd(), ".oa", "bless-state.json"), controllable_via: "slash commands" },
-      { name: "call", state_file: join110(process.cwd(), ".oa", "call-state.json"), controllable_via: "slash commands" },
-      { name: "listen", state_file: join110(process.cwd(), ".oa", "listen-state.json"), controllable_via: "slash commands" },
-      { name: "telegram", state_file: join110(home, ".open-agents", "telegram-state.json"), controllable_via: "slash commands" },
-      { name: "expose", state_file: join110(process.cwd(), ".oa", "expose-state.json"), controllable_via: "/expose commands" },
-      { name: "nexus", state_file: join110(home, ".open-agents", "nexus-peer-cache.json"), controllable_via: "/nexus commands" },
-      { name: "ipfs", state_file: join110(process.cwd(), ".oa", "ipfs"), controllable_via: "slash commands" }
+      { name: "dream", state_file: join111(process.cwd(), ".oa", "dreams"), controllable_via: "SSE + slash commands" },
+      { name: "bless", state_file: join111(process.cwd(), ".oa", "bless-state.json"), controllable_via: "slash commands" },
+      { name: "call", state_file: join111(process.cwd(), ".oa", "call-state.json"), controllable_via: "slash commands" },
+      { name: "listen", state_file: join111(process.cwd(), ".oa", "listen-state.json"), controllable_via: "slash commands" },
+      { name: "telegram", state_file: join111(home, ".open-agents", "telegram-state.json"), controllable_via: "slash commands" },
+      { name: "expose", state_file: join111(process.cwd(), ".oa", "expose-state.json"), controllable_via: "/expose commands" },
+      { name: "nexus", state_file: join111(home, ".open-agents", "nexus-peer-cache.json"), controllable_via: "/nexus commands" },
+      { name: "ipfs", state_file: join111(process.cwd(), ".oa", "ipfs"), controllable_via: "slash commands" }
     ],
     note: "Engine instrumentation lives in the running TUI process. Full status + control requires the daemon↔TUI bridge (PT-07). See parity audit WO-PARITY-04."
   });
@@ -578240,21 +578564,21 @@ async function tryAimsRoute(ctx3) {
   return false;
 }
 function aimsDir() {
-  return join110(homedir37(), ".open-agents", "aims");
+  return join111(homedir38(), ".open-agents", "aims");
 }
 function readAimsFile(name10, fallback) {
   try {
-    const p2 = join110(aimsDir(), name10);
-    if (existsSync94(p2)) return JSON.parse(readFileSync76(p2, "utf-8"));
+    const p2 = join111(aimsDir(), name10);
+    if (existsSync95(p2)) return JSON.parse(readFileSync77(p2, "utf-8"));
   } catch {
   }
   return fallback;
 }
 function writeAimsFile(name10, data) {
   const dir = aimsDir();
-  const { mkdirSync: mkdirSync66, writeFileSync: wf, renameSync: rn } = __require("node:fs");
-  mkdirSync66(dir, { recursive: true });
-  const finalPath = join110(dir, name10);
+  const { mkdirSync: mkdirSync67, writeFileSync: wf, renameSync: rn } = __require("node:fs");
+  mkdirSync67(dir, { recursive: true });
+  const finalPath = join111(dir, name10);
   const tmpPath = `${finalPath}.tmp.${process.pid}.${Date.now()}`;
   try {
     wf(tmpPath, JSON.stringify(data, null, 2) + "\n", { encoding: "utf-8", mode: 384 });
@@ -578584,12 +578908,12 @@ async function handleAimsSuppliers(ctx3) {
       }
     ];
     const sponsorPaths = [
-      join110(homedir37(), ".open-agents", "sponsor-cache.json")
+      join111(homedir38(), ".open-agents", "sponsor-cache.json")
     ];
     for (const p2 of sponsorPaths) {
-      if (!existsSync94(p2)) continue;
+      if (!existsSync95(p2)) continue;
       try {
-        const raw = JSON.parse(readFileSync76(p2, "utf-8"));
+        const raw = JSON.parse(readFileSync77(p2, "utf-8"));
         const list = Array.isArray(raw) ? raw : raw?.sponsors ?? [];
         for (const s2 of list) {
           suppliers.push({
@@ -578651,11 +578975,11 @@ async function handleAimsIncidentPost(ctx3) {
       }));
       return true;
     }
-    const { randomBytes: randomBytes24 } = await import("node:crypto");
+    const { randomBytes: randomBytes25 } = await import("node:crypto");
     const record = await withAimsLock("incidents.json", () => {
       const existing = readAimsFile("incidents.json", []);
       const rec = {
-        id: `INC-${Date.now()}-${randomBytes24(4).toString("hex")}`,
+        id: `INC-${Date.now()}-${randomBytes25(4).toString("hex")}`,
         ts: (/* @__PURE__ */ new Date()).toISOString(),
         raised_by: user ?? "anonymous",
         status: "open",
@@ -585783,10 +586107,24 @@ function getOpenApiSpec() {
       "/v1/models": { get: { summary: "List aggregated models", tags: ["Inference"], responses: { 200: { description: "OpenAI-format model list" }, ...ErrorResponses } } },
       "/v1/chat/completions": {
         post: {
-          summary: "OpenAI-compatible chat completion",
+          summary: "OpenAI-compatible chat completion (with optional server-side agent loop)",
           tags: ["Inference"],
-          requestBody: { required: true, content: { "application/json": { schema: { type: "object", required: ["model", "messages"], properties: { model: { type: "string" }, messages: { type: "array" }, stream: { type: "boolean" }, temperature: { type: "number" } } } } } },
-          responses: { 200: { description: "Chat response (SSE if stream=true)" }, ...ErrorResponses }
+          description: "Standard OpenAI chat-completion proxy by default. Set agent_loop=true to enter a synchronous server-side loop that auto-executes daemon tools (web_search, web_fetch, file_read, ocr, etc.) and re-prompts the model — collapsing N round-trips into 1. include_daemon_tools=['read','run'] auto-merges daemon tools matching those scopes into the offered tools[]. timeout_s overrides OA_BACKEND_TIMEOUT_S (default 120s, max 1h). prompt_template='factual-first' prepends a web_search-first policy. SSE streaming honors tool_calls in delta as standard OpenAI shape: delta.tool_calls=[{id,type:'function',index,function:{name,arguments:<JSON-string>}}]. parallel_tool_calls is forwarded to the backend.",
+          requestBody: { required: true, content: { "application/json": { schema: { type: "object", required: ["model", "messages"], properties: {
+            model: { type: "string" },
+            messages: { type: "array" },
+            stream: { type: "boolean" },
+            temperature: { type: "number" },
+            tools: { type: "array", description: "OpenAI-shape tools array. Forwarded to the backend." },
+            tool_choice: { description: "OpenAI-shape tool_choice. Forwarded to the backend." },
+            parallel_tool_calls: { type: "boolean", description: "Q7 — forwarded to backend; some models (qwen3, llama3) emit multiple tool_calls in one response." },
+            timeout_s: { type: "number", description: "Q1 — per-request timeout in seconds (1-3600). Overrides OA_BACKEND_TIMEOUT_S." },
+            agent_loop: { type: "boolean", description: "Q2 — when true, daemon runs an N-turn agent loop server-side. Daemon tools execute inline; client tool_calls cause the loop to yield." },
+            include_daemon_tools: { type: "array", items: { type: "string", enum: ["read", "run", "admin"] }, description: "Q3 — scopes to merge from daemon tool catalog into tools[]." },
+            max_turns: { type: "integer", description: "Q2 — agent_loop max iterations (default 8, max 64)." },
+            prompt_template: { type: "string", enum: ["factual-first"], description: "Q8 — prepended system policy template. 'factual-first' instructs model to call web_search FIRST for any factual question." }
+          } } } } },
+          responses: { 200: { description: "OpenAI chat.completion shape, SSE if stream=true. agent_loop responses include _agent_loop:{turns,log,done,reason}." }, ...ErrorResponses }
         }
       },
       "/v1/embeddings": { post: { summary: "Generate embeddings", tags: ["Inference"], responses: { 200: { description: "Embedding vectors" }, ...ErrorResponses } } },
@@ -585998,7 +586336,7 @@ function getOpenApiSpec() {
         post: {
           summary: "Execute a single tool directly (MCP-style, no agent loop)",
           tags: ["Tools"],
-          description: "Body: {args: object, working_dir?: string}. Returns the tool's ToolResult {success, output, llmContent?, error?, durationMs} plus security metadata. Auth gating: request scope (read/run/admin) must satisfy tool.requires_scope; non-loopback callers need admin scope unless tool.off_device_allowed=true. Anonymous loopback callers default to admin scope; anonymous remote callers default to read scope.",
+          description: "Body: {args: object, working_dir?: string}. The `args` key is canonical (Q4) — the JSON-schema in /v1/tools/{name} `parameters` describes what goes INSIDE the args wrapper. Returns ToolResult {success, output, llmContent?, error?, durationMs} plus security metadata. Auth gating: request scope (read/run/admin) must satisfy tool.requires_scope; non-loopback callers need admin scope unless tool.off_device_allowed=true. Anonymous loopback callers default to admin scope; anonymous remote callers default to read scope.",
           parameters: [{ name: "name", in: "path", required: true, schema: { type: "string" } }],
           responses: {
             200: { description: "Tool result envelope" },
@@ -586008,6 +586346,28 @@ function getOpenApiSpec() {
           }
         }
       },
+      "/v1/keys": {
+        get: {
+          summary: "List runtime API keys (admin scope)",
+          tags: ["Tools"],
+          description: "Returns runtime keys with secrets masked (only first 8 + last 4 chars). Q6 — runtime-mintable alternative to OA_API_KEY/OA_API_KEYS env vars.",
+          responses: { 200: { description: "Masked key list" }, 403: { description: "Admin scope required" } }
+        },
+        post: {
+          summary: "Mint a new runtime API key (admin scope)",
+          tags: ["Tools"],
+          description: "Body: {scope: 'read'|'run'|'admin', owner: string, profile?: string, rpm?, tpd?, max_jobs?}. Returns the FULL key — only response that contains the secret. Persisted at ~/.open-agents/keys.json mode 0600.",
+          responses: { 201: { description: "Key minted" }, 400: { description: "Invalid body" }, 403: { description: "Admin scope required" } }
+        }
+      },
+      "/v1/keys/{prefix}": {
+        delete: {
+          summary: "Revoke a runtime key by prefix (admin scope)",
+          tags: ["Tools"],
+          parameters: [{ name: "prefix", in: "path", required: true, schema: { type: "string", minLength: 8 }, description: "First 8+ characters of the key" }],
+          responses: { 200: { description: "Number of keys revoked" }, 400: { description: "Prefix too short" }, 403: { description: "Admin scope required" } }
+        }
+      },
       "/v1/hooks": { get: { summary: "List hook types and counts", tags: ["Tools"], responses: { 200: { description: "Hook registry" } } } },
       "/v1/agents": { get: { summary: "List agent types", tags: ["Tools"], responses: { 200: { description: "Agent type registry" } } } },
       "/v1/engines": { get: { summary: "List long-running engines", tags: ["Engines"], responses: { 200: { description: "Engine status + state files" } } } },
@@ -586440,15 +586800,15 @@ var init_auth_oidc = __esm({
 });
 
 // packages/cli/src/api/usage-tracker.ts
-import { mkdirSync as mkdirSync59, readFileSync as readFileSync77, writeFileSync as writeFileSync51, existsSync as existsSync95 } from "node:fs";
-import { join as join111 } from "node:path";
+import { mkdirSync as mkdirSync60, readFileSync as readFileSync78, writeFileSync as writeFileSync52, existsSync as existsSync96 } from "node:fs";
+import { join as join112 } from "node:path";
 function initUsageTracker(oaDir) {
-  const dir = join111(oaDir, "usage");
-  mkdirSync59(dir, { recursive: true });
-  usageFile = join111(dir, "token-usage.json");
+  const dir = join112(oaDir, "usage");
+  mkdirSync60(dir, { recursive: true });
+  usageFile = join112(dir, "token-usage.json");
   try {
-    if (existsSync95(usageFile)) {
-      store = JSON.parse(readFileSync77(usageFile, "utf-8"));
+    if (existsSync96(usageFile)) {
+      store = JSON.parse(readFileSync78(usageFile, "utf-8"));
     }
   } catch {
     store = { providers: {}, lastSaved: "" };
@@ -586484,7 +586844,7 @@ function flush2() {
   if (!initialized2 || !dirty) return;
   try {
     store.lastSaved = (/* @__PURE__ */ new Date()).toISOString();
-    writeFileSync51(usageFile, JSON.stringify(store, null, 2), "utf-8");
+    writeFileSync52(usageFile, JSON.stringify(store, null, 2), "utf-8");
     dirty = false;
   } catch {
   }
@@ -586512,24 +586872,24 @@ var init_usage_tracker = __esm({
 });
 
 // packages/cli/src/api/profiles.ts
-import { existsSync as existsSync96, readFileSync as readFileSync78, writeFileSync as writeFileSync52, mkdirSync as mkdirSync60, readdirSync as readdirSync33, unlinkSync as unlinkSync23 } from "node:fs";
-import { join as join112 } from "node:path";
-import { homedir as homedir38 } from "node:os";
-import { createCipheriv as createCipheriv4, createDecipheriv as createDecipheriv4, randomBytes as randomBytes21, scryptSync as scryptSync3 } from "node:crypto";
+import { existsSync as existsSync97, readFileSync as readFileSync79, writeFileSync as writeFileSync53, mkdirSync as mkdirSync61, readdirSync as readdirSync33, unlinkSync as unlinkSync23 } from "node:fs";
+import { join as join113 } from "node:path";
+import { homedir as homedir39 } from "node:os";
+import { createCipheriv as createCipheriv4, createDecipheriv as createDecipheriv4, randomBytes as randomBytes22, scryptSync as scryptSync3 } from "node:crypto";
 function globalProfileDir() {
-  return join112(homedir38(), ".open-agents", "profiles");
+  return join113(homedir39(), ".open-agents", "profiles");
 }
 function projectProfileDir(projectDir2) {
-  return join112(projectDir2 || process.cwd(), ".oa", "profiles");
+  return join113(projectDir2 || process.cwd(), ".oa", "profiles");
 }
 function listProfiles(projectDir2) {
   const result = [];
   const seen = /* @__PURE__ */ new Set();
   const projDir = projectProfileDir(projectDir2);
-  if (existsSync96(projDir)) {
+  if (existsSync97(projDir)) {
     for (const f2 of readdirSync33(projDir).filter((f3) => f3.endsWith(".json"))) {
       try {
-        const raw = JSON.parse(readFileSync78(join112(projDir, f2), "utf8"));
+        const raw = JSON.parse(readFileSync79(join113(projDir, f2), "utf8"));
         const name10 = f2.replace(".json", "");
         seen.add(name10);
         result.push({
@@ -586543,12 +586903,12 @@ function listProfiles(projectDir2) {
     }
   }
   const globDir = globalProfileDir();
-  if (existsSync96(globDir)) {
+  if (existsSync97(globDir)) {
     for (const f2 of readdirSync33(globDir).filter((f3) => f3.endsWith(".json"))) {
       const name10 = f2.replace(".json", "");
       if (seen.has(name10)) continue;
       try {
-        const raw = JSON.parse(readFileSync78(join112(globDir, f2), "utf8"));
+        const raw = JSON.parse(readFileSync79(join113(globDir, f2), "utf8"));
         result.push({
           name: name10,
           description: raw.description || "",
@@ -586563,11 +586923,11 @@ function listProfiles(projectDir2) {
 }
 function loadProfile(name10, password, projectDir2) {
   const sanitized = name10.replace(/[^a-zA-Z0-9_-]/g, "");
-  const projPath = join112(projectProfileDir(projectDir2), `${sanitized}.json`);
-  const globPath = join112(globalProfileDir(), `${sanitized}.json`);
-  const filePath = existsSync96(projPath) ? projPath : existsSync96(globPath) ? globPath : null;
+  const projPath = join113(projectProfileDir(projectDir2), `${sanitized}.json`);
+  const globPath = join113(globalProfileDir(), `${sanitized}.json`);
+  const filePath = existsSync97(projPath) ? projPath : existsSync97(globPath) ? globPath : null;
   if (!filePath) return null;
-  const raw = JSON.parse(readFileSync78(filePath, "utf8"));
+  const raw = JSON.parse(readFileSync79(filePath, "utf8"));
