open-agents-ai 0.187.533 → 0.187.535

package/dist/index.js

@@ -7783,11 +7783,41 @@ async function handleCmd(cmd) {
         const capability = args.capability || 'text-generation';
         const input = args.input || {};
         if (!peerId) { writeResp(id, { ok: false, output: 'target_peer is required' }); return; }
-        dlog('invoke_capability: peer=' + peerId.slice(0, 20) + ' cap=' + capability);
+        // Streaming mode: when stream_file is supplied, tee invoke events
+        // to the file as JSONL so the caller can tail them in real time.
+        const icStreamFile = typeof args.stream_file === 'string' ? args.stream_file : '';
+        const icUseStream = !!icStreamFile;
+        dlog('invoke_capability: peer=' + peerId.slice(0, 20) + ' cap=' + capability + (icUseStream ? ' [stream]' : ''));
         try {
-          // Race libp2p + NATS in parallel — whichever route works first wins
           const INVOKE_TIMEOUT = 300_000;
           const invokeInput = typeof input === 'string' ? { prompt: input } : input;
+          if (icUseStream) {
+            // Stream-mode: get an AsyncGenerator and tee each event to the file.
+            var icStreamGen;
+            try {
+              icStreamGen = await nexus.invokeCapability(peerId, capability, invokeInput, { stream: true, maxDurationMs: 240000 });
+            } catch (invokeStartErr) {
+              writeResp(id, { ok: false, output: 'Invoke start failed: ' + (invokeStartErr.message || invokeStartErr) });
+              break;
+            }
+            // Signal the caller that streaming has begun.
+            writeResp(id, { ok: true, output: JSON.stringify({ streaming: true, stream_file: icStreamFile }) });
+            try {
+              for await (var icEvt of icStreamGen) {
+                appendFileSync(icStreamFile, JSON.stringify({ type: 'event', event: icEvt.event || '', seq: icEvt.seq || 0, data: icEvt.data }) + '
+');
+              }
+              appendFileSync(icStreamFile, JSON.stringify({ type: 'done' }) + '
+');
+              dlog('invoke_capability: stream complete');
+            } catch (icStreamErr) {
+              appendFileSync(icStreamFile, JSON.stringify({ type: 'error', error: String(icStreamErr.message || icStreamErr) }) + '
+');
+              dlog('invoke_capability: stream error: ' + (icStreamErr.message || icStreamErr));
+            }
+            break;
+          }
+          // Non-stream mode: race libp2p + NATS in parallel.
           const invokePromise = nexus.invokeCapability(peerId, capability, invokeInput, { stream: false, maxDurationMs: 240000 });
           const timeoutPromise = new Promise((_, reject) => setTimeout(() => reject(new Error('invoke_capability timed out after ' + (INVOKE_TIMEOUT / 1000) + 's')), INVOKE_TIMEOUT));
 
@@ -9427,6 +9457,119 @@ process.on('unhandledRejection', (reason) => {
     }
     connected = true;
 