   if (raw.encrypted === true) {
     if (!password) return null;
     return decryptProfile(raw, password);
@@ -586576,32 +586936,32 @@ function loadProfile(name10, password, projectDir2) {
 }
 function saveProfile(profile, password, scope = "global", projectDir2) {
   const dir = scope === "project" ? projectProfileDir(projectDir2) : globalProfileDir();
-  mkdirSync60(dir, { recursive: true });
+  mkdirSync61(dir, { recursive: true });
   const sanitized = profile.name.replace(/[^a-zA-Z0-9_-]/g, "");
-  const filePath = join112(dir, `${sanitized}.json`);
+  const filePath = join113(dir, `${sanitized}.json`);
   profile.modified = (/* @__PURE__ */ new Date()).toISOString();
   if (password) {
     const encrypted = encryptProfile(profile, password);
-    writeFileSync52(filePath, JSON.stringify(encrypted, null, 2), { mode: 384 });
+    writeFileSync53(filePath, JSON.stringify(encrypted, null, 2), { mode: 384 });
   } else {
     profile.encrypted = false;
-    writeFileSync52(filePath, JSON.stringify(profile, null, 2), { mode: 420 });
+    writeFileSync53(filePath, JSON.stringify(profile, null, 2), { mode: 420 });
   }
 }
 function deleteProfile(name10, scope = "global", projectDir2) {
   const sanitized = name10.replace(/[^a-zA-Z0-9_-]/g, "");
   const dir = scope === "project" ? projectProfileDir(projectDir2) : globalProfileDir();
-  const filePath = join112(dir, `${sanitized}.json`);
-  if (existsSync96(filePath)) {
+  const filePath = join113(dir, `${sanitized}.json`);
+  if (existsSync97(filePath)) {
     unlinkSync23(filePath);
     return true;
   }
   return false;
 }
 function encryptProfile(profile, password) {
-  const salt = randomBytes21(32);
+  const salt = randomBytes22(32);
   const key = scryptSync3(password, salt, 32);
-  const iv = randomBytes21(16);
+  const iv = randomBytes22(16);
   const cipher = createCipheriv4("aes-256-gcm", key, iv);
   const plaintext = JSON.stringify(profile);
   const encrypted = Buffer.concat([cipher.update(plaintext, "utf8"), cipher.final()]);
@@ -586707,23 +587067,23 @@ var init_profiles = __esm({
 
 // packages/cli/src/docker.ts
 import { execSync as execSync54, spawn as spawn24 } from "node:child_process";
-import { existsSync as existsSync97, mkdirSync as mkdirSync61, writeFileSync as writeFileSync53 } from "node:fs";
-import { join as join113, resolve as resolve37, dirname as dirname34 } from "node:path";
-import { homedir as homedir39 } from "node:os";
+import { existsSync as existsSync98, mkdirSync as mkdirSync62, writeFileSync as writeFileSync54 } from "node:fs";
+import { join as join114, resolve as resolve37, dirname as dirname34 } from "node:path";
+import { homedir as homedir40 } from "node:os";
 import { fileURLToPath as fileURLToPath16 } from "node:url";
 function getDockerDir() {
   try {
     if (typeof __dirname !== "undefined") {
-      return join113(__dirname, "..", "..", "..", "docker");
+      return join114(__dirname, "..", "..", "..", "docker");
     }
   } catch {
   }
   try {
     const thisDir = dirname34(fileURLToPath16(import.meta.url));
-    return join113(thisDir, "..", "..", "..", "docker");
+    return join114(thisDir, "..", "..", "..", "docker");
   } catch {
   }
-  return join113(process.cwd(), "docker");
+  return join114(process.cwd(), "docker");
 }
 function isDockerAvailable() {
   try {
@@ -586854,11 +587214,11 @@ async function ensureOaImage(force = false) {
   }
   let buildContext;
   const dockerDir = getDockerDir();
-  if (existsSync97(join113(dockerDir, "Dockerfile"))) {
+  if (existsSync98(join114(dockerDir, "Dockerfile"))) {
     buildContext = dockerDir;
   } else {
-    buildContext = join113(homedir39(), ".oa", "docker-build");
-    mkdirSync61(buildContext, { recursive: true });
+    buildContext = join114(homedir40(), ".oa", "docker-build");
+    mkdirSync62(buildContext, { recursive: true });
     writeDockerfiles(buildContext);
   }
   try {
@@ -586932,8 +587292,8 @@ chown -R node:node /workspace /home/node/.oa /home/node/.open-agents 2>/dev/null
 if [ "$1" = "oa" ]; then shift; exec su - node -c "cd /workspace && oa $*"; fi
 exec "$@"
 `;
-  writeFileSync53(join113(dir, "Dockerfile"), dockerfile);
-  writeFileSync53(join113(dir, "docker-entrypoint.sh"), entrypoint, { mode: 493 });
+  writeFileSync54(join114(dir, "Dockerfile"), dockerfile);
+  writeFileSync54(join114(dir, "docker-entrypoint.sh"), entrypoint, { mode: 493 });
 }
 function hasNvidiaGpu() {
   try {
@@ -587186,23 +587546,23 @@ import * as http5 from "node:http";
 import * as https3 from "node:https";
 import { createRequire as createRequire4 } from "node:module";
 import { fileURLToPath as fileURLToPath17 } from "node:url";
-import { dirname as dirname35, join as join114, resolve as resolve38 } from "node:path";
-import { homedir as homedir40 } from "node:os";
+import { dirname as dirname35, join as join115, resolve as resolve38 } from "node:path";
+import { homedir as homedir41 } from "node:os";
 import { spawn as spawn25, execSync as execSync55 } from "node:child_process";
-import { mkdirSync as mkdirSync62, writeFileSync as writeFileSync54, readFileSync as readFileSync79, readdirSync as readdirSync34, existsSync as existsSync98, watch as fsWatch3, renameSync as renameSync8, unlinkSync as unlinkSync24 } from "node:fs";
-import { randomBytes as randomBytes22, randomUUID as randomUUID14 } from "node:crypto";
+import { mkdirSync as mkdirSync63, writeFileSync as writeFileSync55, readFileSync as readFileSync80, readdirSync as readdirSync34, existsSync as existsSync99, watch as fsWatch3, renameSync as renameSync8, unlinkSync as unlinkSync24 } from "node:fs";
+import { randomBytes as randomBytes23, randomUUID as randomUUID14 } from "node:crypto";
 import { createHash as createHash15 } from "node:crypto";
 function getVersion3() {
   try {
     const thisDir = dirname35(fileURLToPath17(import.meta.url));
     const candidates = [
-      join114(thisDir, "..", "package.json"),
-      join114(thisDir, "..", "..", "package.json"),
-      join114(thisDir, "..", "..", "..", "package.json")
+      join115(thisDir, "..", "package.json"),
+      join115(thisDir, "..", "..", "package.json"),
+      join115(thisDir, "..", "..", "..", "package.json")
     ];
     for (const pkgPath of candidates) {
       try {
-        if (!existsSync98(pkgPath)) continue;
+        if (!existsSync99(pkgPath)) continue;
         const pkg = require3(pkgPath);
         if (pkg.name === "open-agents-ai" || pkg.name === "@open-agents/cli" || pkg.name === "@open-agents/monorepo") {
           return pkg.version ?? "0.0.0";
@@ -587349,6 +587709,19 @@ function resolveModelEndpoint(modelId) {
   }
   return null;
 }
+function getBackendTimeoutMs(perRequestSeconds) {
+  if (typeof perRequestSeconds === "number" && perRequestSeconds > 0) {
+    return Math.min(Math.floor(perRequestSeconds * 1e3), BACKEND_TIMEOUT_MAX_MS);
+  }
+  const envS = process.env["OA_BACKEND_TIMEOUT_S"];
+  if (envS) {
+    const n2 = parseFloat(envS);
+    if (Number.isFinite(n2) && n2 > 0) {
+      return Math.min(Math.floor(n2 * 1e3), BACKEND_TIMEOUT_MAX_MS);
+    }
+  }
+  return BACKEND_TIMEOUT_DEFAULT_MS;
+}
 function recordMetric(method, path8, status) {
   const key = `${method}|${path8}|${status}`;
   const existing = metrics.requests.get(key);
@@ -587391,9 +587764,9 @@ function isOriginAllowed(origin) {
   if (!origin) return true;
   let accessMode = (process.env["OA_ACCESS"] || "").toLowerCase().trim();
   try {
-    const accessFile = join114(homedir40(), ".open-agents", "access");
-    if (existsSync98(accessFile)) {
-      const persisted = readFileSync79(accessFile, "utf8").trim().toLowerCase();
+    const accessFile = join115(homedir41(), ".open-agents", "access");
+    if (existsSync99(accessFile)) {
+      const persisted = readFileSync80(accessFile, "utf8").trim().toLowerCase();
       if (persisted === "any" || persisted === "lan" || persisted === "loopback") {
         accessMode = persisted;
       }
@@ -587453,7 +587826,7 @@ async function retrieveMemoryContext(userMessage, sessionId, maxEpisodes = 5) {
     if (!memMod || !memMod.EpisodeStore) {
       return { contextBlock: "", retrieved: [] };
     }
-    const dbPath = join114(homedir40(), ".open-agents", "memory.db");
+    const dbPath = join115(homedir41(), ".open-agents", "memory.db");
     const store2 = new memMod.EpisodeStore(dbPath);
     const recent = store2.search({ limit: 30, sessionId: void 0 }) ?? [];
     const qLower = userMessage.toLowerCase();
@@ -587496,7 +587869,7 @@ async function writeMemoryEpisodes(sessionId, userMessage, assistantContent, too
   try {
     const memMod = await Promise.resolve().then(() => (init_dist7(), dist_exports2)).catch(() => null);
     if (!memMod || !memMod.EpisodeStore) return 0;
-    const dbPath = join114(homedir40(), ".open-agents", "memory.db");
+    const dbPath = join115(homedir41(), ".open-agents", "memory.db");
     const store2 = new memMod.EpisodeStore(dbPath);
     let written = 0;
     try {
@@ -587598,7 +587971,8 @@ async function directChatBackend(opts) {
           proxyRes.on("error", reject);
         });
         proxyReq.on("error", reject);
-        proxyReq.setTimeout(12e4, () => proxyReq.destroy(new Error("Backend timeout (120s)")));
+        const _dctTo = getBackendTimeoutMs(extraFields?.["timeout_s"]);
+        proxyReq.setTimeout(_dctTo, () => proxyReq.destroy(new Error(`Backend timeout (${Math.round(_dctTo / 1e3)}s)`)));
         proxyReq.write(reqBody);
         proxyReq.end();
       });
@@ -587751,7 +588125,7 @@ function backendAuthHeaders(endpoint) {
   if (key) return { Authorization: `Bearer ${key}` };
   return {};
 }
-function ollamaRequest(ollamaUrl, path8, method, body) {
+function ollamaRequest(ollamaUrl, path8, method, body, timeoutMs) {
   return new Promise((resolve43, reject) => {
     const url = new URL(path8, ollamaUrl);
     const isHttps = url.protocol === "https:";
@@ -587778,15 +588152,16 @@ function ollamaRequest(ollamaUrl, path8, method, body) {
         });
       });
     });
-    proxyReq.setTimeout(12e4, () => {
-      proxyReq.destroy(new Error("Backend request timeout (120s)"));
+    const _to = getBackendTimeoutMs(timeoutMs ? timeoutMs / 1e3 : void 0);
+    proxyReq.setTimeout(_to, () => {
+      proxyReq.destroy(new Error(`Backend request timeout (${Math.round(_to / 1e3)}s)`));
     });
     proxyReq.on("error", reject);
     if (body) proxyReq.write(body);
     proxyReq.end();
   });
 }
-function ollamaStream(ollamaUrl, path8, method, body, onData, onEnd, onError) {
+function ollamaStream(ollamaUrl, path8, method, body, onData, onEnd, onError, timeoutMs) {
   const url = new URL(path8, ollamaUrl);
   const isHttps = url.protocol === "https:";
   const options2 = {
@@ -587806,8 +588181,9 @@ function ollamaStream(ollamaUrl, path8, method, body, onData, onEnd, onError) {
     proxyRes.on("data", onData);
     proxyRes.on("end", onEnd);
   });
-  proxyReq.setTimeout(12e4, () => {
-    proxyReq.destroy(new Error("Backend stream timeout (120s)"));
+  const _streamTo = getBackendTimeoutMs(timeoutMs ? timeoutMs / 1e3 : void 0);
+  proxyReq.setTimeout(_streamTo, () => {
+    proxyReq.destroy(new Error(`Backend stream timeout (${Math.round(_streamTo / 1e3)}s)`));
   });
   proxyReq.on("error", onError);
   if (body) proxyReq.write(body);
@@ -587815,32 +588191,76 @@ function ollamaStream(ollamaUrl, path8, method, body, onData, onEnd, onError) {
 }
 function jobsDir() {
   const root = resolve38(process.cwd());
-  const dir = join114(root, ".oa", "jobs");
-  mkdirSync62(dir, { recursive: true });
+  const dir = join115(root, ".oa", "jobs");
+  mkdirSync63(dir, { recursive: true });
   return dir;
 }
 function loadJob(id) {
-  const file = join114(jobsDir(), `${id}.json`);
-  if (!existsSync98(file)) return null;
+  const file = join115(jobsDir(), `${id}.json`);
+  if (!existsSync99(file)) return null;
   try {
-    return JSON.parse(readFileSync79(file, "utf-8"));
+    return JSON.parse(readFileSync80(file, "utf-8"));
   } catch {
     return null;
   }
 }
 function listJobs() {
   const dir = jobsDir();
-  if (!existsSync98(dir)) return [];
+  if (!existsSync99(dir)) return [];
   const files = readdirSync34(dir).filter((f2) => f2.endsWith(".json")).sort();
   const jobs = [];
   for (const file of files) {
     try {
-      jobs.push(JSON.parse(readFileSync79(join114(dir, file), "utf-8")));
+      jobs.push(JSON.parse(readFileSync80(join115(dir, file), "utf-8")));
     } catch {
     }
   }
   return jobs;
 }
+function pruneOldJobs() {
+  const retentionH = parseFloat(process.env["OA_RUN_RETENTION_H"] || "24");
+  const cutoffMs = Date.now() - (Number.isFinite(retentionH) && retentionH > 0 ? retentionH : 24) * 36e5;
+  const dir = jobsDir();
+  if (!existsSync99(dir)) return { pruned: 0, kept: 0 };
+  let pruned = 0;
+  let kept = 0;
+  for (const file of readdirSync34(dir)) {
+    if (!file.endsWith(".json")) continue;
+    const path8 = join115(dir, file);
+    try {
+      const job = JSON.parse(readFileSync80(path8, "utf-8"));
+      if (job.status === "running") {
+        kept++;
+        continue;
+      }
+      const ageRef = job.completedAt || job.startedAt;
+      const ts = ageRef ? Date.parse(ageRef) : NaN;
+      if (Number.isFinite(ts) && ts < cutoffMs) {
+        try {
+          unlinkSync24(path8);
+        } catch {
+        }
+        const outFile = path8.replace(/\.json$/, ".output");
+        if (existsSync99(outFile)) {
+          try {
+            unlinkSync24(outFile);
+          } catch {
+          }
+        }
+        pruned++;
+      } else {
+        kept++;
+      }
+    } catch {
+      try {
+        unlinkSync24(path8);
+        pruned++;
+      } catch {
+      }
+    }
+  }
+  return { pruned, kept };
+}
 function getKeyUsage(user) {
   if (!perKeyUsage.has(user)) {
     perKeyUsage.set(user, { requestTimestamps: [], tokensToday: 0, tokenDate: (/* @__PURE__ */ new Date()).toISOString().slice(0, 10), activeJobs: 0 });
@@ -587909,14 +588329,14 @@ function autoSeedTodosFromPrompt(prompt) {
   return [];
 }
 function atomicJobWrite(dir, id, job) {
-  const finalPath = join114(dir, `${id}.json`);
+  const finalPath = join115(dir, `${id}.json`);
   const tmpPath = `${finalPath}.tmp.${process.pid}.${Date.now()}`;
   try {
-    writeFileSync54(tmpPath, JSON.stringify(job, null, 2), "utf-8");
+    writeFileSync55(tmpPath, JSON.stringify(job, null, 2), "utf-8");
     renameSync8(tmpPath, finalPath);
   } catch {
     try {
-      writeFileSync54(finalPath, JSON.stringify(job, null, 2), "utf-8");
+      writeFileSync55(finalPath, JSON.stringify(job, null, 2), "utf-8");
     } catch {
     }
     try {
@@ -587948,8 +588368,27 @@ function resolveAuth(req2) {
     return { authenticated: false, scope: "read" };
   }
   const singleKey = process.env["OA_API_KEY"];
+  if (singleKey) {
+    if (token === singleKey) return { authenticated: true, scope: "admin" };
+  }
+  if (token) {
+    try {
+      const { lookupKey: _lk } = require3("./runtime-keys.js");
+      const rec = _lk(token);
+      if (rec) {
+        return {
+          authenticated: true,
+          scope: rec.scope,
+          user: rec.owner,
+          rpm: rec.rpm,
+          tpd: rec.tpd,
+          maxJobs: rec.max_jobs
+        };
+      }
+    } catch {
+    }
+  }
   if (!singleKey) return { authenticated: true, scope: "admin" };
-  if (token === singleKey) return { authenticated: true, scope: "admin" };
   return { authenticated: false, scope: "read" };
 }
 function checkAuth(req2, res, requiredScope = "read") {
@@ -588070,7 +588509,41 @@ function handleHelp(req2, res) {
         },
         off_device_policy: "Tools with off_device_allowed=false are loopback-only; remote callers need admin scope to bypass.",
         anonymous_default: "Loopback callers default to admin scope. Remote callers default to read scope until authenticated.",
-        override: "Operators can override per-tool classification via OA_TOOL_OVERRIDES env var (JSON map of name → partial security info)."