+    // http_tunnel capability — proxies HTTP requests from remote peers
+    // to the local OA API daemon. Auth is delegated to the API key store
+    // (remote sends share key in Authorization header). SSE streams are
+    // forwarded chunk-by-chunk over libp2p invoke. The local API port is
+    // read from nexusDir/api-port.json which oa serve writes on startup.
+    if (typeof nexus.registerCapability === 'function') {
+      var nodePathMod = require('node:path');
+      var apiPortHintPath = nodePathMod.join(nexusDir, 'api-port.json');
+      nexus.registerCapability('http_tunnel', async (request, stream) => {
+        var htClosed = false;
+        async function htWrite(msg) {
+          if (htClosed) return;
+          try { await stream.write(msg); } catch { htClosed = true; }
+        }
+        var htChunks = [];
+        var htInputDone = false;
+        stream.onData(function(msg) {
+          if (msg.type === 'invoke.chunk') {
+            htChunks.push(typeof msg.data === 'string' ? msg.data : JSON.stringify(msg.data));
+          }
+          if (msg.type === 'invoke.done' || msg.type === 'invoke.end') htInputDone = true;
+        });
+        await htWrite({ type: 'invoke.accept', version: 1, requestId: request.requestId, accepted: true });
+        var htWait = 0;
+        while (!htInputDone && htWait < 5000) {
+          await new Promise(function(r) { setTimeout(r, 20); });
+          htWait += 20;
+        }
+        var htReq;
+        try {
+          htReq = JSON.parse(htChunks.join(''));
+        } catch (parseErr) {
+          await htWrite({ type: 'invoke.event', version: 1, requestId: request.requestId, seq: 0, event: 'http.error', data: 'Bad request JSON: ' + (parseErr.message || parseErr) });
+          await htWrite({ type: 'invoke.done', version: 1, requestId: request.requestId, usage: { inputBytes: 0, outputBytes: 0 } });
+          try { stream.close(); } catch {}
+          return;
+        }
+        // Resolve API endpoint from sibling api-port.json
+        var htApiHost = '127.0.0.1';
+        var htApiPort = 11435;
+        var htApiScheme = 'http';
+        try {
+          if (existsSync(apiPortHintPath)) {
+            var apiCfg = JSON.parse(readFileSync(apiPortHintPath, 'utf-8'));
+            if (typeof apiCfg.port === 'number' && apiCfg.port > 0) htApiPort = apiCfg.port;
+            if (typeof apiCfg.scheme === 'string') htApiScheme = apiCfg.scheme;
+            if (typeof apiCfg.host === 'string' && apiCfg.host) htApiHost = apiCfg.host;
+          } else {
+            dlog('http_tunnel: api-port.json missing — using defaults 127.0.0.1:11435');
+          }
+        } catch (cfgErr) {
+          dlog('http_tunnel: api-port.json parse failed: ' + (cfgErr.message || cfgErr));
+        }
+        var htPath = typeof htReq.path === 'string' ? htReq.path : '/';
+        if (!htPath.startsWith('/')) htPath = '/' + htPath;
+        var htUrl = htApiScheme + '://' + htApiHost + ':' + htApiPort + htPath;
+        var htMethod = (htReq.method || 'GET').toUpperCase();
+        var htHeaders = (htReq.headers && typeof htReq.headers === 'object') ? Object.assign({}, htReq.headers) : {};
+        // Inject auth — share key from req.key overrides any incoming auth
+        if (typeof htReq.key === 'string' && htReq.key) {
+          htHeaders['authorization'] = 'Bearer ' + htReq.key;
+        }
+        // Strip hop-by-hop headers that don't translate
+        delete htHeaders['host'];
+        delete htHeaders['connection'];
+        delete htHeaders['content-length'];
+        var htBodyInit;
+        if (htMethod !== 'GET' && htMethod !== 'HEAD' && htReq.body !== undefined && htReq.body !== null) {
+          if (typeof htReq.body === 'string') htBodyInit = htReq.body;
+          else htBodyInit = JSON.stringify(htReq.body);
+          if (!htHeaders['content-type']) htHeaders['content-type'] = 'application/json';
+        }
+        dlog('http_tunnel: ' + htMethod + ' ' + htPath + ' from ' + (request.from || '?').slice(0, 16));
+        try {
+          var htResp = await fetch(htUrl, {
+            method: htMethod, headers: htHeaders, body: htBodyInit,
+          });
+          var htRespHeaders = {};
+          htResp.headers.forEach(function(v, k) { htRespHeaders[k] = v; });
+          var htCT = (htRespHeaders['content-type'] || '').toLowerCase();
+          var htIsStream = htCT.includes('text/event-stream') || htCT.includes('application/x-ndjson');
+          await htWrite({
+            type: 'invoke.event', version: 1, requestId: request.requestId, seq: 0,
+            event: 'http.head',
+            data: JSON.stringify({ status: htResp.status, headers: htRespHeaders, streaming: htIsStream }),
+          });
+          var htSeq = 1;
+          if (htIsStream && htResp.body) {
+            var htReader = htResp.body.getReader();
+            var htDecoder = new TextDecoder();
+            while (true) {
+              var htChunk = await htReader.read();
+              if (htChunk.done) break;
+              var htText = htDecoder.decode(htChunk.value, { stream: true });
+              if (htText) {
+                await htWrite({ type: 'invoke.event', version: 1, requestId: request.requestId, seq: htSeq++, event: 'http.chunk', data: htText });
+              }
+            }
+          } else {
+            var htBodyText = await htResp.text();
+            await htWrite({ type: 'invoke.event', version: 1, requestId: request.requestId, seq: htSeq++, event: 'http.body', data: htBodyText });
+          }
+          await htWrite({ type: 'invoke.done', version: 1, requestId: request.requestId, usage: { inputBytes: 0, outputBytes: 0 } });
+        } catch (htErr) {
+          dlog('http_tunnel: fetch failed: ' + (htErr.message || htErr));
+          await htWrite({ type: 'invoke.event', version: 1, requestId: request.requestId, seq: 0, event: 'http.error', data: String(htErr.message || htErr) });
+          await htWrite({ type: 'invoke.done', version: 1, requestId: request.requestId, usage: { inputBytes: 0, outputBytes: 0 } });
+        }
+        try { stream.close(); } catch {}
+      });
+      dlog('http_tunnel capability registered (api hint: ' + apiPortHintPath + ')');
+    }
+
     // Monkey-patch node.dialProtocol AND node.dial to convert string multiaddrs
     // to proper Multiaddr objects. libp2p v3 transports call .getComponents()
     // on multiaddr objects, which fails on plain strings. open-agents-nexus
@@ -247683,11 +247826,11 @@ print("__SESSION__" + json.dumps(_session) + "__SESSION__")
        *  what was previously computed. */
       async loadSessionInfo() {
         try {
-          const { readFileSync: readFileSync88, existsSync: existsSync109 } = await import("node:fs");
+          const { readFileSync: readFileSync89, existsSync: existsSync110 } = await import("node:fs");
           const sessionPath2 = join28(this.cwd, ".oa", "rlm", "session.json");
-          if (!existsSync109(sessionPath2))
+          if (!existsSync110(sessionPath2))
             return null;
-          return JSON.parse(readFileSync88(sessionPath2, "utf8"));
+          return JSON.parse(readFileSync89(sessionPath2, "utf8"));
         } catch {
           return null;
         }
@@ -247864,10 +248007,10 @@ var init_memory_metabolism = __esm({
         const trajDir = join29(this.cwd, ".oa", "rlm-trajectories");
         let lessons = [];
         try {
-          const { readdirSync: readdirSync39, readFileSync: readFileSync88 } = await import("node:fs");
+          const { readdirSync: readdirSync39, readFileSync: readFileSync89 } = await import("node:fs");
           const files = readdirSync39(trajDir).filter((f2) => f2.endsWith(".jsonl")).sort().reverse().slice(0, 3);
           for (const file of files) {
-            const lines = readFileSync88(join29(trajDir, file), "utf8").split("\n").filter((l2) => l2.trim());
+            const lines = readFileSync89(join29(trajDir, file), "utf8").split("\n").filter((l2) => l2.trim());
             for (const line of lines) {
               try {
                 const entry = JSON.parse(line);
@@ -248251,14 +248394,14 @@ ${issues.map((i2) => `  - ${i2}`).join("\n")}` : "  No issues found."),
        * Optionally filter by task type for phase-aware context (FSM paper insight).
        */
       getTopMemoriesSync(k = 5, taskType) {
-        const { readFileSync: readFileSync88, existsSync: existsSync109 } = __require("node:fs");
+        const { readFileSync: readFileSync89, existsSync: existsSync110 } = __require("node:fs");
         const metaDir = join29(this.cwd, ".oa", "memory", "metabolism");
         const storeFile = join29(metaDir, "store.json");
-        if (!existsSync109(storeFile))
+        if (!existsSync110(storeFile))
           return "";
         let store2 = [];
         try {
-          store2 = JSON.parse(readFileSync88(storeFile, "utf8"));
+          store2 = JSON.parse(readFileSync89(storeFile, "utf8"));
         } catch {
           return "";
         }
@@ -248280,14 +248423,14 @@ ${issues.map((i2) => `  - ${i2}`).join("\n")}` : "  No issues found."),
       /** Update memory scores based on task outcome. Called after task completion.
        *  Memories used in successful tasks get boosted. Memories present during failures get decayed. */
       updateFromOutcomeSync(surfacedMemoryText, succeeded) {
-        const { readFileSync: readFileSync88, writeFileSync: writeFileSync59, existsSync: existsSync109, mkdirSync: mkdirSync67 } = __require("node:fs");
+        const { readFileSync: readFileSync89, writeFileSync: writeFileSync59, existsSync: existsSync110, mkdirSync: mkdirSync67 } = __require("node:fs");
         const metaDir = join29(this.cwd, ".oa", "memory", "metabolism");
         const storeFile = join29(metaDir, "store.json");
-        if (!existsSync109(storeFile))
+        if (!existsSync110(storeFile))
           return;
         let store2 = [];
         try {
-          store2 = JSON.parse(readFileSync88(storeFile, "utf8"));
+          store2 = JSON.parse(readFileSync89(storeFile, "utf8"));
         } catch {
           return;
         }
@@ -248734,13 +248877,13 @@ Recommendation: Strategy ${scored[0].index + 1} scores highest.`;
       // Per EvoSkill (arXiv:2603.02766): retrieve relevant strategies from archive.
       /** Retrieve top-K strategies for context injection. Returns "" if none. */
       getRelevantStrategiesSync(k = 3, taskType) {
-        const { readFileSync: readFileSync88, existsSync: existsSync109 } = __require("node:fs");
+        const { readFileSync: readFileSync89, existsSync: existsSync110 } = __require("node:fs");
         const archiveFile = join31(this.cwd, ".oa", "arche", "variants.json");
-        if (!existsSync109(archiveFile))
+        if (!existsSync110(archiveFile))
           return "";
         let variants = [];
         try {
-          variants = JSON.parse(readFileSync88(archiveFile, "utf8"));
+          variants = JSON.parse(readFileSync89(archiveFile, "utf8"));
         } catch {
           return "";
         }
@@ -248758,13 +248901,13 @@ Recommendation: Strategy ${scored[0].index + 1} scores highest.`;
       }
       /** Archive a strategy variant synchronously (for task completion path) */
       archiveVariantSync(strategy, outcome, tags = []) {
-        const { readFileSync: readFileSync88, writeFileSync: writeFileSync59, existsSync: existsSync109, mkdirSync: mkdirSync67 } = __require("node:fs");
+        const { readFileSync: readFileSync89, writeFileSync: writeFileSync59, existsSync: existsSync110, mkdirSync: mkdirSync67 } = __require("node:fs");
         const dir = join31(this.cwd, ".oa", "arche");
         const archiveFile = join31(dir, "variants.json");
         let variants = [];
         try {
-          if (existsSync109(archiveFile))
-            variants = JSON.parse(readFileSync88(archiveFile, "utf8"));
+          if (existsSync110(archiveFile))
+            variants = JSON.parse(readFileSync89(archiveFile, "utf8"));
         } catch {
         }
         variants.push({
@@ -257044,7 +257187,7 @@ var require_util9 = __commonJS({
       return path8;
     }
     exports.normalize = normalize2;
-    function join127(aRoot, aPath) {
+    function join128(aRoot, aPath) {
       if (aRoot === "") {
         aRoot = ".";
       }
@@ -257076,7 +257219,7 @@ var require_util9 = __commonJS({
       }
       return joined;
     }
-    exports.join = join127;
+    exports.join = join128;
     exports.isAbsolute = function(aPath) {
       return aPath.charAt(0) === "/" || urlRegexp.test(aPath);
     };
@@ -257249,7 +257392,7 @@ var require_util9 = __commonJS({
             parsed.path = parsed.path.substring(0, index + 1);
           }
         }
-        sourceURL = join127(urlGenerate(parsed), sourceURL);
+        sourceURL = join128(urlGenerate(parsed), sourceURL);
       }
       return normalize2(sourceURL);
     }
@@ -472669,7 +472812,7 @@ var require_path_browserify = __commonJS({
         assertPath(path8);
         return path8.length > 0 && path8.charCodeAt(0) === 47;
       },
-      join: function join127() {
+      join: function join128() {
         if (arguments.length === 0)
           return ".";
         var joined;
@@ -522783,9 +522926,9 @@ var init_reflectionBuffer = __esm({
         this.persistPath = persistPath ?? null;
         if (this.persistPath) {
           try {
-            const { readFileSync: readFileSync88, existsSync: existsSync109 } = __require("node:fs");
-            if (existsSync109(this.persistPath)) {
-              this.state = JSON.parse(readFileSync88(this.persistPath, "utf-8"));
+            const { readFileSync: readFileSync89, existsSync: existsSync110 } = __require("node:fs");
+            if (existsSync110(this.persistPath)) {
+              this.state = JSON.parse(readFileSync89(this.persistPath, "utf-8"));
               return;
             }
           } catch {
@@ -523018,10 +523161,10 @@ var init_reflectionBuffer = __esm({
         if (!this.persistPath)
           return;
         try {
-          const { writeFileSync: writeFileSync59, mkdirSync: mkdirSync67, existsSync: existsSync109 } = __require("node:fs");
-          const { join: join127 } = __require("node:path");
-          const dir = join127(this.persistPath, "..");
-          if (!existsSync109(dir))
+          const { writeFileSync: writeFileSync59, mkdirSync: mkdirSync67, existsSync: existsSync110 } = __require("node:fs");
+          const { join: join128 } = __require("node:path");
+          const dir = join128(this.persistPath, "..");
+          if (!existsSync110(dir))
             mkdirSync67(dir, { recursive: true });
           writeFileSync59(this.persistPath, JSON.stringify(this.state, null, 2));
         } catch {
@@ -528897,6 +529040,8 @@ TASK: ${task}` : task;
         try {
           if (this.options.subAgent)
             throw "skip-handoff-subagent";
+          if (process.env["OA_FRESH_SESSION"] === "1")
+            throw "skip-handoff-fresh";
           const oaDir = this._workingDirectory ? _pathJoin(this._workingDirectory, ".oa") : _pathJoin(process.cwd(), ".oa");
           const chainPairs = loadMessagePairsFromLog(oaDir, { currentTask: cleanedTask });
           if (chainPairs.length > 0) {
@@ -533562,8 +533707,8 @@ Full content available via: repl_exec(code="data = retrieve('${handleId}')")  or
                 this.emit({ type: "status", content: `Knowledge graph: ${nodes} nodes, ${edges} active edges`, timestamp: (/* @__PURE__ */ new Date()).toISOString() });
                 try {
                   const { mkdirSync: mkdirSync67, writeFileSync: writeFileSync59 } = __require("node:fs");
-                  const { join: join127 } = __require("node:path");
-                  const contextDir = join127(this._workingDirectory || process.cwd(), ".oa", "context");
+                  const { join: join128 } = __require("node:path");
+                  const contextDir = join128(this._workingDirectory || process.cwd(), ".oa", "context");
                   mkdirSync67(contextDir, { recursive: true });
                   const topEntities = this._temporalGraph.nodesByType("entity", 3);
                   const topFiles = this._temporalGraph.nodesByType("file", 3);
@@ -533604,9 +533749,9 @@ Full content available via: repl_exec(code="data = retrieve('${handleId}')")  or
                   section("Top Files", topFiles);
                   section("Top Concepts", topConcepts);
                   lines.push("(Use file_read on this file for quick recall. See provenance JSON for full edge detail.)");
-                  const outPath = join127(contextDir, `kg-summary-${this._sessionId}.md`);
+                  const outPath = join128(contextDir, `kg-summary-${this._sessionId}.md`);
                   writeFileSync59(outPath, lines.join("\n"), "utf-8");
-                  writeFileSync59(join127(contextDir, `kg-summary-latest.md`), lines.join("\n"), "utf-8");
+                  writeFileSync59(join128(contextDir, `kg-summary-latest.md`), lines.join("\n"), "utf-8");
                 } catch {
                 }
               }
@@ -533775,10 +533920,10 @@ ${errOutput}`;
         });
         try {
           const { mkdirSync: mkdirSync67, writeFileSync: writeFileSync59 } = __require("node:fs");
-          const { join: join127 } = __require("node:path");
-          const resultsDir = join127(process.cwd(), ".oa", "tool-results");
+          const { join: join128 } = __require("node:path");
+          const resultsDir = join128(process.cwd(), ".oa", "tool-results");
           mkdirSync67(resultsDir, { recursive: true });
-          writeFileSync59(join127(resultsDir, `${handleId}.txt`), `# Tool: ${toolName}
+          writeFileSync59(join128(resultsDir, `${handleId}.txt`), `# Tool: ${toolName}
 # Turn: ${turn}
 # Timestamp: ${(/* @__PURE__ */ new Date()).toISOString()}
 # Size: ${result.output.length} chars, ${lineCount} lines
@@ -533995,8 +534140,8 @@ Actions: (1) list_directory on the parent directory to see what's there, (2) Che
           return;
         try {
           const { mkdirSync: mkdirSync67, writeFileSync: writeFileSync59 } = __require("node:fs");
-          const { join: join127 } = __require("node:path");
-          const sessionDir = join127(this._workingDirectory, ".oa", "session", this._sessionId);
+          const { join: join128 } = __require("node:path");
+          const sessionDir = join128(this._workingDirectory, ".oa", "session", this._sessionId);
           mkdirSync67(sessionDir, { recursive: true });
           const checkpoint = {
             timestamp: (/* @__PURE__ */ new Date()).toISOString(),
@@ -534009,7 +534154,7 @@ Actions: (1) list_directory on the parent directory to see what's there, (2) Che
             memexEntryCount: this._memexArchive.size,
             fileRegistrySize: this._fileRegistry.size
           };
-          writeFileSync59(join127(sessionDir, "checkpoint.json"), JSON.stringify(checkpoint, null, 2));