+        override: "Operators can override per-tool classification via OA_TOOL_OVERRIDES env var (JSON map of name → partial security info).",
+        filters: "GET /v1/tools supports ?category=, ?scope=, ?risk=, ?off_device=true|false (Q9). E.g. /v1/tools?scope=read&off_device=true returns the safe-to-expose set."
+      },
+      runtime_keys: {
+        "GET /v1/keys": "List runtime keys (admin scope). Secrets masked.",
+        "POST /v1/keys": "Mint a runtime key (admin scope). Body: {scope, owner, profile?, rpm?, tpd?, max_jobs?}. Returns full secret ONCE.",
+        "DELETE /v1/keys/{prefix}": "Revoke a key by its first 8+ chars (admin scope). Soft-delete; record retained for audit.",
+        env_alternative: 'OA_API_KEY (single, admin) or OA_API_KEYS="key:scope:owner:rpm:tpd:max_jobs,...". Runtime keys are checked AFTER env keys.',
+        per_key_profile: "Bind a key to a tool profile (allow/deny lists from /v1/profiles) for capability scoping beyond coarse read/run/admin.",
+        storage: "~/.open-agents/keys.json (mode 600). Soft-deleted keys are kept for audit."
+      },
+      agent_loop_inference: {
+        enable: "POST /v1/chat/completions with body {agent_loop: true} runs an N-turn server-side loop. Daemon executes any tool_calls matching daemon-resident tools and re-prompts; client-side tool_calls cause the loop to yield back so caller can execute them.",
+        merge_daemon_tools: "Body field include_daemon_tools: ['read'] (or ['read','run']) merges the daemon's matching tools into the offered tools[] array automatically — no need to hand-list web_search/web_fetch/file_read/etc.",
+        max_turns: "Body field max_turns (default 8, max 64).",
+        timeout: "Body field timeout_s caps the whole loop (default 30 min, max 1 hour). Per-backend-call timeout is separate (see OA_BACKEND_TIMEOUT_S).",
+        prompt_template: "Body field prompt_template: 'factual-first' prepends a system message instructing the model to call web_search FIRST for any factual question.",
+        response_envelope: "Standard OpenAI chat.completion shape PLUS a _agent_loop: {turns, log:[], done, reason} field. Reason is one of: model_returned_content, client_tools_pending, max_turns_exhausted."
+      },
+      backend_timeout: {
+        env: "OA_BACKEND_TIMEOUT_S — default 120 seconds, max 3600 (1 hour).",
+        per_request: "Body field timeout_s on /v1/chat/completions, /v1/run, agent_loop. Caps to 1h.",
+        rationale: "Q1 (Cody/SA) — was hardcoded 120s, broke cold-start tool-calling thinks on large models."
+      },
+      run_lifecycle: {
+        gc: "Q10 — completed/failed runs older than OA_RUN_RETENTION_H hours (default 24) are pruned at startup and on a 1h interval. Set OA_RUN_RETENTION_H=0 to disable. Running runs are never pruned.",
+        manual_delete: "DELETE /v1/runs/{id} — explicit cleanup."
+      },
+      sse_chunk_shape: {
+        chat_completions: "Standard OpenAI delta shape. tool_calls in delta: [{id:'call_<hex>', type:'function', index:N, function:{name:'...', arguments:'<JSON-string>'}}]. Final chunk: {choices:[{finish_reason:'stop', delta:{}}]} then 'data: [DONE]'.",
+        events_bus: "GET /v1/events streams the daemon-event bus (different shape): event:'tool.called', data:{run_id, tool, args, ts}. NOT the same as chat completions SSE."
+      },
+      parallel_tool_calls: {
+        passthrough: "Request body field parallel_tool_calls: true is forwarded to the backend (Ollama/vLLM). Models supporting it (qwen3, llama3) emit multiple tool_calls in one response — daemon forwards them in delta.tool_calls[].",
+        agent_loop: "When agent_loop=true with multiple daemon-tool tool_calls, all execute sequentially (still server-side; saves N round-trips vs the client doing each one)."
       },
       mcp: {
         "GET /v1/mcps": "List connected MCP (Model Context Protocol) servers",
@@ -588309,6 +588782,277 @@ async function handleApiTags(res) {
     });
   }
 }
+async function runAgentLoopChatCompletions(opts) {
+  const { req: req2, res, ollamaUrl, requestBody, perReqTimeoutS } = opts;
+  const startMs = Date.now();
+  const reqTimeoutMs = getBackendTimeoutMs(perReqTimeoutS);
+  const totalDeadline = startMs + (perReqTimeoutS && perReqTimeoutS > 0 ? Math.min(perReqTimeoutS * 1e3, BACKEND_TIMEOUT_MAX_MS) : 30 * 60 * 1e3);
+  const model = requestBody["model"] || "unknown";
+  const route = resolveModelEndpoint(model);
+  const targetUrl = route?.endpoint.url ?? ollamaUrl;
+  const targetType = route?.endpoint.type ?? loadConfig().backendType ?? "ollama";
+  const originalModel = route?.originalId ?? model;
+  const maxTurns = typeof requestBody["max_turns"] === "number" ? Math.max(1, Math.min(64, requestBody["max_turns"])) : 8;
+  const remoteIp = (req2.socket?.remoteAddress || "").replace(/^::ffff:/, "");
+  const origin = /^(127\.\d+\.\d+\.\d+|::1|localhost)$/.test(remoteIp) ? "loopback" : "remote";
+  const reqAuth = req2;
+  const scope = reqAuth._authScope ?? (origin === "loopback" ? "admin" : "read");
+  const execMod = await Promise.resolve().then(() => (init_dist5(), dist_exports)).catch(() => null);
+  if (!execMod) {
+    jsonResponse(res, 500, { error: "Execution module unavailable" });
+    return;
+  }
+  const classify = execMod.classifyTool;
+  const canInvoke = execMod.canInvokeTool;
+  const daemonTools = /* @__PURE__ */ new Map();
+  for (const [classKey, value2] of Object.entries(execMod)) {
+    if (typeof value2 !== "function") continue;
+    const proto = value2.prototype;
+    if (!proto || typeof proto.execute !== "function") continue;
+    let probe = null;
+    try {
+      probe = new value2();
+    } catch {
+      try {
+        probe = new value2(process.cwd());
+      } catch {
+        probe = null;
+      }
+    }
+    if (probe?.name && typeof probe.name === "string") {
+      daemonTools.set(probe.name, { ToolClass: value2, classKey });
+    }
+  }
+  const includeDaemonTools = Array.isArray(requestBody["include_daemon_tools"]) ? requestBody["include_daemon_tools"].filter((s2) => typeof s2 === "string") : [];
+  const advertisedDaemonNames = /* @__PURE__ */ new Set();
+  if (includeDaemonTools.length > 0) {
+    for (const [toolName, { ToolClass: _T }] of daemonTools.entries()) {
+      void _T;
+      const sec = classify(toolName);
+      if (!sec) continue;
+      if (!includeDaemonTools.includes(sec.requires_scope)) continue;
+      if (canInvoke({ toolName, origin, scope }) !== null) continue;
+      advertisedDaemonNames.add(toolName);
+    }
+  }
+  const callerTools = Array.isArray(requestBody["tools"]) ? requestBody["tools"].filter((t2) => t2?.type === "function" && typeof t2?.function?.name === "string") : [];
+  const callerToolNames = new Set(callerTools.map((t2) => t2.function.name));
+  const daemonToolEntries = [];
+  for (const name10 of advertisedDaemonNames) {
+    if (callerToolNames.has(name10)) continue;
+    const meta = daemonTools.get(name10);
+    if (!meta) continue;
+    let inst = null;
+    try {
+      inst = new meta.ToolClass();
+    } catch {
+      try {
+        inst = new meta.ToolClass(process.cwd());
+      } catch {
+        inst = null;
+      }
+    }
+    if (!inst) continue;
+    daemonToolEntries.push({
+      type: "function",
+      function: {
+        name: name10,
+        description: typeof inst.description === "string" ? inst.description : "",
+        parameters: inst.parameters ?? { type: "object", properties: {} }
+      }
+    });
+  }
+  const mergedTools = [...callerTools, ...daemonToolEntries];
+  const messages2 = Array.isArray(requestBody["messages"]) ? requestBody["messages"].slice() : [];
+  const promptTemplate = typeof requestBody["prompt_template"] === "string" ? requestBody["prompt_template"] : null;
+  if (promptTemplate === "factual-first" && advertisedDaemonNames.has("web_search")) {
+    const SYSTEM_FACTUAL_FIRST = [
+      "[POLICY: factual-first]",
+      "For any user question that asks for a fact, statistic, current event,",
+      "person/place/product detail, or anything you might be tempted to answer",
+      "from training data alone — your FIRST tool_call MUST be `web_search`",
+      "with a query derived from the user's question. Do NOT answer from",
+      "training data. After web_search returns, optionally call `web_fetch`",
+      "on the most relevant URL, then synthesize a grounded answer citing",
+      "the source. Decline to answer factual questions if web_search is",
+      "unavailable."
+    ].join(" ");
+    const firstSystemIdx = messages2.findIndex((m2) => m2.role === "system");
+    if (firstSystemIdx >= 0 && typeof messages2[firstSystemIdx].content === "string") {
+      messages2[firstSystemIdx] = {
+        ...messages2[firstSystemIdx],
+        content: `${SYSTEM_FACTUAL_FIRST}
+
+${messages2[firstSystemIdx].content}`
+      };
+    } else {
+      messages2.unshift({ role: "system", content: SYSTEM_FACTUAL_FIRST });
+    }
+  }
+  const chatId = `chatcmpl-${randomBytes23(12).toString("hex")}`;
+  const turnsLog = [];
+  for (let turn = 1; turn <= maxTurns; turn++) {
+    if (Date.now() > totalDeadline) {
+      jsonResponse(res, 504, {
+        error: "agent_loop timed out",
+        turn,
+        elapsed_ms: Date.now() - startMs,
+        timeout_s: perReqTimeoutS ?? null
+      });
+      return;
+    }
+    const turnBody = {
+      ...requestBody,
+      model: originalModel,
+      messages: messages2,
+      tools: mergedTools.length > 0 ? mergedTools : void 0,
+      stream: false,
+      // Strip our own loop-control fields so they don't confuse the backend
+      agent_loop: void 0,
+      include_daemon_tools: void 0,
+      max_turns: void 0,
+      timeout_s: void 0
+    };
+    for (const k of Object.keys(turnBody)) if (turnBody[k] === void 0) delete turnBody[k];
+    let parsed;
+    try {
+      const path8 = targetType === "vllm" || targetType === "openai" ? "/v1/chat/completions" : "/v1/chat/completions";
+      const result = await ollamaRequest(targetUrl, path8, "POST", JSON.stringify(turnBody), reqTimeoutMs);
+      if (result.status !== 200) {
+        jsonResponse(res, result.status, {
+          error: "Backend request failed during agent_loop",
+          turn,
+          details: result.body.slice(0, 500)
+        });
+        return;
+      }
+      parsed = JSON.parse(result.body);
+    } catch (err) {
+      jsonResponse(res, 502, {
+        error: "Backend proxy error during agent_loop",
+        message: err instanceof Error ? err.message : String(err),
+        turn
+      });
+      return;
+    }
+    const choice = parsed?.choices?.[0];
+    const message2 = choice?.message || { role: "assistant", content: "" };
+    const toolCalls = Array.isArray(message2.tool_calls) ? message2.tool_calls : [];
+    if (toolCalls.length === 0) {
+      jsonResponse(res, 200, {
+        ...parsed,
+        id: chatId,
+        _agent_loop: { turns: turn, log: turnsLog, done: true, reason: "model_returned_content" }
+      });
+      return;
+    }
+    const daemonCalls = [];
+    const clientCalls = [];
+    for (const tc of toolCalls) {
+      const name10 = tc?.function?.name ?? tc?.name ?? "";
+      if (advertisedDaemonNames.has(name10)) daemonCalls.push(tc);
+      else clientCalls.push(tc);
+    }
+    if (clientCalls.length > 0) {
+      turnsLog.push({ turn, tool_calls: toolCalls.length, daemon_executed: 0, client_yielded: clientCalls.length });
+      jsonResponse(res, 200, {
+        ...parsed,
+        id: chatId,
+        _agent_loop: {
+          turns: turn,
+          log: turnsLog,
+          done: false,
+          reason: "client_tools_pending",
+          pending_tool_calls: clientCalls.length
+        }
+      });
+      return;
+    }
+    messages2.push(message2);
+    let executed = 0;
+    for (const tc of daemonCalls) {
+      const name10 = tc?.function?.name ?? tc?.name ?? "";
+      const argsRaw = tc?.function?.arguments ?? tc?.arguments ?? "{}";
+      let args = {};
+      try {
+        args = typeof argsRaw === "string" ? JSON.parse(argsRaw) : argsRaw || {};
+      } catch {
+        args = {};
+      }
+      const denial = canInvoke({ toolName: name10, origin, scope });
+      if (denial) {
+        messages2.push({
+          role: "tool",
+          tool_call_id: tc.id,
+          name: name10,
+          content: JSON.stringify({ error: denial.reason, status: denial.status })
+        });
+        continue;
+      }
+      const meta = daemonTools.get(name10);
+      if (!meta) {
+        messages2.push({
+          role: "tool",
+          tool_call_id: tc.id,
+          name: name10,
+          content: JSON.stringify({ error: `Daemon tool '${name10}' not found` })
+        });
+        continue;
+      }
+      let tool = null;
+      try {
+        tool = new meta.ToolClass(process.cwd());
+      } catch {
+        try {
+          tool = new meta.ToolClass();
+        } catch {
+          tool = null;
+        }
+      }
+      if (!tool) {
+        messages2.push({
+          role: "tool",
+          tool_call_id: tc.id,
+          name: name10,
+          content: JSON.stringify({ error: `Could not instantiate ${meta.classKey}` })
+        });
+        continue;
+      }
+      let toolResult;
+      try {
+        toolResult = await tool.execute(args);
+      } catch (e2) {
+        toolResult = { success: false, output: "", error: e2 instanceof Error ? e2.message : String(e2), durationMs: 0 };
+      }
+      messages2.push({
+        role: "tool",
+        tool_call_id: tc.id,
+        name: name10,
+        content: JSON.stringify(toolResult)
+      });
+      executed++;
+    }
+    turnsLog.push({ turn, tool_calls: toolCalls.length, daemon_executed: executed, client_yielded: 0 });
+  }
+  jsonResponse(res, 200, {
+    id: chatId,
+    object: "chat.completion",
+    created: Math.floor(Date.now() / 1e3),
+    model,
+    choices: [{
+      index: 0,
+      message: { role: "assistant", content: "[agent_loop reached max_turns without producing a final answer]" },
+      finish_reason: "length"
+    }],
+    _agent_loop: {
+      turns: maxTurns,
+      log: turnsLog,
+      done: false,
+      reason: "max_turns_exhausted",
+      max_turns: maxTurns
+    }
+  });
+}
 async function handleV1ChatCompletions(req2, res, ollamaUrl) {
   const body = await parseJsonBody(req2);
   if (!body || typeof body !== "object") {
@@ -588318,6 +589062,18 @@ async function handleV1ChatCompletions(req2, res, ollamaUrl) {
   const requestBody = body;
   const stream = requestBody["stream"] === true;
   const model = requestBody["model"] || "unknown";
+  const perReqTimeoutS = typeof requestBody["timeout_s"] === "number" ? requestBody["timeout_s"] : void 0;
+  if (requestBody["agent_loop"] === true) {
+    await runAgentLoopChatCompletions({
+      req: req2,
+      res,
+      ollamaUrl,
+      requestBody,
+      perReqTimeoutS
+    });
+    return;
+  }
+  const reqTimeoutMs = getBackendTimeoutMs(perReqTimeoutS);
   const route = resolveModelEndpoint(model);
   const targetUrl = route?.endpoint.url ?? ollamaUrl;
   const targetType = route?.endpoint.type ?? loadConfig().backendType ?? "ollama";
@@ -588357,11 +589113,12 @@ async function handleV1ChatCompletions(req2, res, ollamaUrl) {
           } catch {
           }
           res.end();
-        }
+        },
+        reqTimeoutMs
       );
     } else {
       try {
-        const result = await ollamaRequest(targetUrl, "/v1/chat/completions", "POST", payload);
+        const result = await ollamaRequest(targetUrl, "/v1/chat/completions", "POST", payload, reqTimeoutMs);
         if (result.status !== 200) {
           jsonResponse(res, result.status, { error: "Backend request failed", details: result.body });
           return;
@@ -588397,7 +589154,7 @@ async function handleV1ChatCompletions(req2, res, ollamaUrl) {
       "Cache-Control": "no-cache",
       "Connection": "keep-alive"
     });
-    const chatId = `chatcmpl-${randomBytes22(12).toString("hex")}`;
+    const chatId = `chatcmpl-${randomBytes23(12).toString("hex")}`;
     let buffer2 = "";
     ollamaStream(
       targetUrl,
@@ -588439,7 +589196,7 @@ async function handleV1ChatCompletions(req2, res, ollamaUrl) {
               if (ollamaChunk.message.content) delta.content = ollamaChunk.message.content;
               if (ollamaChunk.message.tool_calls) {
                 delta.tool_calls = ollamaChunk.message.tool_calls.map((tc, idx) => ({
-                  id: tc.id || `call_${randomBytes22(8).toString("hex")}`,
+                  id: tc.id || `call_${randomBytes23(8).toString("hex")}`,
                   type: "function",
                   function: {
                     name: tc?.function?.name ?? tc?.name ?? "",
@@ -588501,11 +589258,12 @@ async function handleV1ChatCompletions(req2, res, ollamaUrl) {
         } catch {
         }
         res.end();
-      }
+      },
+      reqTimeoutMs
     );
   } else {
     try {
-      const result = await ollamaRequest(targetUrl, "/api/chat", "POST", ollamaPayload);
+      const result = await ollamaRequest(targetUrl, "/api/chat", "POST", ollamaPayload, reqTimeoutMs);
       if (result.status !== 200) {
         jsonResponse(res, result.status, {
           error: "Ollama request failed",
@@ -588517,14 +589275,14 @@ async function handleV1ChatCompletions(req2, res, ollamaUrl) {
       if (ollamaResp.eval_count) metrics.totalTokensOut += ollamaResp.eval_count;
       if (ollamaResp.prompt_eval_count) metrics.totalTokensIn += ollamaResp.prompt_eval_count;
       trackTokens("local", ollamaResp.prompt_eval_count ?? 0, ollamaResp.eval_count ?? 0);
-      const chatId = `chatcmpl-${randomBytes22(12).toString("hex")}`;
+      const chatId = `chatcmpl-${randomBytes23(12).toString("hex")}`;
       const responseMessage = {
         role: ollamaResp.message?.role ?? "assistant",
         content: ollamaResp.message?.content ?? ""
       };
       if (ollamaResp.message?.tool_calls && ollamaResp.message.tool_calls.length > 0) {
         responseMessage.tool_calls = ollamaResp.message.tool_calls.map((tc, idx) => ({
-          id: tc.id || `call_${randomBytes22(8).toString("hex")}`,
+          id: tc.id || `call_${randomBytes23(8).toString("hex")}`,
           type: "function",
           function: {
             name: tc?.function?.name ?? tc?.name ?? "",
@@ -588997,27 +589755,27 @@ ${task}` : task;
   });
 }
 function updateStateFile() {
-  return join114(homedir40(), ".open-agents", "update-state.json");
+  return join115(homedir41(), ".open-agents", "update-state.json");
 }
 function updateLogPath() {
-  return join114(homedir40(), ".open-agents", "update.log");
+  return join115(homedir41(), ".open-agents", "update.log");
 }
 function readUpdateState() {
   try {
     const p2 = updateStateFile();
-    if (!existsSync98(p2)) return null;
-    return JSON.parse(readFileSync79(p2, "utf-8"));
+    if (!existsSync99(p2)) return null;
+    return JSON.parse(readFileSync80(p2, "utf-8"));
   } catch {
     return null;
   }
 }
 function writeUpdateState(state) {
   try {
-    const dir = join114(homedir40(), ".open-agents");
-    mkdirSync62(dir, { recursive: true });
+    const dir = join115(homedir41(), ".open-agents");
+    mkdirSync63(dir, { recursive: true });
     const finalPath = updateStateFile();
     const tmpPath = `${finalPath}.tmp.${process.pid}`;
-    writeFileSync54(tmpPath, JSON.stringify(state, null, 2), "utf-8");
+    writeFileSync55(tmpPath, JSON.stringify(state, null, 2), "utf-8");
     renameSync8(tmpPath, finalPath);
   } catch {
   }
@@ -589061,15 +589819,15 @@ async function handleV1Update(req2, res, requestId) {
     const { execSync: es } = require3("node:child_process");
     const isWin2 = process.platform === "win32";
     let npmBin = "";
-    for (const candidate of isWin2 ? [join114(nodeDir, "npm.cmd"), join114(nodeDir, "npm")] : [join114(nodeDir, "npm"), "/usr/local/bin/npm", "/usr/bin/npm"]) {
-      if (existsSync98(candidate)) {
+    for (const candidate of isWin2 ? [join115(nodeDir, "npm.cmd"), join115(nodeDir, "npm")] : [join115(nodeDir, "npm"), "/usr/local/bin/npm", "/usr/bin/npm"]) {
+      if (existsSync99(candidate)) {
         npmBin = candidate;
         break;
       }
     }
     if (!npmBin) npmBin = isWin2 ? "npm.cmd" : "npm";
     const pkgSpec = `open-agents-ai@${targetVersion}`;
-    const dir = join114(homedir40(), ".open-agents");
+    const dir = join115(homedir41(), ".open-agents");
     fs7.mkdirSync(dir, { recursive: true });
     const logFd = fs7.openSync(logPath3, "w");
     const npmPrefix = dirname35(nodeDir);
@@ -589079,13 +589837,13 @@ async function handleV1Update(req2, res, requestId) {
         globalBinDir = es(`${npmBin} bin -g`, { encoding: "utf8", timeout: 5e3, stdio: "pipe" }).trim();
       } else {
         const npmCliCandidates = [
-          join114(nodeDir, "..", "lib", "node_modules", "npm", "bin", "npm-cli.js"),
-          join114(npmBin, "..", "..", "lib", "node_modules", "npm", "bin", "npm-cli.js")
+          join115(nodeDir, "..", "lib", "node_modules", "npm", "bin", "npm-cli.js"),
+          join115(npmBin, "..", "..", "lib", "node_modules", "npm", "bin", "npm-cli.js")
         ];
         let npmCli = "";
         for (const c9 of npmCliCandidates) {
           try {
-            if (existsSync98(c9)) {
+            if (existsSync99(c9)) {
               npmCli = c9;
               break;
             }
@@ -589117,13 +589875,13 @@ async function handleV1Update(req2, res, requestId) {
       });
     } else {
       const npmCliCandidates = [
-        join114(nodeDir, "..", "lib", "node_modules", "npm", "bin", "npm-cli.js"),
-        join114(npmBin, "..", "..", "lib", "node_modules", "npm", "bin", "npm-cli.js")
+        join115(nodeDir, "..", "lib", "node_modules", "npm", "bin", "npm-cli.js"),
+        join115(npmBin, "..", "..", "lib", "node_modules", "npm", "bin", "npm-cli.js")
       ];
       let npmCli = "";
       for (const c9 of npmCliCandidates) {
         try {
-          if (existsSync98(c9)) {
+          if (existsSync99(c9)) {
             npmCli = c9;
             break;
           }
@@ -589220,8 +589978,8 @@ function handleV1UpdateStatus(res) {
   let logTail = "";
   let exitCode = null;
   try {
-    if (existsSync98(logPath3)) {
-      const raw = readFileSync79(logPath3, "utf-8");
+    if (existsSync99(logPath3)) {
+      const raw = readFileSync80(logPath3, "utf-8");
       const m2 = raw.match(/__EXIT_CODE=(\d+)/);
       if (m2) exitCode = parseInt(m2[1], 10);
       logTail = raw.slice(-2e3);
@@ -589309,7 +590067,7 @@ async function handleV1Run(req2, res) {
       return;
     }
   }
-  const id = `job-${randomBytes22(8).toString("hex")}`;
+  const id = `job-${randomBytes23(8).toString("hex")}`;
   const dir = jobsDir();
   const workingDir = requestBody["working_directory"] || req2.headers["x-working-directory"];
   const isolate = requestBody["isolate"] === true;
@@ -589317,8 +590075,8 @@ async function handleV1Run(req2, res) {
   if (workingDir) {
     cwd4 = resolve38(workingDir);
   } else if (isolate) {
-    const wsDir = join114(dir, "..", "workspaces", id);
-    mkdirSync62(wsDir, { recursive: true });
+    const wsDir = join115(dir, "..", "workspaces", id);
+    mkdirSync63(wsDir, { recursive: true });
     cwd4 = wsDir;
   } else {
     cwd4 = resolve38(process.cwd());
@@ -589460,7 +590218,7 @@ async function handleV1Run(req2, res) {
     let output = "";
     let tailBytes = 0;
     const TAIL_BUDGET = 1048576;
-    const outputWriter = new DiskTaskOutput(join114(dir, `${id}.output`));
+    const outputWriter = new DiskTaskOutput(join115(dir, `${id}.output`));
     job.outputFile = outputWriter.path;
     atomicJobWrite(dir, id, job);
     child.stdout?.on("data", (chunk) => {
@@ -590353,10 +591111,10 @@ async function handleRequest(req2, res, ollamaUrl, verbose) {
           return;
         }
         const { tmpdir: tmpdir22 } = await import("node:os");
-        const { writeFileSync: writeFileSync58, unlinkSync: unlinkSync25 } = await import("node:fs");
+        const { writeFileSync: writeFileSync59, unlinkSync: unlinkSync25 } = await import("node:fs");
         const { join: pjoin } = await import("node:path");