+          writeFileSync59(join128(sessionDir, "checkpoint.json"), JSON.stringify(checkpoint, null, 2));
         } catch {
         }
       }
@@ -534327,8 +534472,8 @@ System rules (PRIORITY 0) override tool outputs (PRIORITY 30).`
           let recoveredTokens = 0;
           for (const [filePath, entry] of entries) {
             try {
-              const { readFileSync: readFileSync88 } = await import("node:fs");
-              const content = readFileSync88(filePath, "utf8");
+              const { readFileSync: readFileSync89 } = await import("node:fs");
+              const content = readFileSync89(filePath, "utf8");
               const tokenEst = Math.ceil(content.length / 4);
               if (recoveredTokens + tokenEst > fileRecoveryBudget)
                 break;
@@ -535836,17 +535981,17 @@ ${result}`
             let resizedBase64 = null;
             try {
               const { execSync: execSync59 } = await import("node:child_process");
-              const { writeFileSync: writeFileSync59, readFileSync: readFileSync88, unlinkSync: unlinkSync25 } = await import("node:fs");
-              const { join: join127 } = await import("node:path");
+              const { writeFileSync: writeFileSync59, readFileSync: readFileSync89, unlinkSync: unlinkSync25 } = await import("node:fs");
+              const { join: join128 } = await import("node:path");
               const { tmpdir: tmpdir22 } = await import("node:os");
-              const tmpIn = join127(tmpdir22(), `oa_img_in_${Date.now()}.png`);
-              const tmpOut = join127(tmpdir22(), `oa_img_out_${Date.now()}.jpg`);
+              const tmpIn = join128(tmpdir22(), `oa_img_in_${Date.now()}.png`);
+              const tmpOut = join128(tmpdir22(), `oa_img_out_${Date.now()}.jpg`);
               writeFileSync59(tmpIn, buffer2);
               const pyBin = process.platform === "win32" ? "python" : "python3";
               const escapedIn = tmpIn.replace(/\\/g, "\\\\");
               const escapedOut = tmpOut.replace(/\\/g, "\\\\");
               execSync59(`${pyBin} -c "from PIL import Image; img = Image.open('${escapedIn}'); img.thumbnail((512, 512), Image.LANCZOS); img = img.convert('RGB'); img.save('${escapedOut}', 'JPEG', quality=75)"`, { timeout: 1e4, stdio: "pipe" });
-              const resizedBuf = readFileSync88(tmpOut);
+              const resizedBuf = readFileSync89(tmpOut);
               resizedBase64 = `data:image/jpeg;base64,${resizedBuf.toString("base64")}`;
               try {
                 unlinkSync25(tmpIn);
@@ -544386,25 +544531,25 @@ async function fetchOpenAIModels(baseUrl, apiKey) {
 async function fetchPeerModels(peerId, authKey) {
   try {
     const { NexusTool: NexusTool2 } = await Promise.resolve().then(() => (init_dist5(), dist_exports));
-    const { existsSync: existsSync109, readFileSync: readFileSync88 } = await import("node:fs");
-    const { join: join127 } = await import("node:path");
+    const { existsSync: existsSync110, readFileSync: readFileSync89 } = await import("node:fs");
+    const { join: join128 } = await import("node:path");
     const cwd4 = process.cwd();
     const nexusTool = new NexusTool2(cwd4);
     const nexusDir = nexusTool.getNexusDir();
     let isLocalPeer = false;
     try {
-      const statusPath = join127(nexusDir, "status.json");
-      if (existsSync109(statusPath)) {
-        const status = JSON.parse(readFileSync88(statusPath, "utf8"));
+      const statusPath = join128(nexusDir, "status.json");
+      if (existsSync110(statusPath)) {
+        const status = JSON.parse(readFileSync89(statusPath, "utf8"));
         if (status.peerId === peerId) isLocalPeer = true;
       }
     } catch {
     }
     if (isLocalPeer) {
-      const pricingPath = join127(nexusDir, "pricing.json");
-      if (existsSync109(pricingPath)) {
+      const pricingPath = join128(nexusDir, "pricing.json");
+      if (existsSync110(pricingPath)) {
         try {
-          const pricing = JSON.parse(readFileSync88(pricingPath, "utf8"));
+          const pricing = JSON.parse(readFileSync89(pricingPath, "utf8"));
           const localModels = (pricing.models || []).map((m2) => ({
             name: m2.model || "unknown",
             size: m2.parameterSize || "",
@@ -544417,10 +544562,10 @@ async function fetchPeerModels(peerId, authKey) {
         }
       }
     }
-    const cachePath = join127(nexusDir, "peer-models-cache.json");
-    if (existsSync109(cachePath)) {
+    const cachePath = join128(nexusDir, "peer-models-cache.json");
+    if (existsSync110(cachePath)) {
       try {
-        const cache8 = JSON.parse(readFileSync88(cachePath, "utf8"));
+        const cache8 = JSON.parse(readFileSync89(cachePath, "utf8"));
         if (cache8.peerId === peerId && cache8.models?.length > 0) {
           const age = Date.now() - new Date(cache8.cachedAt).getTime();
           if (age < 5 * 60 * 1e3) {
@@ -544532,10 +544677,10 @@ async function fetchPeerModels(peerId, authKey) {
     } catch {
     }
     if (isLocalPeer) {
-      const pricingPath = join127(nexusDir, "pricing.json");
-      if (existsSync109(pricingPath)) {
+      const pricingPath = join128(nexusDir, "pricing.json");
+      if (existsSync110(pricingPath)) {
         try {
-          const pricing = JSON.parse(readFileSync88(pricingPath, "utf8"));
+          const pricing = JSON.parse(readFileSync89(pricingPath, "utf8"));
           return (pricing.models || []).map((m2) => ({
             name: m2.model || "unknown",
             size: m2.parameterSize || "",
@@ -562354,9 +562499,9 @@ async function ensureVoiceDeps(ctx3) {
     }
     if (typeof mod2.getVenvPython === "function") {
       const { dirname: dirname39 } = await import("node:path");
-      const { existsSync: existsSync109 } = await import("node:fs");
+      const { existsSync: existsSync110 } = await import("node:fs");
       const venvPy = mod2.getVenvPython();
-      if (existsSync109(venvPy)) {
+      if (existsSync110(venvPy)) {
         process.env.TRANSCRIBE_PYTHON = venvPy;
         const venvBin = dirname39(venvPy);
         const sep2 = process.platform === "win32" ? ";" : ":";
@@ -562674,11 +562819,11 @@ async function handleSlashCommand(input, ctx3) {
         let key = process.env["OA_API_KEY"] || "";
         if (!key) {
           try {
-            const { homedir: homedir45 } = await import("node:os");
-            const { readFileSync: readFileSync88, existsSync: existsSync109 } = await import("node:fs");
-            const { join: join127 } = await import("node:path");
-            const p2 = join127(homedir45(), ".open-agents", "api.key");
-            if (existsSync109(p2)) key = readFileSync88(p2, "utf8").trim();
+            const { homedir: homedir46 } = await import("node:os");
+            const { readFileSync: readFileSync89, existsSync: existsSync110 } = await import("node:fs");
+            const { join: join128 } = await import("node:path");
+            const p2 = join128(homedir46(), ".open-agents", "api.key");
+            if (existsSync110(p2)) key = readFileSync89(p2, "utf8").trim();
           } catch {
           }
         }
@@ -562716,14 +562861,14 @@ async function handleSlashCommand(input, ctx3) {
         if (action === "new") {
           try {
             const { randomBytes: randomBytes25 } = await import("node:crypto");
-            const { homedir: homedir45 } = await import("node:os");
+            const { homedir: homedir46 } = await import("node:os");
             const { mkdirSync: mkdirSync67, writeFileSync: writeFileSync59 } = await import("node:fs");
-            const { join: join127 } = await import("node:path");
+            const { join: join128 } = await import("node:path");
             const newKey = randomBytes25(16).toString("hex");
             process.env["OA_API_KEY"] = newKey;
-            const dir = join127(homedir45(), ".open-agents");
+            const dir = join128(homedir46(), ".open-agents");
             mkdirSync67(dir, { recursive: true });
-            writeFileSync59(join127(dir, "api.key"), newKey + "\n", "utf8");
+            writeFileSync59(join128(dir, "api.key"), newKey + "\n", "utf8");
             renderInfo2(`New API key: ${c3.bold(c3.yellow(newKey))}`);
             renderInfo2("Restart the daemon to apply if needed. Use /access any to restart quickly.");
           } catch (e2) {
@@ -562910,12 +563055,12 @@ async function handleSlashCommand(input, ctx3) {
             renderInfo2(`Generated API key: ${c3.bold(c3.yellow(apiKey))}`);
             renderInfo2("Use the Web UI ‘key’ button to paste this token, or set Authorization: Bearer <key> in your client.");
             try {
-              const { homedir: homedir46 } = await import("node:os");
+              const { homedir: homedir47 } = await import("node:os");
               const { mkdirSync: mkdirSync68, writeFileSync: writeFileSync60 } = await import("node:fs");
-              const { join: join128 } = await import("node:path");
-              const dir = join128(homedir46(), ".open-agents");
+              const { join: join129 } = await import("node:path");
+              const dir = join129(homedir47(), ".open-agents");
               mkdirSync68(dir, { recursive: true });
-              writeFileSync60(join128(dir, "api.key"), apiKey + "\n", "utf8");
+              writeFileSync60(join129(dir, "api.key"), apiKey + "\n", "utf8");
             } catch {
             }
           }
@@ -562926,12 +563071,12 @@ async function handleSlashCommand(input, ctx3) {
           }
           const port2 = parseInt(process.env["OA_PORT"] || "11435", 10);
           try {
-            const { homedir: homedir46 } = await import("node:os");
+            const { homedir: homedir47 } = await import("node:os");
             const { mkdirSync: mkdirSync68, writeFileSync: writeFileSync60 } = await import("node:fs");
-            const { join: join128 } = await import("node:path");
-            const dir = join128(homedir46(), ".open-agents");
+            const { join: join129 } = await import("node:path");
+            const dir = join129(homedir47(), ".open-agents");
             mkdirSync68(dir, { recursive: true });
-            writeFileSync60(join128(dir, "access"), `${val2}
+            writeFileSync60(join129(dir, "access"), `${val2}
 `, "utf8");
           } catch {
           }
@@ -563012,12 +563157,12 @@ async function handleSlashCommand(input, ctx3) {
         renderInfo2(`Generated API key: ${c3.bold(c3.yellow(apiKey))}`);
         renderInfo2("Use the Web UI ‘key’ button to paste this token, or set Authorization: Bearer <key> in your client.");
         try {
-          const { homedir: homedir46 } = await import("node:os");
+          const { homedir: homedir47 } = await import("node:os");
           const { mkdirSync: mkdirSync68, writeFileSync: writeFileSync60 } = await import("node:fs");
-          const { join: join128 } = await import("node:path");
-          const dir = join128(homedir46(), ".open-agents");
+          const { join: join129 } = await import("node:path");
+          const dir = join129(homedir47(), ".open-agents");
           mkdirSync68(dir, { recursive: true });
-          writeFileSync60(join128(dir, "api.key"), apiKey + "\n", "utf8");
+          writeFileSync60(join129(dir, "api.key"), apiKey + "\n", "utf8");
         } catch {
         }
       }
@@ -563027,13 +563172,13 @@ async function handleSlashCommand(input, ctx3) {
         ctx3.saveSettings({ oaAccess: val });
       }
       const port = parseInt(process.env["OA_PORT"] || "11435", 10);
-      const { homedir: homedir45 } = await import("node:os");
+      const { homedir: homedir46 } = await import("node:os");
       const { mkdirSync: mkdirSync67, writeFileSync: writeFileSync59 } = await import("node:fs");
-      const { join: join127 } = await import("node:path");
+      const { join: join128 } = await import("node:path");
       try {
-        const dir = join127(homedir45(), ".open-agents");
+        const dir = join128(homedir46(), ".open-agents");
         mkdirSync67(dir, { recursive: true });
-        writeFileSync59(join127(dir, "access"), `${val}
+        writeFileSync59(join128(dir, "access"), `${val}
 `, "utf8");
       } catch (e2) {
         renderWarning2(`Could not persist ~/.open-agents/access: ${e2 instanceof Error ? e2.message : String(e2)}`);
@@ -563386,9 +563531,9 @@ async function handleSlashCommand(input, ctx3) {
           renderInfo2("No wallet configured. Ask the agent to create one via the nexus tool.");
         }
       } else if (sub === "name") {
-        const { homedir: homedir45 } = __require("node:os");
+        const { homedir: homedir46 } = __require("node:os");
         const { existsSync: ex, readFileSync: rf, writeFileSync: wf, mkdirSync: mkd } = __require("node:fs");
-        const namePath = __require("node:path").join(homedir45(), ".open-agents", "agent-name");
+        const namePath = __require("node:path").join(homedir46(), ".open-agents", "agent-name");
         if (rest2) {
           const customName = rest2.replace(/[^a-zA-Z0-9_\-.\s]/g, "").trim().slice(0, 40);
           if (!customName) {
@@ -565585,8 +565730,8 @@ sleep 1
           let sponsorName = (config.header.message || "").replace(/^\/+/, "").trim();
           if (!sponsorName || sponsorName.length < 2) {
             try {
-              const { homedir: homedir45 } = __require("os");
-              const namePath = __require("path").join(homedir45(), ".open-agents", "agent-name");
+              const { homedir: homedir46 } = __require("os");
+              const namePath = __require("path").join(homedir46(), ".open-agents", "agent-name");
               if (existsSync83(namePath)) sponsorName = readFileSync66(namePath, "utf8").trim();
             } catch {
             }
@@ -567251,9 +567396,9 @@ async function handleVoiceMenu(ctx3, save2, hasLocal) {
             }
             const { basename: basename21, join: pathJoin } = await import("node:path");
             const { copyFileSync: copyFileSync3, mkdirSync: mkdirSync67, existsSync: exists2 } = await import("node:fs");
-            const { homedir: homedir45 } = await import("node:os");
+            const { homedir: homedir46 } = await import("node:os");
             const modelName = basename21(onnxDrop.path, ".onnx").replace(/[^a-zA-Z0-9_-]/g, "-");
-            const destDir = pathJoin(homedir45(), ".open-agents", "voice", "models", modelName);
+            const destDir = pathJoin(homedir46(), ".open-agents", "voice", "models", modelName);
             if (!exists2(destDir)) mkdirSync67(destDir, { recursive: true });
             copyFileSync3(onnxDrop.path, pathJoin(destDir, "model.onnx"));
             copyFileSync3(jsonDrop.path, pathJoin(destDir, "config.json"));
@@ -568181,8 +568326,8 @@ async function handlePeerEndpoint(peerId, authKey, ctx3, local) {
     if (models.length > 0) {
       try {
         const { writeFileSync: writeFileSync59, mkdirSync: mkdirSync67 } = await import("node:fs");
-        const { join: join127, dirname: dirname39 } = await import("node:path");
-        const cachePath = join127(ctx3.repoRoot || process.cwd(), ".oa", "nexus", "peer-models-cache.json");
+        const { join: join128, dirname: dirname39 } = await import("node:path");
+        const cachePath = join128(ctx3.repoRoot || process.cwd(), ".oa", "nexus", "peer-models-cache.json");
         mkdirSync67(dirname39(cachePath), { recursive: true });
         writeFileSync59(cachePath, JSON.stringify({
           peerId,
@@ -568753,17 +568898,17 @@ async function handleUpdate(subcommand, ctx3) {
   try {
     const { createRequire: createRequire8 } = await import("node:module");
     const { fileURLToPath: fileURLToPath20 } = await import("node:url");
-    const { dirname: dirname39, join: join127 } = await import("node:path");
-    const { existsSync: existsSync109 } = await import("node:fs");
+    const { dirname: dirname39, join: join128 } = await import("node:path");
+    const { existsSync: existsSync110 } = await import("node:fs");
     const req2 = createRequire8(import.meta.url);
     const thisDir = dirname39(fileURLToPath20(import.meta.url));
     const candidates = [
-      join127(thisDir, "..", "package.json"),
-      join127(thisDir, "..", "..", "package.json"),
-      join127(thisDir, "..", "..", "..", "package.json")
+      join128(thisDir, "..", "package.json"),
+      join128(thisDir, "..", "..", "package.json"),
+      join128(thisDir, "..", "..", "..", "package.json")
     ];
     for (const pkgPath of candidates) {
-      if (existsSync109(pkgPath)) {
+      if (existsSync110(pkgPath)) {
         const pkg = req2(pkgPath);
         if (pkg.name === "open-agents-ai" || pkg.name === "@open-agents/cli") {
           currentVersion = pkg.version ?? "0.0.0";
@@ -569910,14 +570055,14 @@ var init_commands = __esm({
           if (val === "any" && !process.env["OA_API_KEY"]) {
             try {
               const { randomBytes: randomBytes25 } = await import("node:crypto");
-              const { homedir: homedir45 } = await import("node:os");
+              const { homedir: homedir46 } = await import("node:os");
               const { mkdirSync: mkdirSync67, writeFileSync: writeFileSync59 } = await import("node:fs");
-              const { join: join127 } = await import("node:path");
+              const { join: join128 } = await import("node:path");
               const apiKey = randomBytes25(16).toString("hex");
               process.env["OA_API_KEY"] = apiKey;
-              const dir = join127(homedir45(), ".open-agents");
+              const dir = join128(homedir46(), ".open-agents");
               mkdirSync67(dir, { recursive: true });
-              writeFileSync59(join127(dir, "api.key"), apiKey + "\n", "utf8");
+              writeFileSync59(join128(dir, "api.key"), apiKey + "\n", "utf8");
               renderInfo2(`Generated API key: ${c3.bold(c3.yellow(apiKey))}`);
               renderInfo2("Use Authorization: Bearer <key> or click 'key' in the Web UI header to paste it.");
             } catch (e2) {
@@ -569931,12 +570076,12 @@ var init_commands = __esm({
           }
           const port = parseInt(process.env["OA_PORT"] || "11435", 10);
           try {
-            const { homedir: homedir45 } = await import("node:os");
+            const { homedir: homedir46 } = await import("node:os");
             const { mkdirSync: mkdirSync67, writeFileSync: writeFileSync59 } = await import("node:fs");
-            const { join: join127 } = await import("node:path");
-            const dir = join127(homedir45(), ".open-agents");
+            const { join: join128 } = await import("node:path");
+            const dir = join128(homedir46(), ".open-agents");
             mkdirSync67(dir, { recursive: true });
-            writeFileSync59(join127(dir, "access"), `${val}
+            writeFileSync59(join128(dir, "access"), `${val}
 `, "utf8");
           } catch {
           }
@@ -585469,10 +585614,168 @@ var init_runtime_keys = __esm({
   }
 });
 