         const tmpPath = pjoin(tmpdir22(), `oa-clone-upload-${Date.now()}-${safeName}`);
-        writeFileSync58(tmpPath, buf);
+        writeFileSync59(tmpPath, buf);
         try {
           const ve = getVoiceEngine();
           const msg = await ve.setCloneVoice(tmpPath);
@@ -590906,7 +591664,7 @@ data: ${JSON.stringify(data)}
         }
         for (const f2 of seenFiles) {
           try {
-            writeFileSync54(f2, JSON.stringify({ tasks: [] }, null, 2));
+            writeFileSync55(f2, JSON.stringify({ tasks: [] }, null, 2));
             deleted++;
           } catch {
           }
@@ -591968,7 +592726,7 @@ ${steering}`;
 function getScheduleRoots() {
   const rootsEnv = process.env["OA_SCHEDULE_ROOTS"] || "";
   const roots = rootsEnv.split(rootsEnv.includes(";") ? ";" : ":").filter(Boolean);
-  const defaults3 = [process.cwd(), join114(homedir40(), "Documents")];
+  const defaults3 = [process.cwd(), join115(homedir41(), "Documents")];
   const set = /* @__PURE__ */ new Set([...defaults3, ...roots]);
   return [...set];
 }
@@ -591980,10 +592738,10 @@ function listScheduledTasks() {
   for (const root of roots) {
     try {
       walk(root, 0, (dir) => {
-        if (dir.endsWith(`${join114(".oa", "scheduled")}`) || dir.includes(`${join114(".oa", "scheduled")}`)) {
-          const file = join114(dir, "tasks.json");
+        if (dir.endsWith(`${join115(".oa", "scheduled")}`) || dir.includes(`${join115(".oa", "scheduled")}`)) {
+          const file = join115(dir, "tasks.json");
           try {
-            const raw = readFileSync79(file, "utf-8");
+            const raw = readFileSync80(file, "utf-8");
             const json = JSON.parse(raw);
             const tasks = Array.isArray(json?.tasks) ? json.tasks : Array.isArray(json) ? json : [];
             tasks.forEach((t2, i2) => {
@@ -592048,7 +592806,7 @@ function walk(dir, depth, onDir, maxDepth) {
     if (e2.name === "node_modules" || e2.name.startsWith(".")) {
       if (e2.name !== ".oa") continue;
     }
-    const child = join114(dir, e2.name);
+    const child = join115(dir, e2.name);
     walk(child, depth + 1, onDir, maxDepth);
   }
 }
@@ -592057,18 +592815,18 @@ function setScheduledEnabled(id, enabled2) {
   const target = tasks.find((t2) => t2.id === id);
   if (!target) return false;
   try {
-    const raw = readFileSync79(target.file, "utf-8");
+    const raw = readFileSync80(target.file, "utf-8");
     const json = JSON.parse(raw);
     const arr = Array.isArray(json?.tasks) ? json.tasks : Array.isArray(json) ? json : [];
     if (!arr[target.index]) return false;
     arr[target.index].enabled = enabled2;
     if (Array.isArray(json?.tasks)) {
       json.tasks = arr;
-      writeFileSync54(target.file, JSON.stringify(json, null, 2));
+      writeFileSync55(target.file, JSON.stringify(json, null, 2));
     } else if (Array.isArray(json)) {
-      writeFileSync54(target.file, JSON.stringify(arr, null, 2));
+      writeFileSync55(target.file, JSON.stringify(arr, null, 2));
     } else {
-      writeFileSync54(target.file, JSON.stringify({ tasks: arr }, null, 2));
+      writeFileSync55(target.file, JSON.stringify({ tasks: arr }, null, 2));
     }
     if (!enabled2) {
       try {
@@ -592090,7 +592848,7 @@ function deleteScheduledById(id) {
   const target = tasks.find((t2) => t2.id === id);
   if (!target) return false;
   try {
-    const raw = readFileSync79(target.file, "utf-8");
+    const raw = readFileSync80(target.file, "utf-8");
     const json = JSON.parse(raw);
     const arr = Array.isArray(json?.tasks) ? json.tasks : Array.isArray(json) ? json : [];
     if (!arr[target.index]) return false;
@@ -592098,11 +592856,11 @@ function deleteScheduledById(id) {
     arr.splice(target.index, 1);
     if (Array.isArray(json?.tasks)) {
       json.tasks = arr;
-      writeFileSync54(target.file, JSON.stringify(json, null, 2));
+      writeFileSync55(target.file, JSON.stringify(json, null, 2));
     } else if (Array.isArray(json)) {
-      writeFileSync54(target.file, JSON.stringify(arr, null, 2));
+      writeFileSync55(target.file, JSON.stringify(arr, null, 2));
     } else {
-      writeFileSync54(target.file, JSON.stringify({ tasks: arr }, null, 2));
+      writeFileSync55(target.file, JSON.stringify({ tasks: arr }, null, 2));
     }
     const candidates = [];
     if (id) candidates.push(id);
@@ -592355,11 +593113,11 @@ function reconcileScheduledTasks(apply) {
   const errors = [];
   for (const f2 of found) {
     const wdir = f2.workingDir || process.cwd();
-    const file = join114(wdir, ".oa", "scheduled", "tasks.json");
+    const file = join115(wdir, ".oa", "scheduled", "tasks.json");
     try {
       let json = { tasks: [] };
       try {
-        const raw = readFileSync79(file, "utf-8");
+        const raw = readFileSync80(file, "utf-8");
         json = JSON.parse(raw);
       } catch {
       }
@@ -592370,9 +593128,9 @@ function reconcileScheduledTasks(apply) {
           const entry = { task: f2.task || `legacy ${f2.id}`, schedule: f2.cron, enabled: true };
           arr.push(entry);
           const toWrite = Array.isArray(json?.tasks) ? { ...json, tasks: arr } : Array.isArray(json) ? arr : { tasks: arr };
-          mkdirSync62(join114(wdir, ".oa", "scheduled"), { recursive: true });
-          mkdirSync62(join114(wdir, ".oa", "scheduled", "logs"), { recursive: true });
-          writeFileSync54(file, JSON.stringify(toWrite, null, 2));
+          mkdirSync63(join115(wdir, ".oa", "scheduled"), { recursive: true });
+          mkdirSync63(join115(wdir, ".oa", "scheduled", "logs"), { recursive: true });
+          writeFileSync55(file, JSON.stringify(toWrite, null, 2));
           adopted.push({ file, index: arr.length - 1 });
         }
       } else {
@@ -592416,32 +593174,32 @@ function writeCrontabLines(lines) {
 }
 function canonicalCronLine(rec) {
   const oaBin = findOaBinary4();
-  const logDir = join114(rec.workingDir, ".oa", "scheduled", "logs");
-  const logFile = join114(logDir, `${rec.id}.log`);
-  const storeFile = join114(rec.workingDir, ".oa", "scheduled", "tasks.json");
+  const logDir = join115(rec.workingDir, ".oa", "scheduled", "logs");
+  const logFile = join115(logDir, `${rec.id}.log`);
+  const storeFile = join115(rec.workingDir, ".oa", "scheduled", "tasks.json");
   const taskEsc = rec.task.replace(/'/g, "'\\''");
-  const lockDir = join114(rec.workingDir, ".oa", "run");
-  const lockPath = join114(lockDir, `${rec.id}.lock`);
+  const lockDir = join115(rec.workingDir, ".oa", "run");
+  const lockPath = join115(lockDir, `${rec.id}.lock`);
   const wrapper = [
     `cd ${JSON.stringify(rec.workingDir)}`,
     `mkdir -p ${JSON.stringify(logDir)}`,
     `mkdir -p ${JSON.stringify(lockDir)}`,
     `if mkdir ${JSON.stringify(lockPath)} 2>/dev/null; then`,
-    `  echo $$ > ${JSON.stringify(join114(lockPath, "pid"))}`,
+    `  echo $$ > ${JSON.stringify(join115(lockPath, "pid"))}`,
     `  trap 'rm -rf ${lockPath}' EXIT`,
     `else`,
-    `  if [ -f ${JSON.stringify(join114(lockPath, "pid"))} ]; then`,
-    `    oldpid=$(cat ${JSON.stringify(join114(lockPath, "pid"))} 2>/dev/null || echo)`,
+    `  if [ -f ${JSON.stringify(join115(lockPath, "pid"))} ]; then`,
+    `    oldpid=$(cat ${JSON.stringify(join115(lockPath, "pid"))} 2>/dev/null || echo)`,
     `    if [ -n "$oldpid" ] && kill -0 "$oldpid" 2>/dev/null; then`,
     `      echo "[oa-scheduler] ${rec.id} already running as PID $oldpid; skipping" >> ${JSON.stringify(logFile)}`,
     `      exit 0`,
     `    else`,
     `      rm -rf ${JSON.stringify(lockPath)} 2>/dev/null || true`,
-    `      mkdir -p ${JSON.stringify(lockPath)} && echo $$ > ${JSON.stringify(join114(lockPath, "pid"))} && trap 'rm -rf ${lockPath}' EXIT`,
+    `      mkdir -p ${JSON.stringify(lockPath)} && echo $$ > ${JSON.stringify(join115(lockPath, "pid"))} && trap 'rm -rf ${lockPath}' EXIT`,
     `    fi`,
     `  else`,
     `    rm -rf ${JSON.stringify(lockPath)} 2>/dev/null || true`,
-    `    mkdir -p ${JSON.stringify(lockPath)} && echo $$ > ${JSON.stringify(join114(lockPath, "pid"))} && trap 'rm -rf ${lockPath}' EXIT`,
+    `    mkdir -p ${JSON.stringify(lockPath)} && echo $$ > ${JSON.stringify(join115(lockPath, "pid"))} && trap 'rm -rf ${lockPath}' EXIT`,
     `  fi`,
     `fi`,
     `${oaBin} '${taskEsc}' >> ${JSON.stringify(logFile)} 2>&1; _oa_exit=$?`,
@@ -592473,9 +593231,9 @@ function fixupOrMigrateScheduled(mode, dryRun) {
       try {
         if (!f2.workingDir || !f2.task) continue;
         const unitBase = `oa-${f2.id}`;
-        const unitDir = join114(homedir40(), ".config", "systemd", "user");
-        const svc = join114(unitDir, `${unitBase}.service`);
-        const tim = join114(unitDir, `${unitBase}.timer`);
+        const unitDir = join115(homedir41(), ".config", "systemd", "user");
+        const svc = join115(unitDir, `${unitBase}.service`);
+        const tim = join115(unitDir, `${unitBase}.timer`);
         const oaBin = findOaBinary4();
         const rec = { id: f2.id, cron: f2.cron, workingDir: f2.workingDir, task: f2.task };
         const cmd = canonicalCronLine(rec).split(" ").slice(5).join(" ");
@@ -592505,9 +593263,9 @@ Persistent=true
 WantedBy=timers.target
 `;
         if (!dryRun) {
-          mkdirSync62(unitDir, { recursive: true });
-          writeFileSync54(svc, svcText);
-          writeFileSync54(tim, timText);
+          mkdirSync63(unitDir, { recursive: true });
+          writeFileSync55(svc, svcText);
+          writeFileSync55(tim, timText);
           try {
             const { execSync: es } = require3("node:child_process");
             es("systemctl --user daemon-reload", { stdio: "pipe" });
@@ -592601,8 +593359,8 @@ function startApiServer(options2 = {}) {
   const config = loadConfig();
   const ollamaUrl = options2.ollamaUrl ?? config.backendUrl;
   const cwd4 = process.cwd();
-  initAuditLog(join114(cwd4, ".oa"));
-  initUsageTracker(join114(cwd4, ".oa"));
+  initAuditLog(join115(cwd4, ".oa"));
+  initUsageTracker(join115(cwd4, ".oa"));
   try {
     const taskMgr = getSharedTaskManager();
     taskMgr.setEventPublisher((type, data, opts) => {
@@ -592644,7 +593402,7 @@ function startApiServer(options2 = {}) {
   try {
     const dir = todoDir();
     try {
-      mkdirSync62(dir, { recursive: true });
+      mkdirSync63(dir, { recursive: true });
     } catch {
     }
     const cache8 = /* @__PURE__ */ new Map();
@@ -592653,7 +593411,7 @@ function startApiServer(options2 = {}) {
         if (!f2.endsWith(".json") || f2.includes(".tmp.")) continue;
         const sid = f2.replace(/\.json$/, "");
         try {
-          const items = JSON.parse(readFileSync79(join114(dir, f2), "utf-8"));
+          const items = JSON.parse(readFileSync80(join115(dir, f2), "utf-8"));
           if (Array.isArray(items)) {
             cache8.set(sid, new Map(items.map((t2) => [t2.id, t2])));
           }
@@ -592665,10 +593423,10 @@ function startApiServer(options2 = {}) {
     const watcher = fsWatch3(dir, (_evt, fname) => {
       if (!fname || !fname.endsWith(".json") || fname.includes(".tmp.")) return;
       const sid = fname.replace(/\.json$/, "");
-      const fp = join114(dir, fname);
+      const fp = join115(dir, fname);
       let next = [];
       try {
-        if (!existsSync98(fp)) {
+        if (!existsSync99(fp)) {
           const old = cache8.get(sid);
           if (old) {
             for (const t2 of old.values()) {
@@ -592681,7 +593439,7 @@ function startApiServer(options2 = {}) {
           }
           return;
         }
-        next = JSON.parse(readFileSync79(fp, "utf-8"));
+        next = JSON.parse(readFileSync80(fp, "utf-8"));
         if (!Array.isArray(next)) return;
       } catch {
         return;
@@ -592720,14 +593478,14 @@ function startApiServer(options2 = {}) {
   const retentionDays = parseInt(process.env["OA_JOB_RETENTION_DAYS"] ?? "30", 10);
   if (retentionDays > 0) {
     try {
-      const jobsDir3 = join114(cwd4, ".oa", "jobs");
-      if (existsSync98(jobsDir3)) {
+      const jobsDir3 = join115(cwd4, ".oa", "jobs");
+      if (existsSync99(jobsDir3)) {
         const cutoff = Date.now() - retentionDays * 864e5;
         for (const f2 of readdirSync34(jobsDir3)) {
           if (!f2.endsWith(".json")) continue;
           try {
-            const jobPath = join114(jobsDir3, f2);
-            const job = JSON.parse(readFileSync79(jobPath, "utf-8"));
+            const jobPath = join115(jobsDir3, f2);
+            const job = JSON.parse(readFileSync80(jobPath, "utf-8"));
             const jobTime = new Date(job.startedAt ?? job.completedAt ?? 0).getTime();
             if (jobTime > 0 && jobTime < cutoff && job.status !== "running") {
               const { unlinkSync: unlinkSync25 } = require3("node:fs");
@@ -592747,8 +593505,8 @@ function startApiServer(options2 = {}) {
   if (useTls) {
     try {
       tlsOpts = {
-        cert: readFileSync79(resolve38(tlsCert)),
-        key: readFileSync79(resolve38(tlsKey))
+        cert: readFileSync80(resolve38(tlsCert)),
+        key: readFileSync80(resolve38(tlsKey))
       };
     } catch (e2) {
       log22(`
@@ -592759,9 +593517,9 @@ function startApiServer(options2 = {}) {
   }
   let runtimeAccessMode = resolveAccessMode(process.env["OA_ACCESS"], host);
   try {
-    const accessFile = join114(homedir40(), ".open-agents", "access");
-    if (existsSync98(accessFile)) {
-      const persisted = readFileSync79(accessFile, "utf8").trim();
+    const accessFile = join115(homedir41(), ".open-agents", "access");
+    if (existsSync99(accessFile)) {
+      const persisted = readFileSync80(accessFile, "utf8").trim();
       const resolved = resolveAccessMode(persisted, host);
       if (resolved) runtimeAccessMode = resolved;
     }
@@ -592814,9 +593572,9 @@ function startApiServer(options2 = {}) {
             const previous = runtimeAccessMode;
             runtimeAccessMode = requested;
             try {
-              const dir = join114(homedir40(), ".open-agents");
-              mkdirSync62(dir, { recursive: true });
-              writeFileSync54(join114(dir, "access"), `${runtimeAccessMode}
+              const dir = join115(homedir41(), ".open-agents");
+              mkdirSync63(dir, { recursive: true });
+              writeFileSync55(join115(dir, "access"), `${runtimeAccessMode}
 `, "utf8");
             } catch {
             }
@@ -593029,9 +593787,9 @@ function startApiServer(options2 = {}) {
       try {
         const { startEmbeddingWorkers: startEmbeddingWorkers2 } = await Promise.resolve().then(() => (init_embedding_workers(), embedding_workers_exports));
         const { ensureEmbedDeps: ensureEmbedDeps2, runEmbedImage: runEmbedImage2, runEmbedAudio: runEmbedAudio2 } = await Promise.resolve().then(() => (init_py_embed(), py_embed_exports));
-        const dbBase = join114(cwd4, ".oa");
-        const epStore = new mem.EpisodeStore(join114(dbBase, "memory.db"));
-        const kg = new mem.TemporalGraph(join114(dbBase, "kg.db"));
+        const dbBase = join115(cwd4, ".oa");
+        const epStore = new mem.EpisodeStore(join115(dbBase, "memory.db"));
+        const kg = new mem.TemporalGraph(join115(dbBase, "kg.db"));
         try {
           ensureEmbedDeps2();
         } catch {
@@ -593108,6 +593866,24 @@ function startApiServer(options2 = {}) {
 `);
     log22(`  Primary: ${config.backendUrl} (${config.backendType || "ollama"})
 `);
+    const _retCheck = process.env["OA_RUN_RETENTION_H"];
+    const _retOff = _retCheck === "0";
+    if (!_retOff) {
+      try {
+        const initial = pruneOldJobs();
+        if (initial.pruned > 0) {
+          log22(`  Run GC: pruned ${initial.pruned} old job records (kept ${initial.kept}).