-// packages/cli/src/api/routes-v1.ts
-import { existsSync as existsSync101, readFileSync as readFileSync82, readdirSync as readdirSync34, statSync as statSync34 } from "node:fs";
-import { join as join117, resolve as pathResolve2 } from "node:path";
+// packages/cli/src/api/tor-fallback.ts
+var tor_fallback_exports = {};
+__export(tor_fallback_exports, {
+  getLocalOnion: () => getLocalOnion,
+  torIsReachable: () => torIsReachable,
+  tunnelViaTor: () => tunnelViaTor
+});
+import { existsSync as existsSync101, readFileSync as readFileSync82 } from "node:fs";
 import { homedir as homedir39 } from "node:os";
+import { join as join117 } from "node:path";
+import { createConnection as createConnection3 } from "node:net";
+function getLocalOnion() {
+  const candidates = [
+    join117(homedir39(), "hidden_service_hostname"),
+    join117(homedir39(), ".oa", "tor", "hostname"),
+    "/var/lib/tor/hidden_service/hostname"
+  ];
+  for (const p2 of candidates) {
+    try {
+      if (existsSync101(p2)) {
+        const v = readFileSync82(p2, "utf-8").trim();
+        if (v && v.endsWith(".onion")) return v;
+      }
+    } catch {
+    }
+  }
+  return null;
+}
+async function torIsReachable() {
+  return new Promise((resolve43) => {
+    const sock = createConnection3({ host: DEFAULT_SOCKS_HOST, port: DEFAULT_SOCKS_PORT });
+    let done = false;
+    const finish = (ok2) => {
+      if (done) return;
+      done = true;
+      try {
+        sock.destroy();
+      } catch {
+      }
+      resolve43(ok2);
+    };
+    sock.once("connect", () => finish(true));
+    sock.once("error", () => finish(false));
+    setTimeout(() => finish(false), 500);
+  });
+}
+async function tunnelViaTor(req2) {
+  const headers = { ...req2.headers || {} };
+  if (req2.shareKey) headers["authorization"] = `Bearer ${req2.shareKey}`;
+  if (!headers["host"]) headers["host"] = req2.onion;
+  if (req2.body && !headers["content-length"]) headers["content-length"] = String(Buffer.byteLength(req2.body, "utf-8"));
+  if (!headers["connection"]) headers["connection"] = "close";
+  const lines = [`${req2.method.toUpperCase()} ${req2.path} HTTP/1.1`];
+  for (const [k, v] of Object.entries(headers)) lines.push(`${k}: ${v}`);
+  lines.push("");
+  lines.push("");
+  const reqBuf = Buffer.from(lines.join("\r\n") + (req2.body ?? ""), "utf-8");
+  const socksSock = await openSocks5(req2.onion, 80, req2.timeoutMs ?? 6e4);
+  socksSock.write(reqBuf);
+  const chunks = [];
+  for await (const ch of socksSock) chunks.push(ch);
+  const raw = Buffer.concat(chunks).toString("utf-8");
+  const headerEnd = raw.indexOf("\r\n\r\n");
+  if (headerEnd < 0) throw new Error("Tor: malformed response (no header terminator)");
+  const headBlock = raw.slice(0, headerEnd);
+  const bodyText = raw.slice(headerEnd + 4);
+  const headLines = headBlock.split("\r\n");
+  const statusLine = headLines.shift() ?? "";
+  const m2 = statusLine.match(/^HTTP\/[\d.]+ (\d+)/);
+  const status = m2 ? parseInt(m2[1], 10) : 0;
+  const respHeaders = {};
+  for (const ln of headLines) {
+    const idx = ln.indexOf(":");
+    if (idx <= 0) continue;
+    respHeaders[ln.slice(0, idx).toLowerCase()] = ln.slice(idx + 1).trim();
+  }
+  const ct = (respHeaders["content-type"] || "").toLowerCase();
+  const streaming = ct.includes("text/event-stream") || ct.includes("application/x-ndjson");
+  return { status, headers: respHeaders, body: bodyText, streaming };
+}
+function openSocks5(targetHost, targetPort, timeoutMs) {
+  return new Promise((resolve43, reject) => {
+    const sock = createConnection3({ host: DEFAULT_SOCKS_HOST, port: DEFAULT_SOCKS_PORT });
+    let stage = "greet";
+    const timer = setTimeout(() => {
+      try {
+        sock.destroy(new Error(`Tor SOCKS5 timeout (${timeoutMs}ms)`));
+      } catch {
+      }
+      reject(new Error(`Tor SOCKS5 timeout (${timeoutMs}ms)`));
+    }, timeoutMs);
+    sock.on("error", (e2) => {
+      clearTimeout(timer);
+      reject(e2);
+    });
+    sock.on("connect", () => {
+      sock.write(Buffer.from([5, 1, 0]));
+    });
+    sock.on("data", (chunk) => {
+      if (stage === "greet") {
+        if (chunk.length < 2 || chunk[0] !== 5 || chunk[1] !== 0) {
+          clearTimeout(timer);
+          reject(new Error("Tor SOCKS5: greeting rejected (auth required?)"));
+          try {
+            sock.destroy();
+          } catch {
+          }
+          return;
+        }
+        const hostBuf = Buffer.from(targetHost, "ascii");
+        const buf = Buffer.alloc(7 + hostBuf.length);
+        buf[0] = 5;
+        buf[1] = 1;
+        buf[2] = 0;
+        buf[3] = 3;
+        buf[4] = hostBuf.length;
+        hostBuf.copy(buf, 5);
+        buf.writeUInt16BE(targetPort, 5 + hostBuf.length);
+        sock.write(buf);
+        stage = "connect";
+        return;
+      }
+      if (stage === "connect") {
+        if (chunk.length < 2 || chunk[0] !== 5) {
+          clearTimeout(timer);
+          reject(new Error("Tor SOCKS5: malformed CONNECT reply"));
+          try {
+            sock.destroy();
+          } catch {
+          }
+          return;
+        }
+        if (chunk[1] !== 0) {
+          const code8 = chunk[1];
+          clearTimeout(timer);
+          reject(new Error(`Tor SOCKS5: CONNECT failed (code ${code8})`));
+          try {
+            sock.destroy();
+          } catch {
+          }
+          return;
+        }
+        clearTimeout(timer);
+        stage = "ready";
+        resolve43(sock);
+      }
+    });
+  });
+}
+var DEFAULT_SOCKS_PORT, DEFAULT_SOCKS_HOST;
+var init_tor_fallback = __esm({
+  "packages/cli/src/api/tor-fallback.ts"() {
+    "use strict";
+    DEFAULT_SOCKS_PORT = parseInt(process.env["OA_TOR_SOCKS_PORT"] || "9050", 10);
+    DEFAULT_SOCKS_HOST = process.env["OA_TOR_SOCKS_HOST"] || "127.0.0.1";
+  }
+});
+
+// packages/cli/src/api/routes-v1.ts
+import { existsSync as existsSync102, readFileSync as readFileSync83, readdirSync as readdirSync34, statSync as statSync34 } from "node:fs";
+import { join as join118, resolve as pathResolve2 } from "node:path";
+import { homedir as homedir40 } from "node:os";
 async function tryRouteV1(ctx3) {
   const { pathname, method } = ctx3;
   if (pathname === "/v1/skills" && method === "GET") {
@@ -585554,6 +585857,8 @@ async function tryRouteV1(ctx3) {
     const m2 = /^\/v1\/keys\/([^/]+)$/.exec(pathname);
     if (m2 && method === "DELETE") return handleRevokeKey(ctx3, decodeURIComponent(m2[1]));
   }
+  if (pathname === "/v1/share/generate" && method === "POST") return handleGenerateShare(ctx3);
+  if (pathname === "/v1/remote-proxy" && method === "POST") return handleRemoteProxy(ctx3);
   if (pathname === "/v1/tools" && method === "GET") {
     return handleListTools(ctx3);
   }
@@ -585700,11 +586005,11 @@ async function handleGetSkill(ctx3, name10) {
 async function fallbackDiscoverSkills() {
   return (_root) => {
     const roots = [
-      join117(homedir39(), ".local", "share", "ai-writing-guide")
+      join118(homedir40(), ".local", "share", "ai-writing-guide")
     ];
     const out = [];
     for (const root of roots) {
-      if (!existsSync101(root)) continue;
+      if (!existsSync102(root)) continue;
       walkForSkills(root, out, 0);
     }
     return out;
@@ -585715,12 +586020,12 @@ function walkForSkills(dir, out, depth) {
   try {
     for (const e2 of readdirSync34(dir, { withFileTypes: true })) {
       if (e2.name.startsWith(".") || e2.name === "node_modules") continue;
-      const p2 = join117(dir, e2.name);
+      const p2 = join118(dir, e2.name);
       if (e2.isDirectory()) {
         walkForSkills(p2, out, depth + 1);
       } else if (e2.isFile() && e2.name === "SKILL.md") {
         try {
-          const content = readFileSync82(p2, "utf-8").slice(0, 2e3);
+          const content = readFileSync83(p2, "utf-8").slice(0, 2e3);
           const nameMatch = content.match(/^name:\s*(.+)$/m);
           const descMatch = content.match(/^description:\s*(.+)$/m);
           out.push({
@@ -585904,7 +586209,7 @@ async function getMemoryStores() {
   if (memoryInitTried) return null;
   memoryInitTried = true;
   try {
-    const dbPath = join117(homedir39(), ".open-agents", "memory.db");
+    const dbPath = join118(homedir40(), ".open-agents", "memory.db");
     const sharedDb = initDb(dbPath);
     memoryStoresCache = {
       episode: new EpisodeStore(dbPath),
@@ -586162,7 +586467,7 @@ async function handleFilesRead(ctx3) {
       }));
       return true;
     }
-    if (!existsSync101(resolved)) {
+    if (!existsSync102(resolved)) {
       sendProblem(res, problemDetails({
         type: P.notFound,
         status: 404,
@@ -586194,7 +586499,7 @@ async function handleFilesRead(ctx3) {
       }));
       return true;
     }
-    const content = readFileSync82(resolved, "utf-8");
+    const content = readFileSync83(resolved, "utf-8");
     const offset = typeof body.offset === "number" && body.offset >= 0 ? body.offset : 0;
     const limit = typeof body.limit === "number" && body.limit > 0 ? body.limit : content.length;
     const slice2 = content.slice(offset, offset + limit);
@@ -586427,14 +586732,14 @@ async function handleNexusStatus(ctx3) {
   const { res, requestId } = ctx3;
   try {
     const statePaths = [
-      join117(process.cwd(), ".oa", "nexus-peer-state.json"),
-      join117(homedir39(), ".open-agents", "nexus-peer-cache.json")
+      join118(process.cwd(), ".oa", "nexus-peer-state.json"),
+      join118(homedir40(), ".open-agents", "nexus-peer-cache.json")
     ];
     const states = [];
     for (const p2 of statePaths) {
-      if (!existsSync101(p2)) continue;
+      if (!existsSync102(p2)) continue;
       try {
-        const raw = readFileSync82(p2, "utf-8");
+        const raw = readFileSync83(p2, "utf-8");
         states.push({ source: p2, data: JSON.parse(raw) });
       } catch (e2) {
         states.push({ source: p2, error: String(e2) });
@@ -586461,8 +586766,8 @@ async function handleNexusStatus(ctx3) {
 }
 function loadAgentName() {
   try {
-    const p2 = join117(homedir39(), ".open-agents", "agent-name");
-    if (existsSync101(p2)) return readFileSync82(p2, "utf-8").trim();
+    const p2 = join118(homedir40(), ".open-agents", "agent-name");
+    if (existsSync102(p2)) return readFileSync83(p2, "utf-8").trim();
   } catch {
   }
   return null;
@@ -586471,14 +586776,14 @@ async function handleSponsors(ctx3) {
   const { req: req2, res, url, requestId } = ctx3;
   try {
     const candidates = [
-      join117(homedir39(), ".open-agents", "sponsor-cache.json"),
-      join117(homedir39(), ".open-agents", "sponsors.json")
+      join118(homedir40(), ".open-agents", "sponsor-cache.json"),
+      join118(homedir40(), ".open-agents", "sponsors.json")
     ];
     let sponsors = [];
     for (const p2 of candidates) {
-      if (!existsSync101(p2)) continue;
+      if (!existsSync102(p2)) continue;
       try {
-        const raw = JSON.parse(readFileSync82(p2, "utf-8"));
+        const raw = JSON.parse(readFileSync83(p2, "utf-8"));
         if (Array.isArray(raw)) {
           sponsors = raw;
           break;
@@ -586547,8 +586852,8 @@ async function handleEvaluate(ctx3) {
       }));
       return true;
     }
-    const jobPath = join117(process.cwd(), ".oa", "jobs", `${runId}.json`);
-    if (!existsSync101(jobPath)) {
+    const jobPath = join118(process.cwd(), ".oa", "jobs", `${runId}.json`);
+    if (!existsSync102(jobPath)) {
       sendProblem(res, problemDetails({
         type: P.notFound,
         status: 404,
@@ -586558,7 +586863,7 @@ async function handleEvaluate(ctx3) {
       }));
       return true;
     }
-    const job = JSON.parse(readFileSync82(jobPath, "utf-8"));
+    const job = JSON.parse(readFileSync83(jobPath, "utf-8"));
     sendJson(res, 200, {
       run_id: runId,
       task: job.task,
@@ -586695,6 +587000,358 @@ async function handleMintKey(ctx3) {
   }
   return true;
 }
+function resolveLocalPeerId() {
+  const candidates = [
+    join118(process.cwd(), ".oa", "nexus", "status.json"),
+    join118(homedir40(), ".oa", "nexus", "status.json"),
+    join118(homedir40(), ".open-agents", "nexus", "status.json")
+  ];
+  for (const p2 of candidates) {
+    if (!existsSync102(p2)) continue;
+    try {
+      const data = JSON.parse(readFileSync83(p2, "utf-8"));
+      if (data?.connected && typeof data.peerId === "string" && data.peerId.length > 10) {
+        return { peerId: data.peerId, agentName: typeof data.agentName === "string" ? data.agentName : null, source: p2 };
+      }
+    } catch {
+    }
+  }
+  return null;
+}
+async function handleGenerateShare(ctx3) {
+  const { req: req2, res, requestId } = ctx3;
+  const reqAuth = req2;
+  if (reqAuth._authScope !== "admin") {
+    sendProblem(res, problemDetails({
+      type: P.forbidden,
+      status: 403,
+      title: "Admin scope required",
+      detail: "Generating a share URL mints a runtime key, which requires 'admin' scope.",
+      instance: requestId
+    }));
+    return true;
+  }
+  try {
+    const body = await parseJsonBodyStrict(req2).catch(() => null) ?? {};
+    const label = typeof body["label"] === "string" && body["label"] ? String(body["label"]).slice(0, 100) : `share-${(/* @__PURE__ */ new Date()).toISOString().slice(0, 10)}`;
+    const scope = typeof body["scope"] === "string" && ["read", "run", "admin"].includes(body["scope"]) ? body["scope"] : "run";
+    const owner = `share:${label}`;
+    const { mintKey: mintKey2 } = await Promise.resolve().then(() => (init_runtime_keys(), runtime_keys_exports));
+    const rec = mintKey2({
+      scope,
+      owner,
+      profile: null
+    });
+    const hostHeader = String(req2.headers["host"] || "").trim();
+    const fallbackHost = process.env["OA_HOST"] || "127.0.0.1:11435";
+    let hostPort = hostHeader || fallbackHost;
+    hostPort = hostPort.replace(/^https?:\/\//i, "");
+    const colonIdx = hostPort.lastIndexOf(":");
+    const host = colonIdx > 0 ? hostPort.slice(0, colonIdx) : hostPort;
+    const portStr = colonIdx > 0 ? hostPort.slice(colonIdx + 1) : "11435";
+    const port = parseInt(portStr, 10) || 11435;
+    const fullKey = rec.key || "";
+    const keyPrefix2 = fullKey.slice(0, 12);
+    if (!fullKey) {
+      sendProblem(res, problemDetails({
+        type: P.internalError,
+        status: 500,
+        title: "Key generation succeeded but no secret returned",
+        detail: "mintKey() did not include the full secret in its response.",
+        instance: requestId
+      }));
+      return true;
+    }
+    const directOnly = body["direct"] === true;
+    const peerInfo = directOnly ? null : resolveLocalPeerId();
+    const scheme = String(req2.headers["x-forwarded-proto"] || (req2.socket?.encrypted ? "https" : "http"));
+    const { getLocalOnion: getLocalOnion2 } = await Promise.resolve().then(() => (init_tor_fallback(), tor_fallback_exports));
+    const onion = getLocalOnion2();
+    let shareUrl;
+    let mode;
+    if (peerInfo && hostHeader) {
+      shareUrl = `oa-share://${peerInfo.peerId}@${hostPort}#${fullKey}`;
+      mode = "libp2p+lan";
+    } else if (peerInfo) {
+      shareUrl = `oa-share://${peerInfo.peerId}#${fullKey}`;
+      mode = "libp2p";
+    } else {
+      shareUrl = `oa-share://${hostPort}#${fullKey}`;
+      mode = "direct";
+    }
+    const plainParams = [];
+    if (peerInfo) plainParams.push(`oa-share-peer=${encodeURIComponent(peerInfo.peerId)}`);
+    plainParams.push(`oa-key=${encodeURIComponent(fullKey)}`);
+    if (onion) plainParams.push(`oa-onion=${encodeURIComponent(onion)}`);
+    plainParams.push(`oa-share-label=${encodeURIComponent(label)}`);
+    const plainUrl = `${scheme}://${hostPort}/?${plainParams.join("&")}`;
+    sendJson(res, 201, {
+      shareUrl,
+      plainUrl,
+      mode,
+      peerId: peerInfo?.peerId || null,
+      onion: onion || null,
+      agentName: peerInfo?.agentName || null,
+      host,
+      port,
+      key: fullKey,
+      keyPrefix: keyPrefix2,
+      label,
+      issuedAt: rec.created || (/* @__PURE__ */ new Date()).toISOString(),
+      reach: {
+        libp2p: !!peerInfo,
+        tor: !!onion,
+        direct: !peerInfo
+      },
+      _note: peerInfo && onion ? "Globally reachable via libp2p (primary) and Tor (.onion fallback)." : peerInfo ? "Globally reachable via libp2p. For maximum reach add Tor: see scripts/tor/tor_setup.sh." : "Nexus daemon offline — URL is direct-HTTP only (LAN/VPN reach). Start nexus for global reach."
+    });
+  } catch (err) {
+    sendProblem(res, problemDetails({
+      type: P.internalError,
+      status: 500,
+      title: "Share URL generation failed",
+      detail: err instanceof Error ? err.message : String(err),
+      instance: requestId
+    }));
+  }
+  return true;
+}
+async function handleRemoteProxy(ctx3) {
+  const { req: req2, res, requestId } = ctx3;
+  const reqAuth = req2;
+  if (reqAuth._authScope !== "admin" && reqAuth._authScope !== "run") {
+    sendProblem(res, problemDetails({
+      type: P.forbidden,
+      status: 403,
+      title: "Auth required",
+      detail: "Remote proxy requires 'run' or 'admin' scope on the LOCAL daemon.",
+      instance: requestId
+    }));
+    return true;
+  }
+  let body;
+  try {
+    body = await parseJsonBodyStrict(req2);
+  } catch {
+    sendProblem(res, problemDetails({
+      type: P.invalidRequest,
+      status: 400,
+      title: "Invalid JSON body",
+      detail: "Body must be JSON object with peerId, key, method, path.",
+      instance: requestId
+    }));
+    return true;
+  }
+  const peerId = String(body?.peerId || "").trim();
+  const onionHint = typeof body?.onion === "string" && body.onion.endsWith(".onion") ? body.onion : null;
+  const shareKey = String(body?.key || "").trim();
+  const method = String(body?.method || "GET").toUpperCase();
+  const path8 = String(body?.path || "/").trim();
+  const headers = body?.headers && typeof body.headers === "object" ? body.headers : {};
+  const useStream = body?.stream === true;
+  const timeoutMs = typeof body?.timeoutMs === "number" ? body.timeoutMs : 6e4;
+  if (!peerId && !onionHint || !shareKey) {
+    sendProblem(res, problemDetails({
+      type: P.invalidRequest,
+      status: 400,
+      title: "key + (peerId or onion) required",
+      detail: "Provide a share key and at least one of peerId (libp2p) or onion (Tor).",
+      instance: requestId
+    }));
+    return true;
+  }
+  const nexusCandidates = [
+    join118(process.cwd(), ".oa", "nexus"),
+    join118(homedir40(), ".oa", "nexus"),
+    join118(homedir40(), ".open-agents", "nexus")
+  ];
+  let nexusDirPath = null;
+  for (const p2 of nexusCandidates) {
+    if (existsSync102(join118(p2, "status.json"))) {
+      nexusDirPath = p2;
+      break;
+    }
+  }
+  let tool = null;
+  if (peerId && nexusDirPath) {
+    const { NexusTool: NexusTool2 } = await Promise.resolve().then(() => (init_dist5(), dist_exports));
+    const nexusToolRepoRoot = nexusDirPath.replace(/[\\/]\.oa[\\/]nexus$/, "");
+    tool = new NexusTool2(nexusToolRepoRoot);
+  }
+  const tunnelInput = {
+    method,
+    path: path8,
+    headers,
+    body: body?.body,
+    key: shareKey
+  };
+  function torEnvelope(t2) {
+    return {
+      event: "http.head",
+      data: JSON.stringify({ status: t2.status, headers: t2.headers, streaming: t2.streaming }),
+      // The browser fetch interceptor reads either `event: http.head + data` (with embedded
+      // status/headers) or falls back to `raw`. We pass both.
+      raw: t2.body,
+      transport: "tor"
+    };
+  }
+  if (!useStream) {
+    let libp2pErr = null;
+    if (tool) {
+      try {
+        const raw = await tool.sendCommand("invoke_capability", {
+          target_peer: peerId,
+          capability: "http_tunnel",
+          input: JSON.stringify(tunnelInput)
+        }, timeoutMs);
+        let parsed = null;
+        try {
+          parsed = JSON.parse(raw);
+        } catch {
+          parsed = { raw };
+        }
+        if (parsed && typeof parsed === "object") parsed.transport = "libp2p";
+        sendJson(res, 200, parsed);
+        return true;
+      } catch (e2) {
+        libp2pErr = e2;
+      }
+    }
+    if (onionHint) {
+      try {
+        const { tunnelViaTor: tunnelViaTor2, torIsReachable: torIsReachable2 } = await Promise.resolve().then(() => (init_tor_fallback(), tor_fallback_exports));
+        if (await torIsReachable2()) {
+          const t2 = await tunnelViaTor2({
+            onion: onionHint,
+            method,
+            path: path8,
+            headers,
+            body: typeof body?.body === "string" ? body.body : body?.body !== void 0 ? JSON.stringify(body.body) : void 0,
+            shareKey,
+            timeoutMs
+          });
+          sendJson(res, 200, torEnvelope(t2));
+          return true;
+        }
+      } catch (torErr) {
+        sendProblem(res, problemDetails({
+          type: P.internalError,
+          status: 502,
+          title: "Both libp2p and Tor transports failed",
+          detail: `libp2p: ${libp2pErr instanceof Error ? libp2pErr.message : String(libp2pErr || "n/a")}; tor: ${torErr instanceof Error ? torErr.message : String(torErr)}`,
+          instance: requestId
+        }));
+        return true;
+      }
+    }
+    sendProblem(res, problemDetails({
+      type: P.internalError,
+      status: 502,
+      title: "No transport reached the remote",
+      detail: tool ? `libp2p invoke failed: ${libp2pErr instanceof Error ? libp2pErr.message : String(libp2pErr)}${onionHint ? "; Tor SOCKS5 not reachable on 127.0.0.1:9050" : "; no .onion fallback available"}` : "Local nexus daemon is offline and no .onion fallback was provided. Start nexus with `oa connect` or include onion in the request.",
+      instance: requestId
+    }));
+    return true;
+  }
+  if (!tool) {
+    sendProblem(res, problemDetails({
+      type: P.internalError,
+      status: 503,
+      title: "Streaming requires libp2p (nexus not running)",
+      detail: "SSE/streaming proxy requires the local nexus daemon. Start it with `oa connect`, or use a non-streaming endpoint with the Tor fallback.",
+      instance: requestId
+    }));
+    return true;
+  }
+  const streamFile = join118(nexusDirPath, `tunnel-${requestId}-${Date.now()}.jsonl`);
+  try {
+    const { writeFileSync: _wfs } = await import("node:fs");
+    _wfs(streamFile, "");
+  } catch {
+  }
+  res.statusCode = 200;
+  res.setHeader("content-type", "text/event-stream");
+  res.setHeader("cache-control", "no-cache");
+  res.setHeader("x-accel-buffering", "no");
+  res.flushHeaders?.();
+  let stopped = false;
+  const stop2 = () => {
+    stopped = true;
+  };
+  req2.on("close", stop2);
+  req2.on("aborted", stop2);
+  const invokeP = tool.sendCommand("invoke_capability", {
+    target_peer: peerId,
+    capability: "http_tunnel",
+    input: JSON.stringify(tunnelInput),
+    stream_file: streamFile
+  }, timeoutMs).catch((err) => {
+    if (!stopped) {
+      try {
+        res.write(`event: error
+data: ${JSON.stringify({ error: err instanceof Error ? err.message : String(err) })}
+
+`);
+      } catch {
+      }
+    }
+  });
+  const { readFileSync: _rfs, existsSync: _exists } = await import("node:fs");
+  let lastSize = 0;
+  let leftover = "";
+  while (!stopped) {
+    try {
+      if (_exists(streamFile)) {
+        const stat5 = (await import("node:fs")).statSync(streamFile);
+        if (stat5.size > lastSize) {
+          const fd = (await import("node:fs")).openSync(streamFile, "r");
+          const len = stat5.size - lastSize;
+          const buf = Buffer.alloc(len);
+          (await import("node:fs")).readSync(fd, buf, 0, len, lastSize);
+          (await import("node:fs")).closeSync(fd);
+          lastSize = stat5.size;
+          const txt = leftover + buf.toString("utf-8");
+          const parts = txt.split("\n");
+          leftover = parts.pop() ?? "";
+          for (const ln of parts) {
+            if (!ln.trim()) continue;
+            let parsed;
+            try {
+              parsed = JSON.parse(ln);
+            } catch {
+              continue;
+            }
+            const eventName = parsed.type === "event" ? parsed.event || "data" : parsed.type;
+            res.write(`event: ${eventName}
+`);
+            res.write(`data: ${JSON.stringify(parsed)}
+
+`);
+            if (parsed.type === "done" || parsed.type === "error") {
+              stopped = true;
+              break;
+            }
+          }
+        }
+      }
+    } catch {
+    }
+    if (stopped) break;
+    await new Promise((r2) => setTimeout(r2, 30));
+  }
+  await invokeP.catch(() => {
+  });
+  try {
+    res.end();
+  } catch {
+  }
+  try {
+    const { unlinkSync: _unl } = await import("node:fs");
+    _unl(streamFile);
+  } catch {
+  }
+  return true;
+}
 async function handleRevokeKey(ctx3, prefix) {
   const { req: req2, res, requestId } = ctx3;
   const reqAuth = req2;
@@ -587046,17 +587703,17 @@ async function handleListAgentTypes(ctx3) {
 }
 async function handleListEngines(ctx3) {
   const { res } = ctx3;
-  const home = homedir39();
+  const home = homedir40();
   sendJson(res, 200, {
     engines: [
-      { name: "dream", state_file: join117(process.cwd(), ".oa", "dreams"), controllable_via: "SSE + slash commands" },
-      { name: "bless", state_file: join117(process.cwd(), ".oa", "bless-state.json"), controllable_via: "slash commands" },
-      { name: "call", state_file: join117(process.cwd(), ".oa", "call-state.json"), controllable_via: "slash commands" },
-      { name: "listen", state_file: join117(process.cwd(), ".oa", "listen-state.json"), controllable_via: "slash commands" },
-      { name: "telegram", state_file: join117(home, ".open-agents", "telegram-state.json"), controllable_via: "slash commands" },
-      { name: "expose", state_file: join117(process.cwd(), ".oa", "expose-state.json"), controllable_via: "/expose commands" },
-      { name: "nexus", state_file: join117(home, ".open-agents", "nexus-peer-cache.json"), controllable_via: "/nexus commands" },
-      { name: "ipfs", state_file: join117(process.cwd(), ".oa", "ipfs"), controllable_via: "slash commands" }
+      { name: "dream", state_file: join118(process.cwd(), ".oa", "dreams"), controllable_via: "SSE + slash commands" },
+      { name: "bless", state_file: join118(process.cwd(), ".oa", "bless-state.json"), controllable_via: "slash commands" },
+      { name: "call", state_file: join118(process.cwd(), ".oa", "call-state.json"), controllable_via: "slash commands" },
+      { name: "listen", state_file: join118(process.cwd(), ".oa", "listen-state.json"), controllable_via: "slash commands" },
+      { name: "telegram", state_file: join118(home, ".open-agents", "telegram-state.json"), controllable_via: "slash commands" },
+      { name: "expose", state_file: join118(process.cwd(), ".oa", "expose-state.json"), controllable_via: "/expose commands" },
+      { name: "nexus", state_file: join118(home, ".open-agents", "nexus-peer-cache.json"), controllable_via: "/nexus commands" },
+      { name: "ipfs", state_file: join118(process.cwd(), ".oa", "ipfs"), controllable_via: "slash commands" }
     ],
     note: "Engine instrumentation lives in the running TUI process. Full status + control requires the daemon↔TUI bridge (PT-07). See parity audit WO-PARITY-04."
   });
@@ -587139,12 +587796,12 @@ async function tryAimsRoute(ctx3) {
   return false;
 }
 function aimsDir() {
-  return join117(homedir39(), ".open-agents", "aims");
+  return join118(homedir40(), ".open-agents", "aims");
 }
 function readAimsFile(name10, fallback) {
   try {
-    const p2 = join117(aimsDir(), name10);
-    if (existsSync101(p2)) return JSON.parse(readFileSync82(p2, "utf-8"));
+    const p2 = join118(aimsDir(), name10);
+    if (existsSync102(p2)) return JSON.parse(readFileSync83(p2, "utf-8"));
   } catch {
   }
   return fallback;
@@ -587153,7 +587810,7 @@ function writeAimsFile(name10, data) {
   const dir = aimsDir();
   const { mkdirSync: mkdirSync67, writeFileSync: wf, renameSync: rn } = __require("node:fs");
   mkdirSync67(dir, { recursive: true });
-  const finalPath = join117(dir, name10);
+  const finalPath = join118(dir, name10);
   const tmpPath = `${finalPath}.tmp.${process.pid}.${Date.now()}`;
   try {
     wf(tmpPath, JSON.stringify(data, null, 2) + "\n", { encoding: "utf-8", mode: 384 });
@@ -587483,12 +588140,12 @@ async function handleAimsSuppliers(ctx3) {
       }
     ];
     const sponsorPaths = [
-      join117(homedir39(), ".open-agents", "sponsor-cache.json")
+      join118(homedir40(), ".open-agents", "sponsor-cache.json")
     ];
     for (const p2 of sponsorPaths) {
-      if (!existsSync101(p2)) continue;
+      if (!existsSync102(p2)) continue;
       try {
-        const raw = JSON.parse(readFileSync82(p2, "utf-8"));
+        const raw = JSON.parse(readFileSync83(p2, "utf-8"));
         const list = Array.isArray(raw) ? raw : raw?.sponsors ?? [];
         for (const s2 of list) {
           suppliers.push({
@@ -589011,7 +589668,7 @@ body { display:flex; flex-direction:column; height:100vh; margin:0; overflow:hid
     <span id="sidebar-status-dot" style="width:8px;height:8px;border-radius:50%;background:var(--color-fg-faint);flex-shrink:0" title="Backend connection"></span>
     <span id="sidebar-status-text" style="flex:1;white-space:nowrap;overflow:hidden;text-overflow:ellipsis">connecting...</span>
     <button id="sidebar-update-btn" onclick="doUpdate()" style="display:none;background:var(--color-warning);border:none;color:#000;padding:2px 6px;border-radius:var(--radius-sm);font-size:0.6rem;cursor:pointer;font-weight:600">update</button>
-    <button id="sidebar-key-btn" onclick="document.getElementById('key-modal').style.display='flex'" title="Set API key" style="background:transparent;border:1px solid var(--color-border);color:var(--color-fg-muted);padding:2px 6px;border-radius:var(--radius-sm);font-size:0.6rem;cursor:pointer">key</button>
+    <button id="sidebar-key-btn" onclick="openKeyModal()" title="Set API key / share access" style="background:transparent;border:1px solid var(--color-border);color:var(--color-fg-muted);padding:2px 6px;border-radius:var(--radius-sm);font-size:0.6rem;cursor:pointer">key</button>
   </div>
 