+`);
+        }
+      } catch {
+      }
+      setInterval(() => {
+        try {
+          pruneOldJobs();
+        } catch {
+        }
+      }, 36e5).unref();
+    }
     if (process.env["OA_API_KEYS"]) {
       const keyCount = process.env["OA_API_KEYS"].split(",").length;
       log22(`  Auth: ${keyCount} scoped key(s) (read/run/admin)
@@ -593228,10 +594004,10 @@ async function handleMemoryIngest(req2, res, ollamaUrl) {
     const labels = Array.isArray(b.labels) ? b.labels : [];
     const mediaPath = typeof b.media_path === "string" ? b.media_path : void 0;
     const cwd4 = process.cwd();
-    const dbBase = join114(cwd4, ".oa");
+    const dbBase = join115(cwd4, ".oa");
     const { EpisodeStore: EpisodeStore3, TemporalGraph: TemporalGraph3 } = await Promise.resolve().then(() => (init_dist7(), dist_exports2));
-    const epStore = new EpisodeStore3(join114(dbBase, "memory.db"));
-    const kg = new TemporalGraph3(join114(dbBase, "kg.db"));
+    const epStore = new EpisodeStore3(join115(dbBase, "memory.db"));
+    const kg = new TemporalGraph3(join115(dbBase, "kg.db"));
     const meta = {};
     if (mediaPath) meta.media_path = mediaPath;
     const epId = epStore.insert({ modality, content: content || (mediaPath || ""), metadata: meta, toolName: "memory_ingest" });
@@ -593298,7 +594074,7 @@ async function handleEntitiesList(req2, res) {
     const type = url.searchParams.get("type") || "person";
     const limit = Math.max(1, Math.min(1e3, parseInt(url.searchParams.get("limit") || "100", 10)));
     const { TemporalGraph: TemporalGraph3 } = await Promise.resolve().then(() => (init_dist7(), dist_exports2));
-    const kg = new TemporalGraph3(join114(process.cwd(), ".oa", "kg.db"));
+    const kg = new TemporalGraph3(join115(process.cwd(), ".oa", "kg.db"));
     const nodes = kg.nodesByType(type, limit).map((n2) => ({ id: n2.id, text: n2.text, mentionCount: n2.mentionCount, firstSeen: n2.firstSeen, lastSeen: n2.lastSeen }));
     jsonResponse(res, 200, { object: "list", data: nodes });
   } catch (err) {
@@ -593320,7 +594096,7 @@ async function handleMemorySearch2(req2, res) {
     const wLex = typeof b.lexical_weight === "number" ? b.lexical_weight : 1;
     const wEmb = typeof b.embedding_weight === "number" ? b.embedding_weight : 1;
     const { EpisodeStore: EpisodeStore3 } = await Promise.resolve().then(() => (init_dist7(), dist_exports2));
-    const epStore = new EpisodeStore3(join114(process.cwd(), ".oa", "memory.db"));
+    const epStore = new EpisodeStore3(join115(process.cwd(), ".oa", "memory.db"));
     const results = epStore.search({ query, modality, limit }, { queryEmbedding: qEmb, lexicalWeight: wLex, embeddingWeight: wEmb });
     jsonResponse(res, 200, { object: "list", data: results.map((e2) => ({ id: e2.id, modality: e2.modality, content: e2.content, timestamp: e2.timestamp })) });
   } catch (err) {
@@ -593387,7 +594163,7 @@ function setTimerEnabled(name10, enabled2) {
     return false;
   }
 }
-var require3, endpointRegistry, modelRouteMap, endpointUsage, metrics, startedAt, runningProcesses, perKeyUsage, CRON_MARKER2;
+var require3, endpointRegistry, modelRouteMap, endpointUsage, BACKEND_TIMEOUT_DEFAULT_MS, BACKEND_TIMEOUT_MAX_MS, metrics, startedAt, runningProcesses, perKeyUsage, CRON_MARKER2;
 var init_serve = __esm({
   "packages/cli/src/api/serve.ts"() {
     "use strict";
@@ -593419,6 +594195,8 @@ var init_serve = __esm({
     endpointRegistry = [];
     modelRouteMap = /* @__PURE__ */ new Map();
     endpointUsage = /* @__PURE__ */ new Map();
+    BACKEND_TIMEOUT_DEFAULT_MS = 12e4;
+    BACKEND_TIMEOUT_MAX_MS = 36e5;
     metrics = {
       requests: /* @__PURE__ */ new Map(),
       totalTokensIn: 0,
@@ -593434,13 +594212,13 @@ var init_serve = __esm({
 
 // packages/cli/src/tui/interactive.ts
 import { cwd } from "node:process";
-import { resolve as resolve39, join as join115, dirname as dirname36, extname as extname12 } from "node:path";
+import { resolve as resolve39, join as join116, dirname as dirname36, extname as extname12 } from "node:path";
 import { createRequire as createRequire5 } from "node:module";
 import { fileURLToPath as fileURLToPath18 } from "node:url";
-import { readFileSync as readFileSync80, writeFileSync as writeFileSync55, appendFileSync as appendFileSync8, rmSync as rmSync5, readdirSync as readdirSync35, mkdirSync as mkdirSync63 } from "node:fs";
-import { existsSync as existsSync99 } from "node:fs";
+import { readFileSync as readFileSync81, writeFileSync as writeFileSync56, appendFileSync as appendFileSync8, rmSync as rmSync5, readdirSync as readdirSync35, mkdirSync as mkdirSync64 } from "node:fs";
+import { existsSync as existsSync100 } from "node:fs";
 import { execSync as execSync56 } from "node:child_process";
-import { homedir as homedir41 } from "node:os";
+import { homedir as homedir42 } from "node:os";
 function formatTimeAgo2(date) {
   const seconds = Math.floor((Date.now() - date.getTime()) / 1e3);
   if (seconds < 60) return "just now";
@@ -593456,12 +594234,12 @@ function getVersion4() {
     const require4 = createRequire5(import.meta.url);
     const thisDir = dirname36(fileURLToPath18(import.meta.url));
     const candidates = [
-      join115(thisDir, "..", "package.json"),
-      join115(thisDir, "..", "..", "package.json"),
-      join115(thisDir, "..", "..", "..", "package.json")
+      join116(thisDir, "..", "package.json"),
+      join116(thisDir, "..", "..", "package.json"),
+      join116(thisDir, "..", "..", "..", "package.json")
     ];
     for (const pkgPath of candidates) {
-      if (existsSync99(pkgPath)) {
+      if (existsSync100(pkgPath)) {
         const pkg = require4(pkgPath);
         if (pkg.name === "open-agents-ai" || pkg.name === "@open-agents/cli" || pkg.name === "@open-agents/monorepo") {
           return pkg.version ?? "0.0.0";
@@ -594224,14 +595002,14 @@ Meta-critique: quality ${meta.quality}/5, thorough: ${meta.thorough}`;
 function gatherMemorySnippets(root) {
   const snippets = [];
   const dirs = [
-    join115(root, ".oa", "memory"),
-    join115(root, ".open-agents", "memory")
+    join116(root, ".oa", "memory"),
+    join116(root, ".open-agents", "memory")
   ];
   for (const dir of dirs) {
-    if (!existsSync99(dir)) continue;
+    if (!existsSync100(dir)) continue;
     try {
       for (const f2 of readdirSync35(dir).filter((f3) => f3.endsWith(".json"))) {
-        const data = JSON.parse(readFileSync80(join115(dir, f2), "utf-8"));
+        const data = JSON.parse(readFileSync81(join116(dir, f2), "utf-8"));
         for (const val of Object.values(data)) {
           const v = typeof val === "object" && val !== null && "value" in val ? String(val.value) : String(val);
           if (v.length > 10) snippets.push(v);
@@ -594385,9 +595163,9 @@ ${metabolismMemories}
   } catch {
   }
   try {
-    const archeFile = join115(repoRoot, ".oa", "arche", "variants.json");
-    if (existsSync99(archeFile)) {
-      const variants = JSON.parse(readFileSync80(archeFile, "utf8"));
+    const archeFile = join116(repoRoot, ".oa", "arche", "variants.json");
+    if (existsSync100(archeFile)) {
+      const variants = JSON.parse(readFileSync81(archeFile, "utf8"));
       if (variants.length > 0) {
         let filtered = variants;
         if (taskType) {
@@ -594559,9 +595337,9 @@ RULES:
   const compactionThreshold = Number.isFinite(envOverride) && envOverride > 0 ? envOverride : modelTier === "small" ? 12e3 : modelTier === "medium" ? 24e3 : 4e4;
   let identityInjection = "";
   try {
-    const ikStateFile = join115(repoRoot, ".oa", "identity", "self-state.json");
-    if (existsSync99(ikStateFile)) {
-      const selfState = JSON.parse(readFileSync80(ikStateFile, "utf8"));
+    const ikStateFile = join116(repoRoot, ".oa", "identity", "self-state.json");
+    if (existsSync100(ikStateFile)) {
+      const selfState = JSON.parse(readFileSync81(ikStateFile, "utf8"));
       const lines = [
         `[Identity State v${selfState.version}]`,
         `Self: ${selfState.narrative_summary}`,
@@ -595422,13 +596200,13 @@ When done, either call task_complete with your answer, or use FINAL_VAR(variable
           });
         }
         try {
-          const ikDir = join115(repoRoot, ".oa", "identity");
-          const ikFile = join115(ikDir, "self-state.json");
+          const ikDir = join116(repoRoot, ".oa", "identity");
+          const ikFile = join116(ikDir, "self-state.json");
           let ikState;
-          if (existsSync99(ikFile)) {
-            ikState = JSON.parse(readFileSync80(ikFile, "utf8"));
+          if (existsSync100(ikFile)) {
+            ikState = JSON.parse(readFileSync81(ikFile, "utf8"));
           } else {
-            mkdirSync63(ikDir, { recursive: true });
+            mkdirSync64(ikDir, { recursive: true });
             const machineId = Date.now().toString(36) + Math.random().toString(36).slice(2, 8);
             ikState = {
               self_id: `oa-${machineId}`,
@@ -595484,7 +596262,7 @@ When done, either call task_complete with your answer, or use FINAL_VAR(variable
           }
           ikState.session_count = (ikState.session_count || 0) + 1;
           ikState.updated_at = (/* @__PURE__ */ new Date()).toISOString();
-          writeFileSync55(ikFile, JSON.stringify(ikState, null, 2));
+          writeFileSync56(ikFile, JSON.stringify(ikState, null, 2));
         } catch (ikErr) {
           try {
             console.error("[IK-OBSERVE]", ikErr);
@@ -595503,9 +596281,9 @@ When done, either call task_complete with your answer, or use FINAL_VAR(variable
       } else {
         renderTaskIncomplete(result.turns, result.toolCalls, result.durationMs, tokens);
         try {
-          const ikFile = join115(repoRoot, ".oa", "identity", "self-state.json");
-          if (existsSync99(ikFile)) {
-            const ikState = JSON.parse(readFileSync80(ikFile, "utf8"));
+          const ikFile = join116(repoRoot, ".oa", "identity", "self-state.json");
+          if (existsSync100(ikFile)) {
+            const ikState = JSON.parse(readFileSync81(ikFile, "utf8"));
             if (!ikState.stats) ikState.stats = { queries_served: 0 };
             ikState.stats.queries_served = (ikState.stats.queries_served || 0) + 1;
             ikState.homeostasis.uncertainty = Math.min(1, ikState.homeostasis.uncertainty + 0.03);
@@ -595516,7 +596294,7 @@ When done, either call task_complete with your answer, or use FINAL_VAR(variable
             if (ikState.version_history.length > 200) ikState.version_history = ikState.version_history.slice(-200);
             ikState.session_count = (ikState.session_count || 0) + 1;
             ikState.updated_at = (/* @__PURE__ */ new Date()).toISOString();
-            writeFileSync55(ikFile, JSON.stringify(ikState, null, 2));
+            writeFileSync56(ikFile, JSON.stringify(ikState, null, 2));
           }
         } catch {
         }
@@ -595761,10 +596539,10 @@ async function startInteractive(config, repoPath) {
     process.stdin.pause();
   }
   try {
-    const oaDir = join115(repoRoot, ".oa");
-    const nexusPidFile = join115(oaDir, "nexus", "daemon.pid");
-    if (existsSync99(nexusPidFile)) {
-      const pid = parseInt(readFileSync80(nexusPidFile, "utf8").trim(), 10);
+    const oaDir = join116(repoRoot, ".oa");
+    const nexusPidFile = join116(oaDir, "nexus", "daemon.pid");
+    if (existsSync100(nexusPidFile)) {
+      const pid = parseInt(readFileSync81(nexusPidFile, "utf8").trim(), 10);
       if (pid > 0) {
         try {
           process.kill(pid, 0);
@@ -596424,7 +597202,7 @@ ${result.summary}`
   let p2pGateway = null;
   let peerMesh = null;
   let inferenceRouter = null;
-  const secretVault = new SecretVault(join115(repoRoot, ".oa", "vault.enc"));
+  const secretVault = new SecretVault(join116(repoRoot, ".oa", "vault.enc"));
   let adminSessionKey = null;
   const callSubAgents = /* @__PURE__ */ new Map();
   const streamRenderer = new StreamRenderer();
@@ -596655,13 +597433,13 @@ Rationale: ${proposal.rationale}${provenanceNote}`;
     const hits = allCompletions.filter((c9) => c9.toLowerCase().startsWith(lower));
     return [hits, line];
   }
-  const HISTORY_DIR = join115(homedir41(), ".open-agents");
-  const HISTORY_FILE = join115(HISTORY_DIR, "repl-history");
+  const HISTORY_DIR = join116(homedir42(), ".open-agents");
+  const HISTORY_FILE = join116(HISTORY_DIR, "repl-history");
   const MAX_HISTORY_LINES = 500;
   let savedHistory = [];
   try {
-    if (existsSync99(HISTORY_FILE)) {
-      const raw = readFileSync80(HISTORY_FILE, "utf8").trim();
+    if (existsSync100(HISTORY_FILE)) {
+      const raw = readFileSync81(HISTORY_FILE, "utf8").trim();
       if (raw) savedHistory = raw.split("\n").reverse();
     }
   } catch {
@@ -596808,12 +597586,12 @@ Rationale: ${proposal.rationale}${provenanceNote}`;
   function persistHistoryLine(line) {
     if (!line.trim()) return;
     try {
-      mkdirSync63(HISTORY_DIR, { recursive: true });
+      mkdirSync64(HISTORY_DIR, { recursive: true });
       appendFileSync8(HISTORY_FILE, line + "\n", "utf8");
       if (Math.random() < 0.02) {
-        const all2 = readFileSync80(HISTORY_FILE, "utf8").trim().split("\n");
+        const all2 = readFileSync81(HISTORY_FILE, "utf8").trim().split("\n");
         if (all2.length > MAX_HISTORY_LINES) {
-          writeFileSync55(HISTORY_FILE, all2.slice(-MAX_HISTORY_LINES).join("\n") + "\n", "utf8");
+          writeFileSync56(HISTORY_FILE, all2.slice(-MAX_HISTORY_LINES).join("\n") + "\n", "utf8");
         }
       }
     } catch {
@@ -596998,10 +597776,10 @@ Rationale: ${proposal.rationale}${provenanceNote}`;
       const { unlinkSync: _rmStale } = await import("node:fs");
       const { homedir: _hdir } = await import("node:os");
       for (const dp of [
-        join115(repoRoot, ".oa", "nexus", "nexus-daemon.mjs"),
-        join115(_hdir(), ".open-agents", ".oa", "nexus", "nexus-daemon.mjs")
+        join116(repoRoot, ".oa", "nexus", "nexus-daemon.mjs"),
+        join116(_hdir(), ".open-agents", ".oa", "nexus", "nexus-daemon.mjs")
       ]) {
-        if (existsSync99(dp)) try {
+        if (existsSync100(dp)) try {
           _rmStale(dp);
         } catch {
         }
@@ -597012,9 +597790,9 @@ Rationale: ${proposal.rationale}${provenanceNote}`;
       const autoNexus = new NexusTool(repoRoot);
       const _registerNexusDaemon = () => {
         try {
-          const nexusPidFile = join115(repoRoot, ".oa", "nexus", "daemon.pid");
-          if (existsSync99(nexusPidFile)) {
-            const nPid = parseInt(readFileSync80(nexusPidFile, "utf8").trim(), 10);
+          const nexusPidFile = join116(repoRoot, ".oa", "nexus", "daemon.pid");
+          if (existsSync100(nexusPidFile)) {
+            const nPid = parseInt(readFileSync81(nexusPidFile, "utf8").trim(), 10);
             if (nPid > 0 && !registry2.daemons.has("Nexus")) {
               registry2.register({ name: "Nexus", pid: nPid, startedAt: Date.now(), status: "running" });
               statusBar.ensureMonitorTimer();
@@ -597071,7 +597849,7 @@ Rationale: ${proposal.rationale}${provenanceNote}`;
     } catch {
     }
     try {
-      const oaDir = join115(repoRoot, ".oa");
+      const oaDir = join116(repoRoot, ".oa");
       const reconnected = await ExposeGateway.checkAndReconnect(oaDir, {
         onInfo: (msg) => writeContent(() => renderInfo2(msg)),
         onError: (msg) => writeContent(() => renderWarning2(msg))
@@ -597103,7 +597881,7 @@ Rationale: ${proposal.rationale}${provenanceNote}`;
     } catch {
     }
     try {
-      const oaDir = join115(repoRoot, ".oa");
+      const oaDir = join116(repoRoot, ".oa");
       const reconnectedP2P = await ExposeP2PGateway.checkAndReconnect(oaDir, new NexusTool(repoRoot), {
         onInfo: (msg) => writeContent(() => renderInfo2(msg)),
         onError: (msg) => writeContent(() => renderWarning2(msg))
@@ -597144,10 +597922,10 @@ Rationale: ${proposal.rationale}${provenanceNote}`;
     }
     try {
       const { homedir: _hd, hostname: _hn, userInfo: _ui } = await import("node:os");
-      const globalNamePath = join115(_hd(), ".open-agents", "agent-name");
+      const globalNamePath = join116(_hd(), ".open-agents", "agent-name");
       let agName = "";
       try {
-        if (existsSync99(globalNamePath)) agName = readFileSync80(globalNamePath, "utf8").trim();
+        if (existsSync100(globalNamePath)) agName = readFileSync81(globalNamePath, "utf8").trim();
       } catch {
       }
       if (!agName) {
@@ -597176,11 +597954,11 @@ Rationale: ${proposal.rationale}${provenanceNote}`;
         }
         if (!ollamaAlive) {
           try {
-            const savedSponsorsPath = join115(repoRoot, ".oa", "sponsor", "known-sponsors.json");
+            const savedSponsorsPath = join116(repoRoot, ".oa", "sponsor", "known-sponsors.json");
             let savedSponsors = [];
             try {
-              if (existsSync99(savedSponsorsPath)) {
-                savedSponsors = JSON.parse(readFileSync80(savedSponsorsPath, "utf8"));
+              if (existsSync100(savedSponsorsPath)) {
+                savedSponsors = JSON.parse(readFileSync81(savedSponsorsPath, "utf8"));
                 const oneHourAgo = Date.now() - 36e5;
                 savedSponsors = savedSponsors.filter((s2) => (s2.lastVerified || 0) > oneHourAgo);
               }
@@ -598272,10 +599050,10 @@ Respond concisely and safely. Remember: you are talking to the general public.`;
               if (name10 === "voice_list_files") {
                 const baseDir = String(args?.dir ?? ".");
                 const { readdirSync: readdirSync37, statSync: statSync30 } = __require("node:fs");
-                const { join: join120, resolve: resolve43 } = __require("node:path");
-                const base3 = baseDir.startsWith("/") ? baseDir : resolve43(join120(repoRoot, baseDir));
+                const { join: join121, resolve: resolve43 } = __require("node:path");
+                const base3 = baseDir.startsWith("/") ? baseDir : resolve43(join121(repoRoot, baseDir));
                 const items = readdirSync37(base3).slice(0, 200).map((f2) => {
-                  const s2 = statSync30(join120(base3, f2));
+                  const s2 = statSync30(join121(base3, f2));
                   return { name: f2, dir: s2.isDirectory(), size: s2.size };
                 });
                 return JSON.stringify({ dir: base3, items }, null, 2);
@@ -598363,7 +599141,7 @@ Respond concisely and safely. Remember: you are talking to the general public.`;
           kind,
           targetUrl,
           authKey,
-          stateDir: join115(repoRoot, ".oa"),
+          stateDir: join116(repoRoot, ".oa"),
           passthrough: passthrough ?? false,
           loadbalance: loadbalance ?? false,
           endpointAuth: passthrough ? currentConfig.apiKey : void 0,
@@ -598409,7 +599187,7 @@ Respond concisely and safely. Remember: you are talking to the general public.`;
         await tunnelGateway.stop();
         tunnelGateway = null;
       }
-      const newTunnel = new ExposeGateway({ kind, targetUrl, authKey, fullAccess, stateDir: join115(repoRoot, ".oa") });
+      const newTunnel = new ExposeGateway({ kind, targetUrl, authKey, fullAccess, stateDir: join116(repoRoot, ".oa") });
       newTunnel.on("stats", (stats) => {
         statusBar.setExposeStatus({
           status: stats.status,
@@ -598496,9 +599274,9 @@ Respond concisely and safely. Remember: you are talking to the general public.`;
       });
       if (!result.success) throw new Error(result.error || "Connect failed");
       try {
-        const nexusPidFile = join115(repoRoot, ".oa", "nexus", "daemon.pid");
-        if (existsSync99(nexusPidFile)) {
-          const pid = parseInt(readFileSync80(nexusPidFile, "utf8").trim(), 10);
+        const nexusPidFile = join116(repoRoot, ".oa", "nexus", "daemon.pid");
+        if (existsSync100(nexusPidFile)) {
+          const pid = parseInt(readFileSync81(nexusPidFile, "utf8").trim(), 10);
           if (pid > 0) {
             registry2.register({
               name: "Nexus",
@@ -598686,10 +599464,10 @@ Respond concisely and safely. Remember: you are talking to the general public.`;
         writeContent(() => renderInfo2(`Killed ${bgKilled} background task(s).`));
       }
       try {
-        const nexusDir = join115(repoRoot, OA_DIR, "nexus");
-        const pidFile = join115(nexusDir, "daemon.pid");
-        if (existsSync99(pidFile)) {
-          const pid = parseInt(readFileSync80(pidFile, "utf8").trim(), 10);
+        const nexusDir = join116(repoRoot, OA_DIR, "nexus");
+        const pidFile = join116(nexusDir, "daemon.pid");
+        if (existsSync100(pidFile)) {
+          const pid = parseInt(readFileSync81(pidFile, "utf8").trim(), 10);
           if (pid > 0) {
             try {
               if (process.platform === "win32") {
@@ -598711,13 +599489,13 @@ Respond concisely and safely. Remember: you are talking to the general public.`;
       } catch {
       }
       try {
-        const voiceDir2 = join115(homedir41(), ".open-agents", "voice");
+        const voiceDir2 = join116(homedir42(), ".open-agents", "voice");
         const voicePidFiles = ["luxtts-daemon.pid", "piper-daemon.pid"];
         for (const pf of voicePidFiles) {
-          const pidPath = join115(voiceDir2, pf);
-          if (existsSync99(pidPath)) {
+          const pidPath = join116(voiceDir2, pf);
+          if (existsSync100(pidPath)) {
             try {
-              const pid = parseInt(readFileSync80(pidPath, "utf8").trim(), 10);
+              const pid = parseInt(readFileSync81(pidPath, "utf8").trim(), 10);
               if (pid > 0) {
                 if (process.platform === "win32") {
                   try {
@@ -598741,8 +599519,8 @@ Respond concisely and safely. Remember: you are talking to the general public.`;
         execSync56(process.platform === "win32" ? "timeout /t 1 /nobreak >nul" : "sleep 0.5", { timeout: 3e3, stdio: "ignore" });
       } catch {
       }
-      const oaPath = join115(repoRoot, OA_DIR);
-      if (existsSync99(oaPath)) {
+      const oaPath = join116(repoRoot, OA_DIR);
+      if (existsSync100(oaPath)) {
         let deleted = false;
         for (let attempt = 0; attempt < 3; attempt++) {
           try {
@@ -598826,19 +599604,19 @@ Respond concisely and safely. Remember: you are talking to the general public.`;
   try {
     const { isPersonaPlexRunning: isPersonaPlexRunning2 } = await Promise.resolve().then(() => (init_personaplex(), personaplex_exports));
     if (isPersonaPlexRunning2()) {
-      const ppPidFile = join115(homedir41(), ".open-agents", "voice", "personaplex", "daemon.pid");
-      const ppPortFile = join115(homedir41(), ".open-agents", "voice", "personaplex", "daemon.port");
-      if (existsSync99(ppPidFile)) {
-        const ppPid = parseInt(readFileSync80(ppPidFile, "utf8").trim(), 10);
-        const ppPort = existsSync99(ppPortFile) ? parseInt(readFileSync80(ppPortFile, "utf8").trim(), 10) : void 0;
+      const ppPidFile = join116(homedir42(), ".open-agents", "voice", "personaplex", "daemon.pid");
+      const ppPortFile = join116(homedir42(), ".open-agents", "voice", "personaplex", "daemon.port");
+      if (existsSync100(ppPidFile)) {
+        const ppPid = parseInt(readFileSync81(ppPidFile, "utf8").trim(), 10);
+        const ppPort = existsSync100(ppPortFile) ? parseInt(readFileSync81(ppPortFile, "utf8").trim(), 10) : void 0;
         if (ppPid > 0 && !registry2.daemons.has("PersonaPlex")) {
           registry2.register({ name: "PersonaPlex", pid: ppPid, port: ppPort, startedAt: Date.now(), status: "running" });
         }
       }
     }
-    const nexusPidFile = join115(repoRoot, ".oa", "nexus", "daemon.pid");
-    if (existsSync99(nexusPidFile)) {
-      const nPid = parseInt(readFileSync80(nexusPidFile, "utf8").trim(), 10);
+    const nexusPidFile = join116(repoRoot, ".oa", "nexus", "daemon.pid");
+    if (existsSync100(nexusPidFile)) {
+      const nPid = parseInt(readFileSync81(nexusPidFile, "utf8").trim(), 10);
       if (nPid > 0 && !registry2.daemons.has("Nexus")) {
         try {
           process.kill(nPid, 0);
@@ -599205,9 +599983,9 @@ Execute this skill now. Follow the behavioral guidance above.`;
       }
     }
     const cleanPath = input.replace(/^['"]|['"]$/g, "").trim();
-    const isImage = isImagePath(cleanPath) && existsSync99(resolve39(repoRoot, cleanPath));
-    const isMedia = !isImage && isTranscribablePath(cleanPath) && existsSync99(resolve39(repoRoot, cleanPath));
-    const isMarkdown = !isImage && !isMedia && /\.(md|markdown)$/i.test(cleanPath) && existsSync99(resolve39(repoRoot, cleanPath));
+    const isImage = isImagePath(cleanPath) && existsSync100(resolve39(repoRoot, cleanPath));
+    const isMedia = !isImage && isTranscribablePath(cleanPath) && existsSync100(resolve39(repoRoot, cleanPath));
+    const isMarkdown = !isImage && !isMedia && /\.(md|markdown)$/i.test(cleanPath) && existsSync100(resolve39(repoRoot, cleanPath));
     if (activeTask) {
       if (activeTask.runner.isPaused) {
         activeTask.runner.resume();
@@ -599216,7 +599994,7 @@ Execute this skill now. Follow the behavioral guidance above.`;
       if (isImage) {
         try {
           const imgPath = resolve39(repoRoot, cleanPath);
-          const imgBuffer = readFileSync80(imgPath);
+          const imgBuffer = readFileSync81(imgPath);
           const base642 = imgBuffer.toString("base64");
           const ext = extname12(cleanPath).toLowerCase();
           const mime = ext === ".png" ? "image/png" : ext === ".gif" ? "image/gif" : ext === ".webp" ? "image/webp" : "image/jpeg";
@@ -599372,7 +600150,7 @@ ${result.text}`;
     if (isMarkdown && fullInput === input) {
       try {
         const mdPath = resolve39(repoRoot, cleanPath);
-        const mdContent = readFileSync80(mdPath, "utf8");
+        const mdContent = readFileSync81(mdPath, "utf8");
         const { parseMcpMarkdown: parseMcpMarkdown2 } = await Promise.resolve().then(() => (init_dist5(), dist_exports));
         const result = parseMcpMarkdown2(mdContent);
         if (result.servers.length > 0) {
@@ -599794,13 +600572,13 @@ async function runWithTUI(task, config, repoPath, callbacks) {
     const handle2 = startTask(task, config, repoRoot);
     await handle2.promise;
     try {
-      const ikDir = join115(repoRoot, ".oa", "identity");
-      const ikFile = join115(ikDir, "self-state.json");
+      const ikDir = join116(repoRoot, ".oa", "identity");
+      const ikFile = join116(ikDir, "self-state.json");
       let ikState;
-      if (existsSync99(ikFile)) {
-        ikState = JSON.parse(readFileSync80(ikFile, "utf8"));
+      if (existsSync100(ikFile)) {
+        ikState = JSON.parse(readFileSync81(ikFile, "utf8"));
       } else {
-        mkdirSync63(ikDir, { recursive: true });
+        mkdirSync64(ikDir, { recursive: true });
         ikState = {
           self_id: `oa-${Date.now().toString(36)}`,
           version: 1,
@@ -599822,7 +600600,7 @@ async function runWithTUI(task, config, repoPath, callbacks) {
       ikState.homeostasis.coherence = Math.min(1, ikState.homeostasis.coherence + 0.05);
       ikState.session_count = (ikState.session_count || 0) + 1;
       ikState.updated_at = (/* @__PURE__ */ new Date()).toISOString();
-      writeFileSync55(ikFile, JSON.stringify(ikState, null, 2));
+      writeFileSync56(ikFile, JSON.stringify(ikState, null, 2));
     } catch (ikErr) {
     }
     try {
@@ -599835,11 +600613,11 @@ async function runWithTUI(task, config, repoPath, callbacks) {
       );
     } catch {
       try {
-        const archeDir = join115(repoRoot, ".oa", "arche");
-        const archeFile = join115(archeDir, "variants.json");
+        const archeDir = join116(repoRoot, ".oa", "arche");
+        const archeFile = join116(archeDir, "variants.json");
         let variants = [];
         try {
-          if (existsSync99(archeFile)) variants = JSON.parse(readFileSync80(archeFile, "utf8"));
+          if (existsSync100(archeFile)) variants = JSON.parse(readFileSync81(archeFile, "utf8"));
         } catch {
         }
         variants.push({
@@ -599853,15 +600631,15 @@ async function runWithTUI(task, config, repoPath, callbacks) {
           tags: ["general"]
         });
         if (variants.length > 50) variants = variants.slice(-50);
-        mkdirSync63(archeDir, { recursive: true });
-        writeFileSync55(archeFile, JSON.stringify(variants, null, 2));
+        mkdirSync64(archeDir, { recursive: true });
+        writeFileSync56(archeFile, JSON.stringify(variants, null, 2));
       } catch {
       }
     }
     try {
-      const metaFile = join115(repoRoot, ".oa", "memory", "metabolism", "store.json");
-      if (existsSync99(metaFile)) {
-        const store2 = JSON.parse(readFileSync80(metaFile, "utf8"));
+      const metaFile = join116(repoRoot, ".oa", "memory", "metabolism", "store.json");
+      if (existsSync100(metaFile)) {
+        const store2 = JSON.parse(readFileSync81(metaFile, "utf8"));
         const surfaced = store2.filter((m2) => m2.type !== "quarantine" && m2.scores?.confidence > 0.15).sort((a2, b) => b.scores.utility * b.scores.confidence - a2.scores.utility * a2.scores.confidence).slice(0, 5);
         let updated = false;
         for (const item of surfaced) {
@@ -599872,7 +600650,7 @@ async function runWithTUI(task, config, repoPath, callbacks) {
           updated = true;
         }
         if (updated) {
-          writeFileSync55(metaFile, JSON.stringify(store2, null, 2));
+          writeFileSync56(metaFile, JSON.stringify(store2, null, 2));
         }
       }
     } catch {
@@ -599925,9 +600703,9 @@ Rules:
           try {