   <!-- Resize handle -->
@@ -589343,14 +590000,21 @@ body { display:flex; flex-direction:column; height:100vh; margin:0; overflow:hid
 </div>
 
 <div id="key-modal">
-  <form class="modal" onsubmit="event.preventDefault(); saveKey();" autocomplete="off">
-    <h3>API Key</h3>
-    <input id="key-input" type="password" placeholder="Bearer token (leave empty if auth disabled)" autocomplete="new-password">
-    <div>
+  <form class="modal" onsubmit="event.preventDefault(); saveKey();" autocomplete="off" style="min-width:480px">
+    <h3>API Key &amp; Sharing</h3>
+    <div style="position:relative">
+      <input id="key-input" type="password" placeholder="Bearer token (leave empty if auth disabled, or paste an oa-share:// URL to connect remote)" autocomplete="new-password" oninput="onKeyInputChange(this.value)" onfocus="showRecentKeysDropdown()" onblur="setTimeout(hideRecentKeysDropdown, 150)">
+      <div id="key-recent-dropdown" style="display:none;position:absolute;top:100%;left:0;right:0;background:var(--color-bg-elevated);border:1px solid var(--color-border);border-radius:var(--radius-sm);max-height:180px;overflow-y:auto;z-index:10;font-size:0.78rem;margin-top:2px"></div>
+    </div>
+    <p id="key-input-hint" style="font-size:0.7rem;color:var(--color-fg-muted);margin:4px 0 8px">Tip: paste an <code>oa-share://host:port#key</code> URL or <code>http://host:port/?oa-key=…</code> to connect to a remote OA instance.</p>
+    <div style="display:flex;gap:6px;flex-wrap:wrap">
       <button type="submit">save</button>
       <button type="button" onclick="clearKey()">clear</button>
+      <button type="button" onclick="generateShareUrl()" title="Generate a share URL that lets a remote OA instance connect to this one">share access</button>
       <button type="button" onclick="closeKeyModal()">cancel</button>
     </div>
+    <div id="share-result" style="display:none;margin-top:14px;padding:10px;background:var(--color-bg-elevated);border:1px solid var(--color-border);border-radius:var(--radius-sm);font-size:0.78rem"></div>
+    <div id="remote-state" style="display:none;margin-top:14px;padding:10px;background:var(--color-bg-elevated);border:1px solid var(--color-accent);border-radius:var(--radius-sm);font-size:0.78rem"></div>
   </form>
 </div>
 
@@ -590472,6 +591136,15 @@ async function sendMessage() {
       messageWithContext = filesBlock + text;
     }
 
+    // FRESH-SESSION: pull the one-shot fresh flag the newChatSession()
+    // handler set. Consumed (cleared) here so subsequent sends within
+    // this same session don't keep claiming "fresh" and miss legitimate
+    // mid-session handoff.
+    let _freshPending = false;
+    try {
+      _freshPending = localStorage.getItem('oa.freshSessionPending') === '1';
+      if (_freshPending) localStorage.removeItem('oa.freshSessionPending');
+    } catch {}
     const body = {
       session_id: chatSessionId,
       model: modelSelect.value,
@@ -590481,6 +591154,10 @@ async function sendMessage() {
       // Pass the user-selected workspace as working_directory so the
       // agent subprocess operates in the right cwd.
       ...(chatWorkingDir ? { working_directory: chatWorkingDir } : {}),
+      // FRESH-SESSION: tell the daemon to skip cross-task handoff
+      // injection on this turn. Daemon plumbs it to OA_FRESH_SESSION=1
+      // for the agent subprocess; runner's handoff block respects it.
+      ...(_freshPending ? { fresh: true } : {}),
     };
 
     const response = await fetch('/v1/chat', {
@@ -590788,11 +591465,174 @@ document.getElementById('key-btn').onclick = () => {
   document.getElementById('key-input').value = apiKey;
 };
 function saveKey() {
-  apiKey = document.getElementById('key-input').value;
+  const raw = document.getElementById('key-input').value || '';
+  const parsed = parseShareInput(raw);
+  if (parsed) {
+    // Save into recent-keys for autocomplete
+    const recLabel = parsed.label || (parsed.peerId
+      ? ('remote ' + (parsed.peerId.slice(0, 12) + '…'))
+      : ('remote ' + parsed.host));
+    saveRecentKey({
+      key: parsed.key, peerId: parsed.peerId, onion: parsed.onion || null,
+      host: parsed.host, label: recLabel,
+    });
+    if (parsed.peerId || parsed.onion) {
+      // ─── REMOTE MODE: libp2p (primary) + Tor (fallback) ──────────────
+      // Stay on this page; route /v1/... calls through this daemon's
+      // /v1/remote-proxy. The local daemon will try libp2p invoke first
+      // (when peerId is set); if that fails (or peerId missing) it
+      // falls back to Tor SOCKS5 → onion (when onion is set).
+      try {
+        localStorage.setItem('oa.activeRemoteShare', JSON.stringify({
+          peerId: parsed.peerId,
+          onion: parsed.onion || null,
+          key: parsed.key,
+          host: parsed.host || null,
+          label: recLabel,
+          activatedAt: new Date().toISOString(),
+        }));
+      } catch {}
+      installRemoteFetchProxy();
+      closeKeyModal();
+      try { location.reload(); } catch { loadModels(); }
+      return;
+    }
+    if (parsed.host) {
+      // Legacy direct-HTTP — open the remote origin in a new tab.
+      const remoteUrl = (parsed.scheme || 'http') + '://' + parsed.host + '/?oa-key=' + encodeURIComponent(parsed.key) + '&oa-share-label=' + encodeURIComponent(parsed.label || '');
+      window.open(remoteUrl, '_blank');
+      closeKeyModal();
+      return;
+    }
+  }
+  apiKey = raw;
   localStorage.setItem('oa-api-key', apiKey);
+  if (apiKey) {
+    saveRecentKey({ key: apiKey, host: location.host, label: 'local ' + location.host });
+  }
   closeKeyModal();
   loadModels();
 }
+
+// ─── Remote-mode fetch proxy ─────────────────────────────────────────────
+// When 'oa.activeRemoteShare' is set, intercept window.fetch so any
+// /v1/... call gets re-routed via POST /v1/remote-proxy to be tunneled
+// through libp2p to the remote peer. SSE streams keep their text/event-
+// stream shape end-to-end.
+let _oaRemoteFetchInstalled = false;
+function getActiveRemoteShare() {
+  try {
+    const raw = localStorage.getItem('oa.activeRemoteShare');
+    if (!raw) return null;
+    const obj = JSON.parse(raw);
+    if (!obj || !obj.peerId || !obj.key) return null;
+    return obj;
+  } catch { return null; }
+}
+function clearActiveRemoteShare() {
+  try { localStorage.removeItem('oa.activeRemoteShare'); } catch {}
+}
+function installRemoteFetchProxy() {
+  if (_oaRemoteFetchInstalled) return;
+  _oaRemoteFetchInstalled = true;
+  const _origFetch = window.fetch.bind(window);
+  window.fetch = async function(input, init) {
+    const share = getActiveRemoteShare();
+    if (!share) return _origFetch(input, init);
+    let urlStr = '';
+    if (typeof input === 'string') urlStr = input;
+    else if (input && input.url) urlStr = input.url;
+    else return _origFetch(input, init);
+    let pathOnly;
+    try {
+      const u = new URL(urlStr, location.href);
+      // Don't proxy:
+      //   - cross-origin (already remote)
+      //   - the proxy endpoint itself (infinite loop)
+      //   - non-/v1/* routes (e.g. /assets, /openapi.json)
+      if (u.origin !== location.origin) return _origFetch(input, init);
+      if (u.pathname === '/v1/remote-proxy') return _origFetch(input, init);
+      if (!u.pathname.startsWith('/v1/')) return _origFetch(input, init);
+      pathOnly = u.pathname + u.search;
+    } catch { return _origFetch(input, init); }
+
+    const method = ((init && init.method) || (input && input.method) || 'GET').toUpperCase();
+    const headersIn = {};
+    if (init && init.headers) {
+      const h = init.headers;
+      if (h instanceof Headers) h.forEach((v, k) => { headersIn[k] = v; });
+      else if (Array.isArray(h)) h.forEach(([k, v]) => { headersIn[k] = v; });
+      else Object.assign(headersIn, h);
+    }
+    let bodyOut;
+    if (init && init.body !== undefined && init.body !== null) {
+      if (typeof init.body === 'string') bodyOut = init.body;
+      else if (init.body instanceof FormData) {
+        const obj = {}; init.body.forEach((v, k) => { obj[k] = v; });
+        bodyOut = obj;
+      } else bodyOut = init.body;
+    }
+    // Heuristic: SSE if Accept includes text/event-stream OR the path is
+    // a known streaming endpoint. We open the proxy in stream mode and
+    // surface a Response with text/event-stream.
+    const acceptHdr = (headersIn['accept'] || headersIn['Accept'] || '').toLowerCase();
+    const wantsStream = acceptHdr.includes('text/event-stream')
+      || pathOnly.includes('/v1/chat/completions')
+      || pathOnly.includes('/v1/events');
+
+    const proxyBody = JSON.stringify({
+      peerId: share.peerId || null,
+      onion: share.onion || null,
+      key: share.key,
+      method, path: pathOnly, headers: headersIn, body: bodyOut,
+      stream: wantsStream, timeoutMs: 120000,
+    });
+    if (wantsStream) {
+      // Pass through as-is — receiver returns text/event-stream.
+      return _origFetch('/v1/remote-proxy', {
+        method: 'POST',
+        headers: { 'content-type': 'application/json', 'accept': 'text/event-stream' },
+        body: proxyBody,
+      });
+    }
+    // Non-stream: receiver returns a JSON envelope { status, headers, body }.
+    // Synthesize a Response that mimics the original remote response.
+    const proxyResp = await _origFetch('/v1/remote-proxy', {
+      method: 'POST',
+      headers: { 'content-type': 'application/json' },
+      body: proxyBody,
+    });
+    if (!proxyResp.ok) return proxyResp;
+    let env = null;
+    try { env = await proxyResp.json(); } catch {}
+    if (!env || typeof env !== 'object') {
+      return new Response('', { status: 502, statusText: 'Empty proxy response' });
+    }
+    // The non-stream envelope is the http_tunnel handler last event,
+    // with its body JSON-stringified inside the data field. Unwrap it.
+    let status = 200;
+    let headersOut = new Headers();
+    let bodyText = '';
+    if (typeof env.raw === 'string') {
+      // Single-shot result from the http_tunnel head+body events combined
+      bodyText = env.raw;
+    } else if (env.event === 'http.body' || env.event === 'http.head') {
+      try {
+        const inner = JSON.parse(env.data);
+        if (inner.status) status = inner.status;
+        if (inner.headers) Object.entries(inner.headers).forEach(([k, v]) => headersOut.set(k, String(v)));
+      } catch {}
+      bodyText = String(env.data || '');
+    } else {
+      bodyText = JSON.stringify(env);
+    }
+    return new Response(bodyText, { status, headers: headersOut });
+  };
+}
+// Auto-install on every load if a remote share is active.
+try {
+  if (getActiveRemoteShare()) installRemoteFetchProxy();
+} catch {}
 function clearKey() {
   apiKey = '';
   localStorage.removeItem('oa-api-key');
@@ -590802,7 +591642,351 @@ function clearKey() {
 }
 function closeKeyModal() {
   document.getElementById('key-modal').classList.remove('visible');
+  const sr = document.getElementById('share-result'); if (sr) sr.style.display = 'none';
 }
+function openKeyModal() {
+  document.getElementById('key-modal').classList.add('visible');
+  document.getElementById('key-input').value = apiKey;
+  // Refresh the remote-state hint based on current localStorage.
+  refreshKeyModalRemoteState();
+}
+window.openKeyModal = openKeyModal;
+
+// ─── Share URL parsing ─────────────────────────────────────────────────
+// Accepts:
+//   oa-share://<peerId>#<key>                  (libp2p, global)
+//   oa-share://<peerId>@<host:port>#<key>      (libp2p w/ LAN hint)
+//   oa-share://<host:port>#<key>               (legacy direct-HTTP)
+//   http(s)://host:port/?oa-key=KEY[&oa-share-peer=PID&oa-share-label=L]
+// Returns { peerId?, host?, key, scheme?, label? } or null when the input
+// is a plain key. peerId is a libp2p PeerID (starts with 12D3KooW or Qm).
+function _looksLikePeerId(s) {
+  if (!s || typeof s !== 'string') return false;
+  // libp2p PeerIDs are base58-encoded multihashes, typically starting with
+  // 12D3KooW (Ed25519) or Qm (RSA). Length ~46-52 chars, no dots or colons.
+  return /^(12D3KooW|Qm)[1-9A-HJ-NP-Za-km-z]{30,}$/.test(s);
+}
+function parseShareInput(raw) {
+  const v = String(raw || '').trim();
+  if (!v) return null;
+  // oa-share scheme — custom parser since URL() doesn't always honor it.
+  if (v.toLowerCase().startsWith('oa-share://')) {
+    const after = v.slice('oa-share://'.length);
+    const hashIdx = after.indexOf('#');
+    if (hashIdx < 0) return null;
+    const hostPart = after.slice(0, hashIdx);
+    const key = after.slice(hashIdx + 1);
+    if (!hostPart || !key) return null;
+    // Three shapes:
+    //   peerId@host:port   → libp2p+LAN
+    //   peerId             → libp2p only (no host)
+    //   host:port          → legacy direct
+    const atIdx = hostPart.indexOf('@');
+    if (atIdx >= 0) {
+      const peerId = hostPart.slice(0, atIdx);
+      const host = hostPart.slice(atIdx + 1);
+      return { peerId: _looksLikePeerId(peerId) ? peerId : null, host, key, scheme: 'http' };
+    }
+    if (_looksLikePeerId(hostPart)) {
+      return { peerId: hostPart, host: null, key, scheme: 'libp2p' };
+    }
+    return { peerId: null, host: hostPart, key, scheme: 'http' };
+  }
+  // http(s) URL with ?oa-key=, optional ?oa-share-peer=, optional ?oa-onion=
+  if (/^https?:\\/\\//i.test(v)) {
+    try {
+      const u = new URL(v);
+      const k = u.searchParams.get('oa-key');
+      if (!k) return null;
+      const peerIdQ = u.searchParams.get('oa-share-peer') || null;
+      const onionQ = u.searchParams.get('oa-onion') || null;
+      const label = u.searchParams.get('oa-share-label') || '';
+      return {
+        peerId: _looksLikePeerId(peerIdQ) ? peerIdQ : null,
+        onion: (onionQ && onionQ.endsWith('.onion')) ? onionQ : null,
+        host: u.host, key: k,
+        scheme: u.protocol.replace(':', ''), label,
+      };
+    } catch { return null; }
+  }
+  return null;
+}
+
+function onKeyInputChange(v) {
+  const hint = document.getElementById('key-input-hint');
+  if (!hint) return;
+  const parsed = parseShareInput(v);
+  if (parsed) {
+    hint.innerHTML = '✓ detected share URL — host <code>' + escapeHtml(parsed.host) + '</code>; clicking save will open the remote UI with this key';
+    hint.style.color = 'var(--color-success)';
+  } else {
+    hint.innerHTML = 'Tip: paste an <code>oa-share://host:port#key</code> URL or <code>http://host:port/?oa-key=…</code> to connect to a remote OA instance.';
+    hint.style.color = 'var(--color-fg-muted)';
+  }
+  showRecentKeysDropdown();
+}
+
+// Tiny HTML escape — same as the one used in connections settings.
+function escapeHtml(s) {
+  return String(s || '').replace(/&/g, '&amp;').replace(/</g, '&lt;').replace(/>/g, '&gt;').replace(/"/g, '&quot;').replace(/'/g, '&#39;');
+}
+
+// ─── Recent keys (localStorage history with autocomplete dropdown) ──
+const _OA_RECENT_KEYS_LS = 'oa.recentKeys';
+const _OA_RECENT_KEYS_MAX = 10;
+function loadRecentKeys() {
+  try {
+    const raw = localStorage.getItem(_OA_RECENT_KEYS_LS);
+    if (!raw) return [];
+    const parsed = JSON.parse(raw);
+    return Array.isArray(parsed) ? parsed : [];
+  } catch { return []; }
+}
+function saveRecentKey(rec) {
+  if (!rec || !rec.key) return;
+  let list = loadRecentKeys();
+  // Move existing entry with same key to top; otherwise prepend.
+  list = list.filter(r => r.key !== rec.key);
+  list.unshift({ ...rec, lastUsed: new Date().toISOString() });
+  if (list.length > _OA_RECENT_KEYS_MAX) list = list.slice(0, _OA_RECENT_KEYS_MAX);
+  try { localStorage.setItem(_OA_RECENT_KEYS_LS, JSON.stringify(list)); } catch {}
+}
+function deleteRecentKey(key) {
+  let list = loadRecentKeys().filter(r => r.key !== key);
+  try { localStorage.setItem(_OA_RECENT_KEYS_LS, JSON.stringify(list)); } catch {}
+  showRecentKeysDropdown();
+}
+window.deleteRecentKey = deleteRecentKey;
+
+function showRecentKeysDropdown() {
+  const dd = document.getElementById('key-recent-dropdown');
+  if (!dd) return;
+  const recents = loadRecentKeys();
+  const inp = document.getElementById('key-input');
+  const filter = (inp && inp.value || '').toLowerCase();
+  const matches = recents.filter(r => {
+    if (!filter) return true;
+    return (r.key || '').toLowerCase().includes(filter)
+        || (r.host || '').toLowerCase().includes(filter)
+        || (r.label || '').toLowerCase().includes(filter);
+  });
+  if (matches.length === 0) { dd.style.display = 'none'; return; }
+  dd.innerHTML = matches.map(r => {
+    const k = String(r.key || '');
+    const masked = k.length > 12 ? k.slice(0, 4) + '…' + k.slice(-4) : k;
+    const host = escapeHtml(r.host || '');
+    const label = escapeHtml(r.label || '');
+    const keySafe = k.replace(/\\\\/g, '\\\\\\\\').replace(/'/g, "\\\\'");
+    return '<div class="oa-rec-key" style="display:flex;align-items:center;gap:8px;padding:6px 10px;cursor:pointer;border-bottom:1px solid var(--color-border)" '
+      + 'onclick="useRecentKey(\\'' + keySafe + '\\')" '
+      + 'onmouseover="this.style.background=\\'var(--color-bg-hover)\\'" '
+      + 'onmouseout="this.style.background=\\'transparent\\'">'
+      + '<span style="flex:1;font-family:var(--font-mono);font-size:0.78rem"><span style="color:var(--color-fg-muted)">' + (host || 'local') + '</span> · <code>' + masked + '</code></span>'
+      + '<span style="font-size:0.7rem;color:var(--color-fg-muted)">' + label + '</span>'
+      + '<button type="button" onclick="event.stopPropagation();deleteRecentKey(\\'' + keySafe + '\\')" '
+      +   'title="Forget this key" '
+      +   'style="background:transparent;border:none;color:var(--color-fg-muted);cursor:pointer;font-size:1rem;padding:0 4px">&times;</button>'
+      + '</div>';
+  }).join('');
+  dd.style.display = 'block';
+}
+function hideRecentKeysDropdown() {
+  const dd = document.getElementById('key-recent-dropdown');
+  if (dd) dd.style.display = 'none';
+}
+function useRecentKey(k) {
+  const inp = document.getElementById('key-input');
+  if (inp) {
+    inp.value = k;
+    inp.focus();
+    onKeyInputChange(k);
+  }
+  hideRecentKeysDropdown();
+}
+window.useRecentKey = useRecentKey;
+
+// ─── Generate share URL ────────────────────────────────────────────────
+async function generateShareUrl() {
+  const out = document.getElementById('share-result');
+  if (!out) return;
+  out.style.display = 'block';
+  out.innerHTML = '<div style="color:var(--color-fg-muted)">generating…</div>';
+  try {
+    const r = await fetch('/v1/share/generate', {
+      method: 'POST',
+      headers: { ...headers(), 'Content-Type': 'application/json' },
+      body: JSON.stringify({ scope: 'run' }),
+    });
+    if (r.status === 403) {
+      out.innerHTML = '<div style="color:var(--color-error)">✗ admin scope required — your current key does not have permission to mint share URLs. Set an admin-scope key first.</div>';
+      return;
+    }
+    if (r.status >= 400) {
+      const err = await r.json().catch(() => ({}));
+      out.innerHTML = '<div style="color:var(--color-error)">✗ HTTP ' + r.status + (err.detail ? ' — ' + escapeHtml(err.detail) : '') + '</div>';
+      return;
+    }
+    const j = await r.json();
+    const safeShare = escapeHtml(j.shareUrl || '');
+    const safePlain = escapeHtml(j.plainUrl || '');
+    out.innerHTML =
+      '<div style="font-weight:500;margin-bottom:6px;color:var(--color-success)">✓ Share URL generated — hand off to remote</div>' +
+      '<div style="margin:6px 0">' +
+        '<label style="display:block;font-size:0.7rem;color:var(--color-fg-muted);margin-bottom:2px">oa-share URL (compact, recommended for OA-to-OA)</label>' +
+        '<div style="display:flex;gap:6px;align-items:center">' +
+          '<input readonly value="' + safeShare + '" style="flex:1;background:var(--color-bg-input);border:1px solid var(--color-border);color:var(--color-fg);padding:5px 8px;border-radius:var(--radius-sm);font-family:var(--font-mono);font-size:0.74rem">' +
+          '<button type="button" onclick="copyShareUrl(\\'oa-share\\')" style="font-size:0.74rem">copy</button>' +
+        '</div>' +
+      '</div>' +
+      '<div style="margin:6px 0">' +
+        '<label style="display:block;font-size:0.7rem;color:var(--color-fg-muted);margin-bottom:2px">plain URL (works in any browser, no scheme handler needed)</label>' +
+        '<div style="display:flex;gap:6px;align-items:center">' +
+          '<input readonly value="' + safePlain + '" style="flex:1;background:var(--color-bg-input);border:1px solid var(--color-border);color:var(--color-fg);padding:5px 8px;border-radius:var(--radius-sm);font-family:var(--font-mono);font-size:0.74rem">' +
+          '<button type="button" onclick="copyShareUrl(\\'plain\\')" style="font-size:0.74rem">copy</button>' +
+        '</div>' +
+      '</div>' +
+      '<p style="font-size:0.68rem;color:var(--color-fg-muted);margin:6px 0 0">Note: this URL contains the full secret. Anyone with it can use this OA. To revoke: open Advanced settings → keys → revoke the prefix <code>' + escapeHtml(j.keyPrefix || '') + '</code>.</p>';
+    // Stash for the copy buttons + add to recent.
+    window.__oaLastShareUrl = j.shareUrl;
+    window.__oaLastPlainUrl = j.plainUrl;
+    saveRecentKey({ key: j.key, host: j.host + ':' + j.port, label: j.label || ('shared ' + j.host) });
+  } catch (e) {
+    out.innerHTML = '<div style="color:var(--color-error)">✗ ' + escapeHtml(e && e.message ? e.message : String(e)) + '</div>';
+  }
+}
+function copyShareUrl(which) {
+  const v = which === 'plain' ? window.__oaLastPlainUrl : window.__oaLastShareUrl;
+  if (!v) return;
+  if (navigator.clipboard && navigator.clipboard.writeText) {
+    navigator.clipboard.writeText(v).then(
+      () => { /* ok */ },
+      () => { fallbackCopy(v); }
+    );
+  } else {
+    fallbackCopy(v);
+  }
+}
+function fallbackCopy(v) {
+  const ta = document.createElement('textarea');
+  ta.value = v; document.body.appendChild(ta); ta.select();
+  try { document.execCommand('copy'); } catch {}
+  document.body.removeChild(ta);
+}
+window.generateShareUrl = generateShareUrl;
+window.copyShareUrl = copyShareUrl;
+
+// ─── Remote-state helpers (visual indicator on the key button) ───────
+// When localStorage carries oa.remoteHost we are in REMOTE mode: the
+// key was loaded from an oa-share URL or via on-load ?oa-key=. The key
+// button shows a "remote" badge and clicking expands to show host+key
+// inline with a "close connection" button that severs and shuffles the
+// key into recents.
+function refreshKeyModalRemoteState() {
+  // Two remote modes coexist:
+  //   1. libp2p — oa.activeRemoteShare = {peerId, key, host?, label}
+  //   2. direct — oa.remoteHost (legacy, set by ?oa-key= pickup)
+  const active = getActiveRemoteShare();
+  const directHost = (function() {
+    try { return localStorage.getItem('oa.remoteHost') || ''; } catch { return ''; }
+  })();
+  const isRemote = !!active || !!directHost;
+  let remoteLabel;
+  if (active) {
+    const parts = [];
+    if (active.peerId) parts.push('libp2p ' + active.peerId.slice(0, 12) + '…');
+    if (active.onion) parts.push('tor ' + active.onion.slice(0, 16) + '…');
+    if (active.host) parts.push(active.host);
+    remoteLabel = parts.join(' / ') || 'remote';
+  } else {
+    remoteLabel = directHost;
+  }
+  const stateBox = document.getElementById('remote-state');
+  const btn = document.getElementById('sidebar-key-btn');
+  if (isRemote && btn) {
+    btn.textContent = 'remote';
+    btn.style.background = 'var(--color-accent)';
+    btn.style.color = '#fff';
+    btn.style.borderColor = 'var(--color-accent)';
+    btn.title = 'connected to ' + remoteLabel + ' — click to view / disconnect';
+  } else if (btn) {
+    btn.textContent = 'key';
+    btn.style.background = 'transparent';
+    btn.style.color = 'var(--color-fg-muted)';
+    btn.style.borderColor = 'var(--color-border)';
+    btn.title = 'set API key / share access';
+  }
+  if (!stateBox) return;
+  if (isRemote) {
+    const safe = escapeHtml(remoteLabel);
+    let mode;
+    if (active) {
+      const tiers = [];
+      if (active.peerId) tiers.push('libp2p');
+      if (active.onion) tiers.push('tor');
+      mode = tiers.join(' + ') + ' (global)';
+    } else {
+      mode = 'direct (LAN/VPN)';
+    }
+    stateBox.style.display = 'block';
+    stateBox.innerHTML =
+      '<div style="font-weight:500;color:var(--color-accent)">REMOTE connection active</div>' +
+      '<div style="margin-top:4px;font-size:0.74rem">mode <code>' + escapeHtml(mode) + '</code></div>' +
+      '<div style="margin-top:2px;font-size:0.74rem">target <code>' + safe + '</code></div>' +
+      '<div style="margin-top:8px"><button type="button" onclick="closeRemoteConnection()" style="background:var(--color-error);color:#fff;border:none;padding:4px 10px;border-radius:var(--radius-sm);cursor:pointer;font-size:0.74rem">close connection</button></div>';
+  } else {
+    stateBox.style.display = 'none';
+  }
+}
+function closeRemoteConnection() {
+  // Save the active remote into recents before clearing.
+  const active = getActiveRemoteShare();
+  if (active) {
+    saveRecentKey({
+      key: active.key, peerId: active.peerId, host: active.host,
+      label: 'recent ' + (active.label || ('remote ' + (active.peerId || '').slice(0, 12) + '…')),
+    });
+    clearActiveRemoteShare();
+  } else {
+    let savedKey = ''; let savedHost = '';
+    try {
+      savedKey = localStorage.getItem('oa-api-key') || '';
+      savedHost = localStorage.getItem('oa.remoteHost') || '';
+    } catch {}
+    if (savedKey) saveRecentKey({ key: savedKey, host: savedHost, label: 'recent remote ' + savedHost });
+  }
+  try {
+    localStorage.removeItem('oa.remoteHost');
+    localStorage.removeItem('oa.remoteScheme');
+    localStorage.removeItem('oa-api-key');
+  } catch {}
+  apiKey = '';
+  refreshKeyModalRemoteState();
+  location.reload();
+}
+window.closeRemoteConnection = closeRemoteConnection;
+
+// ─── On-load: ?oa-key=... pickup ───────────────────────────────────────
+// When the page loads with an oa-key query param (i.e. someone clicked
+// a share URL), capture the key into localStorage, mark this as a
+// remote session (host = this origin), and clean the URL.
+(function pickupShareKeyFromUrl() {
+  try {
+    const u = new URL(location.href);
+    const k = u.searchParams.get('oa-key');
+    if (!k) return;
+    const label = u.searchParams.get('oa-share-label') || '';
+    localStorage.setItem('oa-api-key', k);
+    // Origin-based remote: when the page loaded from a different host
+    // than the user's "home" OA, that's a remote session by definition.
+    localStorage.setItem('oa.remoteHost', location.host);
+    localStorage.setItem('oa.remoteScheme', location.protocol.replace(':', ''));
+    saveRecentKey({ key: k, host: location.host, label: label || ('remote ' + location.host) });
+    // Strip the key from the URL so it isn't visible / browser-history'd.
+    u.searchParams.delete('oa-key');
+    u.searchParams.delete('oa-share-label');
+    history.replaceState({}, '', u.pathname + (u.search || '') + (u.hash || ''));
+  } catch {}
+})();
 