             const { initDb: initDb2 } = __require("@open-agents/memory");
             const { ProceduralMemoryStore: ProceduralMemoryStore2 } = __require("@open-agents/memory");
-            const dbDir = join115(repoRoot, ".oa", "memory");
-            mkdirSync63(dbDir, { recursive: true });
-            const db = initDb2(join115(dbDir, "structured.db"));
+            const dbDir = join116(repoRoot, ".oa", "memory");
+            mkdirSync64(dbDir, { recursive: true });
+            const db = initDb2(join116(dbDir, "structured.db"));
             const memStore = new ProceduralMemoryStore2(db);
             memStore.createWithEmbedding({
               content: content.slice(0, 600),
@@ -599942,11 +600720,11 @@ Rules:
             db.close();
           } catch {
           }
-          const metaDir = join115(repoRoot, ".oa", "memory", "metabolism");
-          const storeFile = join115(metaDir, "store.json");
+          const metaDir = join116(repoRoot, ".oa", "memory", "metabolism");
+          const storeFile = join116(metaDir, "store.json");
           let store2 = [];
           try {
-            if (existsSync99(storeFile)) store2 = JSON.parse(readFileSync80(storeFile, "utf8"));
+            if (existsSync100(storeFile)) store2 = JSON.parse(readFileSync81(storeFile, "utf8"));
           } catch {
           }
           store2.push({
@@ -599961,26 +600739,26 @@ Rules:
             accessCount: 0
           });
           if (store2.length > 100) store2 = store2.slice(-100);
-          mkdirSync63(metaDir, { recursive: true });
-          writeFileSync55(storeFile, JSON.stringify(store2, null, 2));
+          mkdirSync64(metaDir, { recursive: true });
+          writeFileSync56(storeFile, JSON.stringify(store2, null, 2));
         }
       }
     } catch {
     }
     try {
-      const cohereSettingsFile = join115(repoRoot, ".oa", "settings.json");
+      const cohereSettingsFile = join116(repoRoot, ".oa", "settings.json");
       let cohereActive = false;
       try {
-        if (existsSync99(cohereSettingsFile)) {
-          const settings = JSON.parse(readFileSync80(cohereSettingsFile, "utf8"));
+        if (existsSync100(cohereSettingsFile)) {
+          const settings = JSON.parse(readFileSync81(cohereSettingsFile, "utf8"));
           cohereActive = settings.cohere === true;
         }
       } catch {
       }
       if (cohereActive) {
-        const metaFile = join115(repoRoot, ".oa", "memory", "metabolism", "store.json");
-        if (existsSync99(metaFile)) {
-          const store2 = JSON.parse(readFileSync80(metaFile, "utf8"));
+        const metaFile = join116(repoRoot, ".oa", "memory", "metabolism", "store.json");
+        if (existsSync100(metaFile)) {
+          const store2 = JSON.parse(readFileSync81(metaFile, "utf8"));
           const latest = store2.filter((m2) => m2.sourceTrace === "trajectory-extraction" || m2.sourceTrace === "llm-trajectory-extraction").slice(-1)[0];
           if (latest && latest.scores?.confidence >= 0.6) {
             try {
@@ -600005,18 +600783,18 @@ Rules:
     }
   } catch (err) {
     try {
-      const ikFile = join115(repoRoot, ".oa", "identity", "self-state.json");
-      if (existsSync99(ikFile)) {
-        const ikState = JSON.parse(readFileSync80(ikFile, "utf8"));
+      const ikFile = join116(repoRoot, ".oa", "identity", "self-state.json");
+      if (existsSync100(ikFile)) {
+        const ikState = JSON.parse(readFileSync81(ikFile, "utf8"));
         ikState.homeostasis.uncertainty = Math.min(1, ikState.homeostasis.uncertainty + 0.1);
         ikState.homeostasis.coherence = Math.max(0, ikState.homeostasis.coherence - 0.05);
         ikState.session_count = (ikState.session_count || 0) + 1;
         ikState.updated_at = (/* @__PURE__ */ new Date()).toISOString();
-        writeFileSync55(ikFile, JSON.stringify(ikState, null, 2));
+        writeFileSync56(ikFile, JSON.stringify(ikState, null, 2));
       }
-      const metaFile = join115(repoRoot, ".oa", "memory", "metabolism", "store.json");
-      if (existsSync99(metaFile)) {
-        const store2 = JSON.parse(readFileSync80(metaFile, "utf8"));
+      const metaFile = join116(repoRoot, ".oa", "memory", "metabolism", "store.json");
+      if (existsSync100(metaFile)) {
+        const store2 = JSON.parse(readFileSync81(metaFile, "utf8"));
         const surfaced = store2.filter((m2) => m2.type !== "quarantine" && m2.scores?.confidence > 0.15).sort((a2, b) => b.scores.utility * b.scores.confidence - a2.scores.utility * a2.scores.confidence).slice(0, 5);
         for (const item of surfaced) {
           item.accessCount = (item.accessCount || 0) + 1;
@@ -600024,14 +600802,14 @@ Rules:
           item.scores.utility = Math.max(0, (item.scores.utility || 0.5) - 0.05);
           item.scores.confidence = Math.max(0, (item.scores.confidence || 0.5) - 0.02);
         }
-        writeFileSync55(metaFile, JSON.stringify(store2, null, 2));
+        writeFileSync56(metaFile, JSON.stringify(store2, null, 2));
       }
       try {
-        const archeDir = join115(repoRoot, ".oa", "arche");
-        const archeFile = join115(archeDir, "variants.json");
+        const archeDir = join116(repoRoot, ".oa", "arche");
+        const archeFile = join116(archeDir, "variants.json");
         let variants = [];
         try {
-          if (existsSync99(archeFile)) variants = JSON.parse(readFileSync80(archeFile, "utf8"));
+          if (existsSync100(archeFile)) variants = JSON.parse(readFileSync81(archeFile, "utf8"));
         } catch {
         }
         variants.push({
@@ -600045,8 +600823,8 @@ Rules:
           tags: ["general"]
         });
         if (variants.length > 50) variants = variants.slice(-50);
-        mkdirSync63(archeDir, { recursive: true });
-        writeFileSync55(archeFile, JSON.stringify(variants, null, 2));
+        mkdirSync64(archeDir, { recursive: true });
+        writeFileSync56(archeFile, JSON.stringify(variants, null, 2));
       } catch {
       }
     } catch {
@@ -600135,13 +600913,13 @@ __export(run_exports, {
 });
 import { resolve as resolve40 } from "node:path";
 import { spawn as spawn26 } from "node:child_process";
-import { mkdirSync as mkdirSync64, writeFileSync as writeFileSync56, readFileSync as readFileSync81, readdirSync as readdirSync36, existsSync as existsSync100 } from "node:fs";
-import { randomBytes as randomBytes23 } from "node:crypto";
-import { join as join116 } from "node:path";
+import { mkdirSync as mkdirSync65, writeFileSync as writeFileSync57, readFileSync as readFileSync82, readdirSync as readdirSync36, existsSync as existsSync101 } from "node:fs";
+import { randomBytes as randomBytes24 } from "node:crypto";
+import { join as join117 } from "node:path";
 function jobsDir2(repoPath) {
   const root = resolve40(repoPath ?? process.cwd());
-  const dir = join116(root, ".oa", "jobs");
-  mkdirSync64(dir, { recursive: true });
+  const dir = join117(root, ".oa", "jobs");
+  mkdirSync65(dir, { recursive: true });
   return dir;
 }
 async function runCommand(opts, config) {
@@ -600231,7 +601009,7 @@ function extractSummary(captured) {
   return lines.slice(-3).join(" ").slice(0, 200);
 }
 async function runBackground(task, config, opts) {
-  const id = `job-${randomBytes23(3).toString("hex")}`;
+  const id = `job-${randomBytes24(3).toString("hex")}`;
   const dir = jobsDir2(opts.repoPath);
   const repoRoot = resolve40(opts.repoPath ?? process.cwd());
   const job = {
@@ -600260,7 +601038,7 @@ async function runBackground(task, config, opts) {
     }
   });
   job.pid = child.pid ?? 0;
-  writeFileSync56(join116(dir, `${id}.json`), JSON.stringify(job, null, 2));
+  writeFileSync57(join117(dir, `${id}.json`), JSON.stringify(job, null, 2));
   let output = "";
   child.stdout?.on("data", (chunk) => {
     output += chunk.toString();
@@ -600276,7 +601054,7 @@ async function runBackground(task, config, opts) {
       job.summary = result.summary;
       job.durationMs = result.durationMs;
       job.error = result.error;
-      writeFileSync56(join116(dir, `${id}.json`), JSON.stringify(job, null, 2));
+      writeFileSync57(join117(dir, `${id}.json`), JSON.stringify(job, null, 2));
     } catch {
     }
   });
@@ -600292,13 +601070,13 @@ async function runBackground(task, config, opts) {
 }
 function statusCommand(jobId, repoPath) {
   const dir = jobsDir2(repoPath);
-  const file = join116(dir, `${jobId}.json`);
-  if (!existsSync100(file)) {
+  const file = join117(dir, `${jobId}.json`);
+  if (!existsSync101(file)) {
     console.error(`Job not found: ${jobId}`);
     console.log(`Available jobs: oa jobs`);
     process.exit(1);
   }
-  const job = JSON.parse(readFileSync81(file, "utf-8"));
+  const job = JSON.parse(readFileSync82(file, "utf-8"));
   const runtime = job.completedAt ? `${((new Date(job.completedAt).getTime() - new Date(job.startedAt).getTime()) / 1e3).toFixed(0)}s` : `${((Date.now() - new Date(job.startedAt).getTime()) / 1e3).toFixed(0)}s`;
   const icon = job.status === "completed" ? "✓" : job.status === "failed" ? "✗" : "●";
   console.log(`${icon} ${job.id} [${job.status}] ${runtime}`);
@@ -600319,7 +601097,7 @@ function jobsCommand(repoPath) {
   console.log("Jobs:");
   for (const file of files) {
     try {
-      const job = JSON.parse(readFileSync81(join116(dir, file), "utf-8"));
+      const job = JSON.parse(readFileSync82(join117(dir, file), "utf-8"));
       const icon = job.status === "completed" ? "✓" : job.status === "failed" ? "✗" : "●";
       const runtime = job.completedAt ? `${((new Date(job.completedAt).getTime() - new Date(job.startedAt).getTime()) / 1e3).toFixed(0)}s` : `${((Date.now() - new Date(job.startedAt).getTime()) / 1e3).toFixed(0)}s`;
       const cleanListTask = cleanForStorage(job.task) || job.task;
@@ -600343,13 +601121,13 @@ __export(index_repo_exports, {
   indexRepoCommand: () => indexRepoCommand
 });
 import { resolve as resolve41 } from "node:path";
-import { existsSync as existsSync101, statSync as statSync29 } from "node:fs";
+import { existsSync as existsSync102, statSync as statSync29 } from "node:fs";
 import { cwd as cwd2 } from "node:process";
 async function indexRepoCommand(opts, _config3) {
   const repoRoot = resolve41(opts.repoPath ?? cwd2());
   printHeader("Index Repository");
   printInfo(`Indexing: ${repoRoot}`);
-  if (!existsSync101(repoRoot)) {
+  if (!existsSync102(repoRoot)) {
     printError(`Path does not exist: ${repoRoot}`);
     process.exit(1);
   }
@@ -600601,8 +601379,8 @@ var config_exports2 = {};
 __export(config_exports2, {
   configCommand: () => configCommand
 });
-import { join as join117, resolve as resolve42 } from "node:path";
-import { homedir as homedir42 } from "node:os";
+import { join as join118, resolve as resolve42 } from "node:path";
+import { homedir as homedir43 } from "node:os";
 import { cwd as cwd3 } from "node:process";
 function redactIfSensitive(key, value2) {
   if (SENSITIVE_KEYS.has(key) && typeof value2 === "string" && value2.length > 0) {
@@ -600683,7 +601461,7 @@ function handleShow(opts, config) {
     }
   }
   printSection("Config File");
-  printInfo(`~/.open-agents/config.json (${join117(homedir42(), ".open-agents", "config.json")})`);
+  printInfo(`~/.open-agents/config.json (${join118(homedir43(), ".open-agents", "config.json")})`);
   printSection("Priority Chain");
   printInfo("  1. CLI flags (--model, --backend-url, etc.)");
   printInfo("  2. Project .oa/settings.json (--local)");
@@ -600722,7 +601500,7 @@ function handleSet(opts, _config3) {
       const coerced = coerceForSettings(key, value2);
       saveProjectSettings(repoRoot, { [key]: coerced });
       printSuccess(`Project override set: ${key} = ${redactIfSensitive(key, value2)}`);
-      printInfo(`Saved to ${join117(repoRoot, ".oa", "settings.json")}`);
+      printInfo(`Saved to ${join118(repoRoot, ".oa", "settings.json")}`);
       printInfo("This override applies only when running in this workspace.");
     } catch (err) {
       printError(`Failed to save: ${err instanceof Error ? err.message : String(err)}`);
@@ -600906,8 +601684,8 @@ __export(eval_exports, {
   evalCommand: () => evalCommand
 });
 import { tmpdir as tmpdir21 } from "node:os";
-import { mkdirSync as mkdirSync65, writeFileSync as writeFileSync57 } from "node:fs";
-import { join as join118 } from "node:path";
+import { mkdirSync as mkdirSync66, writeFileSync as writeFileSync58 } from "node:fs";
+import { join as join119 } from "node:path";
 async function evalCommand(opts, config) {
   const suiteName = opts.suite ?? "basic";
   const suite = SUITES[suiteName];
@@ -601036,10 +601814,10 @@ async function evalCommand(opts, config) {
   process.exit(failed > 0 ? 1 : 0);
 }
 function createTempEvalRepo() {
-  const dir = join118(tmpdir21(), `open-agents-eval-${Date.now()}`);
-  mkdirSync65(dir, { recursive: true });
-  writeFileSync57(
-    join118(dir, "package.json"),
+  const dir = join119(tmpdir21(), `open-agents-eval-${Date.now()}`);
+  mkdirSync66(dir, { recursive: true });
+  writeFileSync58(
+    join119(dir, "package.json"),
     JSON.stringify({ name: "eval-repo", version: "0.0.0" }, null, 2) + "\n",
     "utf8"
   );
@@ -601103,7 +601881,7 @@ init_typed_node_events();
 import { parseArgs as nodeParseArgs2 } from "node:util";
 import { createRequire as createRequire6 } from "node:module";
 import { fileURLToPath as fileURLToPath19 } from "node:url";
-import { dirname as dirname37, join as join119 } from "node:path";
+import { dirname as dirname37, join as join120 } from "node:path";
 
 // packages/cli/src/cli.ts
 init_typed_node_events();
@@ -601243,7 +602021,7 @@ init_output();
 function getVersion5() {
   try {
     const require4 = createRequire6(import.meta.url);
-    const pkgPath = join119(dirname37(fileURLToPath19(import.meta.url)), "..", "package.json");
+    const pkgPath = join120(dirname37(fileURLToPath19(import.meta.url)), "..", "package.json");
     const pkg = require4(pkgPath);
     return pkg.version;
   } catch {
@@ -601557,12 +602335,12 @@ function crashLog(label, err) {
   const logLine = `[${timestamp}] ${label}: ${msg}
 `;
   try {
-    const { appendFileSync: appendFileSync9, mkdirSync: mkdirSync66 } = __require("node:fs");
-    const { join: join120 } = __require("node:path");
-    const { homedir: homedir43 } = __require("node:os");
-    const logDir = join120(homedir43(), ".open-agents");
-    mkdirSync66(logDir, { recursive: true });
-    appendFileSync9(join120(logDir, "crash.log"), logLine);
+    const { appendFileSync: appendFileSync9, mkdirSync: mkdirSync67 } = __require("node:fs");
+    const { join: join121 } = __require("node:path");
+    const { homedir: homedir44 } = __require("node:os");
+    const logDir = join121(homedir44(), ".open-agents");
+    mkdirSync67(logDir, { recursive: true });
+    appendFileSync9(join121(logDir, "crash.log"), logLine);
   } catch {
   }
   try {