 // Tab switching
 const allPanels = ['chat-container','agent-panel','jobs-panel','config-panel','activity-panel','projects-panel','voice-panel'];
@@ -591536,6 +592720,11 @@ function newChatSession() {
   switchSession('');
   const sel = document.getElementById('chat-session-select');
   if (sel) sel.value = '';
+  // FRESH-SESSION: mark the next chat send as fresh so the daemon skips
+  // cross-task handoff injection (which previously bled prior session
+  // context into the new chat regardless of the browser's reset).
+  // Cleared inside the chat send handler after one use.
+  try { localStorage.setItem('oa.freshSessionPending', '1'); } catch {}
 }
 function deleteChatSession() {
   if (!chatSessionId) return;
@@ -592399,6 +593588,7 @@ async function doUpdate() {
   try { pollMetrics(); } catch {}
   try { loadScheduled(); } catch {}
   try { loadServices(); } catch {}
+  try { refreshKeyModalRemoteState(); } catch {}
 
   btn.textContent = 'updated v' + newVersion;
   btn.style.background = '#1a3a1a';
@@ -593383,6 +594573,7 @@ $currentProject.subscribe((proj) => {
   try { if (typeof updateSessionSelect === 'function') updateSessionSelect(); } catch {}
   try { if (typeof updateAgentRunSelect === 'function') updateAgentRunSelect(); } catch {}
   try { if (typeof restoreChatSession === 'function') restoreChatSession(); } catch {}
+  try { if (typeof refreshKeyModalRemoteState === 'function') refreshKeyModalRemoteState(); } catch {}
 });
 
 // $selectedModel changes update the visible <select> if it's not
@@ -595561,15 +596752,15 @@ var init_auth_oidc = __esm({
 });
 
 // packages/cli/src/api/usage-tracker.ts
-import { mkdirSync as mkdirSync60, readFileSync as readFileSync83, writeFileSync as writeFileSync52, existsSync as existsSync102 } from "node:fs";
-import { join as join118 } from "node:path";
+import { mkdirSync as mkdirSync60, readFileSync as readFileSync84, writeFileSync as writeFileSync52, existsSync as existsSync103 } from "node:fs";
+import { join as join119 } from "node:path";
 function initUsageTracker(oaDir) {
-  const dir = join118(oaDir, "usage");
+  const dir = join119(oaDir, "usage");
   mkdirSync60(dir, { recursive: true });
-  usageFile = join118(dir, "token-usage.json");
+  usageFile = join119(dir, "token-usage.json");
   try {
-    if (existsSync102(usageFile)) {
-      store = JSON.parse(readFileSync83(usageFile, "utf-8"));
+    if (existsSync103(usageFile)) {
+      store = JSON.parse(readFileSync84(usageFile, "utf-8"));
     }
   } catch {
     store = { providers: {}, lastSaved: "" };
@@ -595633,24 +596824,24 @@ var init_usage_tracker = __esm({
 });
 
 // packages/cli/src/api/profiles.ts
-import { existsSync as existsSync103, readFileSync as readFileSync84, writeFileSync as writeFileSync53, mkdirSync as mkdirSync61, readdirSync as readdirSync35, unlinkSync as unlinkSync23 } from "node:fs";
-import { join as join119 } from "node:path";
-import { homedir as homedir40 } from "node:os";
+import { existsSync as existsSync104, readFileSync as readFileSync85, writeFileSync as writeFileSync53, mkdirSync as mkdirSync61, readdirSync as readdirSync35, unlinkSync as unlinkSync23 } from "node:fs";
+import { join as join120 } from "node:path";
+import { homedir as homedir41 } from "node:os";
 import { createCipheriv as createCipheriv4, createDecipheriv as createDecipheriv4, randomBytes as randomBytes22, scryptSync as scryptSync3 } from "node:crypto";
 function globalProfileDir() {
-  return join119(homedir40(), ".open-agents", "profiles");
+  return join120(homedir41(), ".open-agents", "profiles");
 }
 function projectProfileDir(projectDir2) {
-  return join119(projectDir2 || process.cwd(), ".oa", "profiles");
+  return join120(projectDir2 || process.cwd(), ".oa", "profiles");
 }
 function listProfiles(projectDir2) {
   const result = [];
   const seen = /* @__PURE__ */ new Set();
   const projDir = projectProfileDir(projectDir2);
-  if (existsSync103(projDir)) {
+  if (existsSync104(projDir)) {
     for (const f2 of readdirSync35(projDir).filter((f3) => f3.endsWith(".json"))) {
       try {
-        const raw = JSON.parse(readFileSync84(join119(projDir, f2), "utf8"));
+        const raw = JSON.parse(readFileSync85(join120(projDir, f2), "utf8"));
         const name10 = f2.replace(".json", "");
         seen.add(name10);
         result.push({
@@ -595664,12 +596855,12 @@ function listProfiles(projectDir2) {
     }
   }
   const globDir = globalProfileDir();
-  if (existsSync103(globDir)) {
+  if (existsSync104(globDir)) {
     for (const f2 of readdirSync35(globDir).filter((f3) => f3.endsWith(".json"))) {
       const name10 = f2.replace(".json", "");
       if (seen.has(name10)) continue;
       try {
-        const raw = JSON.parse(readFileSync84(join119(globDir, f2), "utf8"));
+        const raw = JSON.parse(readFileSync85(join120(globDir, f2), "utf8"));
         result.push({
           name: name10,
           description: raw.description || "",
@@ -595684,11 +596875,11 @@ function listProfiles(projectDir2) {
 }
 function loadProfile(name10, password, projectDir2) {
   const sanitized = name10.replace(/[^a-zA-Z0-9_-]/g, "");
-  const projPath = join119(projectProfileDir(projectDir2), `${sanitized}.json`);
-  const globPath = join119(globalProfileDir(), `${sanitized}.json`);
-  const filePath = existsSync103(projPath) ? projPath : existsSync103(globPath) ? globPath : null;
+  const projPath = join120(projectProfileDir(projectDir2), `${sanitized}.json`);
+  const globPath = join120(globalProfileDir(), `${sanitized}.json`);
+  const filePath = existsSync104(projPath) ? projPath : existsSync104(globPath) ? globPath : null;
   if (!filePath) return null;
-  const raw = JSON.parse(readFileSync84(filePath, "utf8"));
+  const raw = JSON.parse(readFileSync85(filePath, "utf8"));
   if (raw.encrypted === true) {
     if (!password) return null;
     return decryptProfile(raw, password);
@@ -595699,7 +596890,7 @@ function saveProfile(profile, password, scope = "global", projectDir2) {
   const dir = scope === "project" ? projectProfileDir(projectDir2) : globalProfileDir();
   mkdirSync61(dir, { recursive: true });
   const sanitized = profile.name.replace(/[^a-zA-Z0-9_-]/g, "");
-  const filePath = join119(dir, `${sanitized}.json`);
+  const filePath = join120(dir, `${sanitized}.json`);
   profile.modified = (/* @__PURE__ */ new Date()).toISOString();
   if (password) {
     const encrypted = encryptProfile(profile, password);
@@ -595712,8 +596903,8 @@ function saveProfile(profile, password, scope = "global", projectDir2) {
 function deleteProfile(name10, scope = "global", projectDir2) {
   const sanitized = name10.replace(/[^a-zA-Z0-9_-]/g, "");
   const dir = scope === "project" ? projectProfileDir(projectDir2) : globalProfileDir();
-  const filePath = join119(dir, `${sanitized}.json`);
-  if (existsSync103(filePath)) {
+  const filePath = join120(dir, `${sanitized}.json`);
+  if (existsSync104(filePath)) {
     unlinkSync23(filePath);
     return true;
   }
@@ -595828,23 +597019,23 @@ var init_profiles = __esm({
 
 // packages/cli/src/docker.ts
 import { execSync as execSync56, spawn as spawn24 } from "node:child_process";
-import { existsSync as existsSync104, mkdirSync as mkdirSync62, writeFileSync as writeFileSync54 } from "node:fs";
-import { join as join120, resolve as resolve37, dirname as dirname35 } from "node:path";
-import { homedir as homedir41 } from "node:os";
+import { existsSync as existsSync105, mkdirSync as mkdirSync62, writeFileSync as writeFileSync54 } from "node:fs";
+import { join as join121, resolve as resolve37, dirname as dirname35 } from "node:path";
+import { homedir as homedir42 } from "node:os";
 import { fileURLToPath as fileURLToPath16 } from "node:url";
 function getDockerDir() {
   try {
     if (typeof __dirname !== "undefined") {
-      return join120(__dirname, "..", "..", "..", "docker");
+      return join121(__dirname, "..", "..", "..", "docker");
     }
   } catch {
   }
   try {
     const thisDir = dirname35(fileURLToPath16(import.meta.url));
-    return join120(thisDir, "..", "..", "..", "docker");
+    return join121(thisDir, "..", "..", "..", "docker");
   } catch {
   }
-  return join120(process.cwd(), "docker");
+  return join121(process.cwd(), "docker");
 }
 function isDockerAvailable() {
   try {
@@ -595975,10 +597166,10 @@ async function ensureOaImage(force = false) {
   }
   let buildContext;
   const dockerDir = getDockerDir();
-  if (existsSync104(join120(dockerDir, "Dockerfile"))) {
+  if (existsSync105(join121(dockerDir, "Dockerfile"))) {
     buildContext = dockerDir;
   } else {
-    buildContext = join120(homedir41(), ".oa", "docker-build");
+    buildContext = join121(homedir42(), ".oa", "docker-build");
     mkdirSync62(buildContext, { recursive: true });
     writeDockerfiles(buildContext);
   }
@@ -596053,8 +597244,8 @@ chown -R node:node /workspace /home/node/.oa /home/node/.open-agents 2>/dev/null
 if [ "$1" = "oa" ]; then shift; exec su - node -c "cd /workspace && oa $*"; fi
 exec "$@"
 `;
-  writeFileSync54(join120(dir, "Dockerfile"), dockerfile);
-  writeFileSync54(join120(dir, "docker-entrypoint.sh"), entrypoint, { mode: 493 });
+  writeFileSync54(join121(dir, "Dockerfile"), dockerfile);
+  writeFileSync54(join121(dir, "docker-entrypoint.sh"), entrypoint, { mode: 493 });
 }
 function hasNvidiaGpu() {
   try {
@@ -596307,23 +597498,23 @@ import * as http5 from "node:http";
 import * as https3 from "node:https";
 import { createRequire as createRequire5 } from "node:module";
 import { fileURLToPath as fileURLToPath17 } from "node:url";
-import { dirname as dirname36, join as join121, resolve as resolve38 } from "node:path";
-import { homedir as homedir42 } from "node:os";
+import { dirname as dirname36, join as join122, resolve as resolve38 } from "node:path";
+import { homedir as homedir43 } from "node:os";
 import { spawn as spawn25, execSync as execSync57 } from "node:child_process";
-import { mkdirSync as mkdirSync63, writeFileSync as writeFileSync55, readFileSync as readFileSync85, readdirSync as readdirSync36, existsSync as existsSync105, watch as fsWatch3, renameSync as renameSync8, unlinkSync as unlinkSync24 } from "node:fs";
+import { mkdirSync as mkdirSync63, writeFileSync as writeFileSync55, readFileSync as readFileSync86, readdirSync as readdirSync36, existsSync as existsSync106, watch as fsWatch3, renameSync as renameSync8, unlinkSync as unlinkSync24 } from "node:fs";
 import { randomBytes as randomBytes23, randomUUID as randomUUID16 } from "node:crypto";
 import { createHash as createHash19 } from "node:crypto";
 function getVersion3() {
   try {
     const thisDir = dirname36(fileURLToPath17(import.meta.url));
     const candidates = [
-      join121(thisDir, "..", "package.json"),
-      join121(thisDir, "..", "..", "package.json"),
-      join121(thisDir, "..", "..", "..", "package.json")
+      join122(thisDir, "..", "package.json"),
+      join122(thisDir, "..", "..", "package.json"),
+      join122(thisDir, "..", "..", "..", "package.json")
     ];
     for (const pkgPath of candidates) {
       try {
-        if (!existsSync105(pkgPath)) continue;
+        if (!existsSync106(pkgPath)) continue;
         const pkg = require3(pkgPath);
         if (pkg.name === "open-agents-ai" || pkg.name === "@open-agents/cli" || pkg.name === "@open-agents/monorepo") {
           return pkg.version ?? "0.0.0";
@@ -596525,9 +597716,9 @@ function isOriginAllowed(origin) {
   if (!origin) return true;
   let accessMode = (process.env["OA_ACCESS"] || "").toLowerCase().trim();
   try {
-    const accessFile = join121(homedir42(), ".open-agents", "access");
-    if (existsSync105(accessFile)) {
-      const persisted = readFileSync85(accessFile, "utf8").trim().toLowerCase();
+    const accessFile = join122(homedir43(), ".open-agents", "access");
+    if (existsSync106(accessFile)) {
+      const persisted = readFileSync86(accessFile, "utf8").trim().toLowerCase();
       if (persisted === "any" || persisted === "lan" || persisted === "loopback") {
         accessMode = persisted;
       }
@@ -596587,7 +597778,7 @@ async function retrieveMemoryContext(userMessage, sessionId, maxEpisodes = 5) {
     if (!memMod || !memMod.EpisodeStore) {
       return { contextBlock: "", retrieved: [] };
     }
-    const dbPath = join121(homedir42(), ".open-agents", "memory.db");
+    const dbPath = join122(homedir43(), ".open-agents", "memory.db");
     const store2 = new memMod.EpisodeStore(dbPath);
     const recent = store2.search({ limit: 30, sessionId: void 0 }) ?? [];
     const qLower = userMessage.toLowerCase();
@@ -596630,7 +597821,7 @@ async function writeMemoryEpisodes(sessionId, userMessage, assistantContent, too
   try {
     const memMod = await Promise.resolve().then(() => (init_dist7(), dist_exports2)).catch(() => null);
     if (!memMod || !memMod.EpisodeStore) return 0;
-    const dbPath = join121(homedir42(), ".open-agents", "memory.db");
+    const dbPath = join122(homedir43(), ".open-agents", "memory.db");
     const store2 = new memMod.EpisodeStore(dbPath);
     let written = 0;
     try {
@@ -596952,27 +598143,27 @@ function ollamaStream(ollamaUrl, path8, method, body, onData, onEnd, onError, ti
 }
 function jobsDir() {
   const root = resolve38(process.cwd());
-  const dir = join121(root, ".oa", "jobs");
+  const dir = join122(root, ".oa", "jobs");
   mkdirSync63(dir, { recursive: true });
   return dir;
 }
 function loadJob(id) {
-  const file = join121(jobsDir(), `${id}.json`);
-  if (!existsSync105(file)) return null;
+  const file = join122(jobsDir(), `${id}.json`);
+  if (!existsSync106(file)) return null;
   try {
-    return JSON.parse(readFileSync85(file, "utf-8"));
+    return JSON.parse(readFileSync86(file, "utf-8"));
   } catch {
     return null;
   }
 }
 function listJobs() {
   const dir = jobsDir();
-  if (!existsSync105(dir)) return [];
+  if (!existsSync106(dir)) return [];
   const files = readdirSync36(dir).filter((f2) => f2.endsWith(".json")).sort();
   const jobs = [];
   for (const file of files) {
     try {
-      jobs.push(JSON.parse(readFileSync85(join121(dir, file), "utf-8")));
+      jobs.push(JSON.parse(readFileSync86(join122(dir, file), "utf-8")));
     } catch {
     }
   }
@@ -596982,14 +598173,14 @@ function pruneOldJobs() {
   const retentionH = parseFloat(process.env["OA_RUN_RETENTION_H"] || "24");
   const cutoffMs = Date.now() - (Number.isFinite(retentionH) && retentionH > 0 ? retentionH : 24) * 36e5;
   const dir = jobsDir();
-  if (!existsSync105(dir)) return { pruned: 0, kept: 0 };
+  if (!existsSync106(dir)) return { pruned: 0, kept: 0 };
   let pruned = 0;
   let kept = 0;
   for (const file of readdirSync36(dir)) {
     if (!file.endsWith(".json")) continue;
-    const path8 = join121(dir, file);
+    const path8 = join122(dir, file);
     try {
-      const job = JSON.parse(readFileSync85(path8, "utf-8"));
+      const job = JSON.parse(readFileSync86(path8, "utf-8"));
       if (job.status === "running") {
         kept++;
         continue;
@@ -597002,7 +598193,7 @@ function pruneOldJobs() {
         } catch {
         }
         const outFile = path8.replace(/\.json$/, ".output");
-        if (existsSync105(outFile)) {
+        if (existsSync106(outFile)) {
           try {
             unlinkSync24(outFile);
           } catch {
@@ -597295,7 +598486,7 @@ function autoSeedTodosFromPrompt(prompt) {
   return [];
 }
 function atomicJobWrite(dir, id, job) {
-  const finalPath = join121(dir, `${id}.json`);
+  const finalPath = join122(dir, `${id}.json`);
   const tmpPath = `${finalPath}.tmp.${process.pid}.${Date.now()}`;
   try {
     writeFileSync55(tmpPath, JSON.stringify(job, null, 2), "utf-8");
@@ -598721,23 +599912,23 @@ ${task}` : task;
   });
 }
 function updateStateFile() {
-  return join121(homedir42(), ".open-agents", "update-state.json");
+  return join122(homedir43(), ".open-agents", "update-state.json");
 }
 function updateLogPath() {
-  return join121(homedir42(), ".open-agents", "update.log");
+  return join122(homedir43(), ".open-agents", "update.log");
 }
 function readUpdateState() {
   try {
     const p2 = updateStateFile();
-    if (!existsSync105(p2)) return null;
-    return JSON.parse(readFileSync85(p2, "utf-8"));
+    if (!existsSync106(p2)) return null;
+    return JSON.parse(readFileSync86(p2, "utf-8"));
   } catch {
     return null;
   }
 }
 function writeUpdateState(state) {
   try {
-    const dir = join121(homedir42(), ".open-agents");
+    const dir = join122(homedir43(), ".open-agents");
     mkdirSync63(dir, { recursive: true });
     const finalPath = updateStateFile();
     const tmpPath = `${finalPath}.tmp.${process.pid}`;
@@ -598785,15 +599976,15 @@ async function handleV1Update(req2, res, requestId) {
     const { execSync: es } = require3("node:child_process");
     const isWin2 = process.platform === "win32";
     let npmBin = "";
-    for (const candidate of isWin2 ? [join121(nodeDir, "npm.cmd"), join121(nodeDir, "npm")] : [join121(nodeDir, "npm"), "/usr/local/bin/npm", "/usr/bin/npm"]) {
-      if (existsSync105(candidate)) {
+    for (const candidate of isWin2 ? [join122(nodeDir, "npm.cmd"), join122(nodeDir, "npm")] : [join122(nodeDir, "npm"), "/usr/local/bin/npm", "/usr/bin/npm"]) {
+      if (existsSync106(candidate)) {
         npmBin = candidate;
         break;
       }
     }
     if (!npmBin) npmBin = isWin2 ? "npm.cmd" : "npm";
     const pkgSpec = `open-agents-ai@${targetVersion}`;
-    const dir = join121(homedir42(), ".open-agents");
+    const dir = join122(homedir43(), ".open-agents");
     fs7.mkdirSync(dir, { recursive: true });
     const logFd = fs7.openSync(logPath3, "w");
     const npmPrefix = dirname36(nodeDir);
@@ -598803,13 +599994,13 @@ async function handleV1Update(req2, res, requestId) {
         globalBinDir = es(`${npmBin} bin -g`, { encoding: "utf8", timeout: 5e3, stdio: "pipe" }).trim();
       } else {
         const npmCliCandidates = [
-          join121(nodeDir, "..", "lib", "node_modules", "npm", "bin", "npm-cli.js"),
-          join121(npmBin, "..", "..", "lib", "node_modules", "npm", "bin", "npm-cli.js")
+          join122(nodeDir, "..", "lib", "node_modules", "npm", "bin", "npm-cli.js"),
+          join122(npmBin, "..", "..", "lib", "node_modules", "npm", "bin", "npm-cli.js")
         ];
         let npmCli = "";
         for (const c9 of npmCliCandidates) {
           try {
-            if (existsSync105(c9)) {
+            if (existsSync106(c9)) {
               npmCli = c9;
               break;
             }
@@ -598841,13 +600032,13 @@ async function handleV1Update(req2, res, requestId) {
       });
     } else {
       const npmCliCandidates = [
-        join121(nodeDir, "..", "lib", "node_modules", "npm", "bin", "npm-cli.js"),
-        join121(npmBin, "..", "..", "lib", "node_modules", "npm", "bin", "npm-cli.js")
+        join122(nodeDir, "..", "lib", "node_modules", "npm", "bin", "npm-cli.js"),
+        join122(npmBin, "..", "..", "lib", "node_modules", "npm", "bin", "npm-cli.js")
       ];
       let npmCli = "";
       for (const c9 of npmCliCandidates) {
         try {
-          if (existsSync105(c9)) {
+          if (existsSync106(c9)) {
             npmCli = c9;
             break;
           }
@@ -598944,8 +600135,8 @@ function handleV1UpdateStatus(res) {
   let logTail = "";
   let exitCode = null;
   try {
-    if (existsSync105(logPath3)) {
-      const raw = readFileSync85(logPath3, "utf-8");
+    if (existsSync106(logPath3)) {
+      const raw = readFileSync86(logPath3, "utf-8");
       const m2 = raw.match(/__EXIT_CODE=(\d+)/);
       if (m2) exitCode = parseInt(m2[1], 10);
       logTail = raw.slice(-2e3);
@@ -599041,7 +600232,7 @@ async function handleV1Run(req2, res) {
   if (workingDir) {
     cwd4 = resolve38(workingDir);
   } else if (isolate) {
-    const wsDir = join121(dir, "..", "workspaces", id);
+    const wsDir = join122(dir, "..", "workspaces", id);
     mkdirSync63(wsDir, { recursive: true });
     cwd4 = wsDir;
   } else {
@@ -599228,7 +600419,7 @@ async function handleV1Run(req2, res) {
     let output = "";
     let tailBytes = 0;
     const TAIL_BUDGET = 1048576;
-    const outputWriter = new DiskTaskOutput(join121(dir, `${id}.output`));
+    const outputWriter = new DiskTaskOutput(join122(dir, `${id}.output`));
     job.outputFile = outputWriter.path;
     atomicJobWrite(dir, id, job);
     child.stdout?.on("data", (chunk) => {
@@ -600994,6 +602185,9 @@ ${historyLines}
       runEnv["OA_RUN_USER"] = req2._authUser || "anonymous";
       runEnv["OA_RUN_SCOPE"] = req2._authScope || "admin";
       runEnv["OA_SESSION_ID"] = session.id;
+      if (chatBody["fresh"] === true) {
+        runEnv["OA_FRESH_SESSION"] = "1";
+      }
       runEnv["OLLAMA_HOST"] = currentCfg.backendUrl || process.env["OLLAMA_HOST"] || "http://127.0.0.1:11434";
       if (currentCfg.apiKey) runEnv["OA_API_KEY_INHERIT"] = currentCfg.apiKey;
       const child = spawn25(process.execPath, [oaBin, ...args], {
@@ -601799,7 +602993,7 @@ ${steering}`;
 function getScheduleRoots() {
   const rootsEnv = process.env["OA_SCHEDULE_ROOTS"] || "";
   const roots = rootsEnv.split(rootsEnv.includes(";") ? ";" : ":").filter(Boolean);
-  const defaults3 = [process.cwd(), join121(homedir42(), "Documents")];
+  const defaults3 = [process.cwd(), join122(homedir43(), "Documents")];
   const set = /* @__PURE__ */ new Set([...defaults3, ...roots]);
   return [...set];
 }
@@ -601811,10 +603005,10 @@ function listScheduledTasks() {
   for (const root of roots) {
     try {
       walk(root, 0, (dir) => {
-        if (dir.endsWith(`${join121(".oa", "scheduled")}`) || dir.includes(`${join121(".oa", "scheduled")}`)) {
-          const file = join121(dir, "tasks.json");
+        if (dir.endsWith(`${join122(".oa", "scheduled")}`) || dir.includes(`${join122(".oa", "scheduled")}`)) {
+          const file = join122(dir, "tasks.json");
           try {
-            const raw = readFileSync85(file, "utf-8");
+            const raw = readFileSync86(file, "utf-8");
             const json = JSON.parse(raw);
             const tasks = Array.isArray(json?.tasks) ? json.tasks : Array.isArray(json) ? json : [];
             tasks.forEach((t2, i2) => {
@@ -601879,7 +603073,7 @@ function walk(dir, depth, onDir, maxDepth) {
     if (e2.name === "node_modules" || e2.name.startsWith(".")) {
       if (e2.name !== ".oa") continue;
     }
-    const child = join121(dir, e2.name);
+    const child = join122(dir, e2.name);
     walk(child, depth + 1, onDir, maxDepth);
   }
 }
@@ -601888,7 +603082,7 @@ function setScheduledEnabled(id, enabled2) {
   const target = tasks.find((t2) => t2.id === id);
   if (!target) return false;
   try {
-    const raw = readFileSync85(target.file, "utf-8");
+    const raw = readFileSync86(target.file, "utf-8");
     const json = JSON.parse(raw);
     const arr = Array.isArray(json?.tasks) ? json.tasks : Array.isArray(json) ? json : [];
     if (!arr[target.index]) return false;
@@ -601921,7 +603115,7 @@ function deleteScheduledById(id) {
   const target = tasks.find((t2) => t2.id === id);
   if (!target) return false;
   try {
-    const raw = readFileSync85(target.file, "utf-8");
+    const raw = readFileSync86(target.file, "utf-8");
     const json = JSON.parse(raw);
     const arr = Array.isArray(json?.tasks) ? json.tasks : Array.isArray(json) ? json : [];
     if (!arr[target.index]) return false;
@@ -602186,11 +603380,11 @@ function reconcileScheduledTasks(apply) {
   const errors = [];
   for (const f2 of found) {
     const wdir = f2.workingDir || process.cwd();
-    const file = join121(wdir, ".oa", "scheduled", "tasks.json");
+    const file = join122(wdir, ".oa", "scheduled", "tasks.json");
     try {
       let json = { tasks: [] };
       try {
-        const raw = readFileSync85(file, "utf-8");
+        const raw = readFileSync86(file, "utf-8");
         json = JSON.parse(raw);
       } catch {
       }
@@ -602201,8 +603395,8 @@ function reconcileScheduledTasks(apply) {
           const entry = { task: f2.task || `legacy ${f2.id}`, schedule: f2.cron, enabled: true };
           arr.push(entry);
           const toWrite = Array.isArray(json?.tasks) ? { ...json, tasks: arr } : Array.isArray(json) ? arr : { tasks: arr };
-          mkdirSync63(join121(wdir, ".oa", "scheduled"), { recursive: true });
-          mkdirSync63(join121(wdir, ".oa", "scheduled", "logs"), { recursive: true });
+          mkdirSync63(join122(wdir, ".oa", "scheduled"), { recursive: true });
+          mkdirSync63(join122(wdir, ".oa", "scheduled", "logs"), { recursive: true });
           writeFileSync55(file, JSON.stringify(toWrite, null, 2));
           adopted.push({ file, index: arr.length - 1 });
         }
@@ -602247,32 +603441,32 @@ function writeCrontabLines(lines) {
 }
 function canonicalCronLine(rec) {
   const oaBin = findOaBinary4();
-  const logDir = join121(rec.workingDir, ".oa", "scheduled", "logs");
-  const logFile = join121(logDir, `${rec.id}.log`);
-  const storeFile = join121(rec.workingDir, ".oa", "scheduled", "tasks.json");
+  const logDir = join122(rec.workingDir, ".oa", "scheduled", "logs");
+  const logFile = join122(logDir, `${rec.id}.log`);
+  const storeFile = join122(rec.workingDir, ".oa", "scheduled", "tasks.json");
   const taskEsc = rec.task.replace(/'/g, "'\\''");
-  const lockDir = join121(rec.workingDir, ".oa", "run");
-  const lockPath = join121(lockDir, `${rec.id}.lock`);
+  const lockDir = join122(rec.workingDir, ".oa", "run");
+  const lockPath = join122(lockDir, `${rec.id}.lock`);
   const wrapper = [
     `cd ${JSON.stringify(rec.workingDir)}`,
     `mkdir -p ${JSON.stringify(logDir)}`,
     `mkdir -p ${JSON.stringify(lockDir)}`,
     `if mkdir ${JSON.stringify(lockPath)} 2>/dev/null; then`,
-    `  echo $$ > ${JSON.stringify(join121(lockPath, "pid"))}`,
+    `  echo $$ > ${JSON.stringify(join122(lockPath, "pid"))}`,
     `  trap 'rm -rf ${lockPath}' EXIT`,
     `else`,
-    `  if [ -f ${JSON.stringify(join121(lockPath, "pid"))} ]; then`,
-    `    oldpid=$(cat ${JSON.stringify(join121(lockPath, "pid"))} 2>/dev/null || echo)`,
+    `  if [ -f ${JSON.stringify(join122(lockPath, "pid"))} ]; then`,
+    `    oldpid=$(cat ${JSON.stringify(join122(lockPath, "pid"))} 2>/dev/null || echo)`,
     `    if [ -n "$oldpid" ] && kill -0 "$oldpid" 2>/dev/null; then`,
     `      echo "[oa-scheduler] ${rec.id} already running as PID $oldpid; skipping" >> ${JSON.stringify(logFile)}`,
     `      exit 0`,
     `    else`,
     `      rm -rf ${JSON.stringify(lockPath)} 2>/dev/null || true`,
-    `      mkdir -p ${JSON.stringify(lockPath)} && echo $$ > ${JSON.stringify(join121(lockPath, "pid"))} && trap 'rm -rf ${lockPath}' EXIT`,
+    `      mkdir -p ${JSON.stringify(lockPath)} && echo $$ > ${JSON.stringify(join122(lockPath, "pid"))} && trap 'rm -rf ${lockPath}' EXIT`,
     `    fi`,
     `  else`,
     `    rm -rf ${JSON.stringify(lockPath)} 2>/dev/null || true`,
-    `    mkdir -p ${JSON.stringify(lockPath)} && echo $$ > ${JSON.stringify(join121(lockPath, "pid"))} && trap 'rm -rf ${lockPath}' EXIT`,
+    `    mkdir -p ${JSON.stringify(lockPath)} && echo $$ > ${JSON.stringify(join122(lockPath, "pid"))} && trap 'rm -rf ${lockPath}' EXIT`,
     `  fi`,
     `fi`,
     `${oaBin} '${taskEsc}' >> ${JSON.stringify(logFile)} 2>&1; _oa_exit=$?`,
@@ -602304,9 +603498,9 @@ function fixupOrMigrateScheduled(mode, dryRun) {
       try {
         if (!f2.workingDir || !f2.task) continue;
         const unitBase = `oa-${f2.id}`;
-        const unitDir = join121(homedir42(), ".config", "systemd", "user");
-        const svc = join121(unitDir, `${unitBase}.service`);
-        const tim = join121(unitDir, `${unitBase}.timer`);
+        const unitDir = join122(homedir43(), ".config", "systemd", "user");
+        const svc = join122(unitDir, `${unitBase}.service`);
+        const tim = join122(unitDir, `${unitBase}.timer`);
         const oaBin = findOaBinary4();
         const rec = { id: f2.id, cron: f2.cron, workingDir: f2.workingDir, task: f2.task };
         const cmd = canonicalCronLine(rec).split(" ").slice(5).join(" ");
@@ -602432,8 +603626,8 @@ function startApiServer(options2 = {}) {
   const config = loadConfig();
   const ollamaUrl = options2.ollamaUrl ?? config.backendUrl;
   const cwd4 = process.cwd();
-  initAuditLog(join121(cwd4, ".oa"));
-  initUsageTracker(join121(cwd4, ".oa"));
+  initAuditLog(join122(cwd4, ".oa"));
+  initUsageTracker(join122(cwd4, ".oa"));
   try {
     const taskMgr = getSharedTaskManager();
     taskMgr.setEventPublisher((type, data, opts) => {
@@ -602484,7 +603678,7 @@ function startApiServer(options2 = {}) {
         if (!f2.endsWith(".json") || f2.includes(".tmp.")) continue;
         const sid = f2.replace(/\.json$/, "");
         try {
-          const items = JSON.parse(readFileSync85(join121(dir, f2), "utf-8"));
+          const items = JSON.parse(readFileSync86(join122(dir, f2), "utf-8"));
           if (Array.isArray(items)) {
             cache8.set(sid, new Map(items.map((t2) => [t2.id, t2])));
           }
@@ -602496,10 +603690,10 @@ function startApiServer(options2 = {}) {
     const watcher = fsWatch3(dir, (_evt, fname) => {
       if (!fname || !fname.endsWith(".json") || fname.includes(".tmp.")) return;
       const sid = fname.replace(/\.json$/, "");
-      const fp = join121(dir, fname);
+      const fp = join122(dir, fname);
       let next = [];
       try {
-        if (!existsSync105(fp)) {
+        if (!existsSync106(fp)) {
           const old = cache8.get(sid);
           if (old) {
             for (const t2 of old.values()) {
@@ -602512,7 +603706,7 @@ function startApiServer(options2 = {}) {
           }
           return;
         }
-        next = JSON.parse(readFileSync85(fp, "utf-8"));
+        next = JSON.parse(readFileSync86(fp, "utf-8"));
         if (!Array.isArray(next)) return;
       } catch {
         return;
@@ -602551,14 +603745,14 @@ function startApiServer(options2 = {}) {
   const retentionDays = parseInt(process.env["OA_JOB_RETENTION_DAYS"] ?? "30", 10);
   if (retentionDays > 0) {
     try {
-      const jobsDir3 = join121(cwd4, ".oa", "jobs");
-      if (existsSync105(jobsDir3)) {
+      const jobsDir3 = join122(cwd4, ".oa", "jobs");
+      if (existsSync106(jobsDir3)) {
         const cutoff = Date.now() - retentionDays * 864e5;
         for (const f2 of readdirSync36(jobsDir3)) {
           if (!f2.endsWith(".json")) continue;
           try {
-            const jobPath = join121(jobsDir3, f2);
-            const job = JSON.parse(readFileSync85(jobPath, "utf-8"));
+            const jobPath = join122(jobsDir3, f2);
+            const job = JSON.parse(readFileSync86(jobPath, "utf-8"));
             const jobTime = new Date(job.startedAt ?? job.completedAt ?? 0).getTime();
             if (jobTime > 0 && jobTime < cutoff && job.status !== "running") {
               const { unlinkSync: unlinkSync25 } = require3("node:fs");
@@ -602578,8 +603772,8 @@ function startApiServer(options2 = {}) {
   if (useTls) {
     try {
       tlsOpts = {
-        cert: readFileSync85(resolve38(tlsCert)),
-        key: readFileSync85(resolve38(tlsKey))
+        cert: readFileSync86(resolve38(tlsCert)),
+        key: readFileSync86(resolve38(tlsKey))
       };
     } catch (e2) {
       log22(`
@@ -602590,9 +603784,9 @@ function startApiServer(options2 = {}) {
   }
   let runtimeAccessMode = resolveAccessMode(process.env["OA_ACCESS"], host);
   try {
-    const accessFile = join121(homedir42(), ".open-agents", "access");
-    if (existsSync105(accessFile)) {
-      const persisted = readFileSync85(accessFile, "utf8").trim();
+    const accessFile = join122(homedir43(), ".open-agents", "access");
+    if (existsSync106(accessFile)) {
+      const persisted = readFileSync86(accessFile, "utf8").trim();
       const resolved = resolveAccessMode(persisted, host);
       if (resolved) runtimeAccessMode = resolved;
     }
@@ -602645,9 +603839,9 @@ function startApiServer(options2 = {}) {
             const previous = runtimeAccessMode;
             runtimeAccessMode = requested;
             try {
-              const dir = join121(homedir42(), ".open-agents");
+              const dir = join122(homedir43(), ".open-agents");
               mkdirSync63(dir, { recursive: true });
-              writeFileSync55(join121(dir, "access"), `${runtimeAccessMode}
+              writeFileSync55(join122(dir, "access"), `${runtimeAccessMode}
 `, "utf8");
             } catch {
             }
@@ -602860,9 +604054,9 @@ function startApiServer(options2 = {}) {
       try {
         const { startEmbeddingWorkers: startEmbeddingWorkers2 } = await Promise.resolve().then(() => (init_embedding_workers(), embedding_workers_exports));
         const { ensureEmbedDeps: ensureEmbedDeps2, runEmbedImage: runEmbedImage2, runEmbedAudio: runEmbedAudio2 } = await Promise.resolve().then(() => (init_py_embed(), py_embed_exports));
-        const dbBase = join121(cwd4, ".oa");
-        const epStore = new mem.EpisodeStore(join121(dbBase, "memory.db"));
-        const kg = new mem.TemporalGraph(join121(dbBase, "kg.db"));
+        const dbBase = join122(cwd4, ".oa");
+        const epStore = new mem.EpisodeStore(join122(dbBase, "memory.db"));
+        const kg = new mem.TemporalGraph(join122(dbBase, "kg.db"));
         try {
           ensureEmbedDeps2();
         } catch {
@@ -602939,6 +604133,34 @@ function startApiServer(options2 = {}) {
 `);
     log22(`  Primary: ${config.backendUrl} (${config.backendType || "ollama"})
 `);
+    try {
+      const { writeFileSync: writeFileSync59, mkdirSync: mkdirSync67, existsSync: _exists } = require3("node:fs");
+      const { join: _join } = require3("node:path");
+      const { homedir: _homedir } = require3("node:os");
+      const apiHint = JSON.stringify({
+        port,
+        host: host === "0.0.0.0" ? "127.0.0.1" : host,
+        scheme: proto,
+        pid: process.pid,
+        startedAt: (/* @__PURE__ */ new Date()).toISOString(),
+        version: version4
+      }, null, 2);
+      const candidates = [
+        _join(process.cwd(), ".oa", "nexus"),
+        _join(_homedir(), ".oa", "nexus"),
+        _join(_homedir(), ".open-agents", "nexus")
+      ];
+      for (const dir of candidates) {
+        try {
+          if (!_exists(dir)) mkdirSync67(dir, { recursive: true });
+          writeFileSync59(_join(dir, "api-port.json"), apiHint);
+        } catch {
+        }
+      }
+    } catch (e2) {
+      log22(`  WARN: api-port hint write failed: ${e2.message}
+`);
+    }
     try {
       adoptHandoffRuns();
     } catch (e2) {
@@ -603172,10 +604394,10 @@ async function handleMemoryIngest(req2, res, ollamaUrl) {
     const labels = Array.isArray(b.labels) ? b.labels : [];
     const mediaPath = typeof b.media_path === "string" ? b.media_path : void 0;
     const cwd4 = process.cwd();
-    const dbBase = join121(cwd4, ".oa");
+    const dbBase = join122(cwd4, ".oa");
     const { EpisodeStore: EpisodeStore3, TemporalGraph: TemporalGraph3 } = await Promise.resolve().then(() => (init_dist7(), dist_exports2));
-    const epStore = new EpisodeStore3(join121(dbBase, "memory.db"));
-    const kg = new TemporalGraph3(join121(dbBase, "kg.db"));
+    const epStore = new EpisodeStore3(join122(dbBase, "memory.db"));
+    const kg = new TemporalGraph3(join122(dbBase, "kg.db"));
     const meta = {};
     if (mediaPath) meta.media_path = mediaPath;
     const epId = epStore.insert({ modality, content: content || (mediaPath || ""), metadata: meta, toolName: "memory_ingest" });
@@ -603242,7 +604464,7 @@ async function handleEntitiesList(req2, res) {
     const type = url.searchParams.get("type") || "person";
     const limit = Math.max(1, Math.min(1e3, parseInt(url.searchParams.get("limit") || "100", 10)));
     const { TemporalGraph: TemporalGraph3 } = await Promise.resolve().then(() => (init_dist7(), dist_exports2));
-    const kg = new TemporalGraph3(join121(process.cwd(), ".oa", "kg.db"));
+    const kg = new TemporalGraph3(join122(process.cwd(), ".oa", "kg.db"));
     const nodes = kg.nodesByType(type, limit).map((n2) => ({ id: n2.id, text: n2.text, mentionCount: n2.mentionCount, firstSeen: n2.firstSeen, lastSeen: n2.lastSeen }));
     jsonResponse(res, 200, { object: "list", data: nodes });
   } catch (err) {
@@ -603264,7 +604486,7 @@ async function handleMemorySearch2(req2, res) {
     const wLex = typeof b.lexical_weight === "number" ? b.lexical_weight : 1;
     const wEmb = typeof b.embedding_weight === "number" ? b.embedding_weight : 1;
     const { EpisodeStore: EpisodeStore3 } = await Promise.resolve().then(() => (init_dist7(), dist_exports2));
-    const epStore = new EpisodeStore3(join121(process.cwd(), ".oa", "memory.db"));
+    const epStore = new EpisodeStore3(join122(process.cwd(), ".oa", "memory.db"));
     const results = epStore.search({ query, modality, limit }, { queryEmbedding: qEmb, lexicalWeight: wLex, embeddingWeight: wEmb });
     jsonResponse(res, 200, { object: "list", data: results.map((e2) => ({ id: e2.id, modality: e2.modality, content: e2.content, timestamp: e2.timestamp })) });
   } catch (err) {
@@ -603381,13 +604603,13 @@ var init_serve = __esm({
 
 // packages/cli/src/tui/interactive.ts
 import { cwd } from "node:process";
-import { resolve as resolve39, join as join122, dirname as dirname37, extname as extname12 } from "node:path";
+import { resolve as resolve39, join as join123, dirname as dirname37, extname as extname12 } from "node:path";
 import { createRequire as createRequire6 } from "node:module";
 import { fileURLToPath as fileURLToPath18 } from "node:url";
-import { readFileSync as readFileSync86, writeFileSync as writeFileSync56, appendFileSync as appendFileSync8, rmSync as rmSync5, readdirSync as readdirSync37, mkdirSync as mkdirSync64 } from "node:fs";
-import { existsSync as existsSync106 } from "node:fs";
+import { readFileSync as readFileSync87, writeFileSync as writeFileSync56, appendFileSync as appendFileSync8, rmSync as rmSync5, readdirSync as readdirSync37, mkdirSync as mkdirSync64 } from "node:fs";
+import { existsSync as existsSync107 } from "node:fs";
 import { execSync as execSync58 } from "node:child_process";
-import { homedir as homedir43 } from "node:os";
+import { homedir as homedir44 } from "node:os";
 function formatTimeAgo2(date) {
   const seconds = Math.floor((Date.now() - date.getTime()) / 1e3);
   if (seconds < 60) return "just now";
@@ -603403,12 +604625,12 @@ function getVersion4() {
     const require4 = createRequire6(import.meta.url);
     const thisDir = dirname37(fileURLToPath18(import.meta.url));
     const candidates = [
-      join122(thisDir, "..", "package.json"),
-      join122(thisDir, "..", "..", "package.json"),
-      join122(thisDir, "..", "..", "..", "package.json")
+      join123(thisDir, "..", "package.json"),
+      join123(thisDir, "..", "..", "package.json"),
+      join123(thisDir, "..", "..", "..", "package.json")
     ];
     for (const pkgPath of candidates) {
-      if (existsSync106(pkgPath)) {
+      if (existsSync107(pkgPath)) {
         const pkg = require4(pkgPath);
         if (pkg.name === "open-agents-ai" || pkg.name === "@open-agents/cli" || pkg.name === "@open-agents/monorepo") {
           return pkg.version ?? "0.0.0";
@@ -604214,14 +605436,14 @@ Meta-critique: quality ${meta.quality}/5, thorough: ${meta.thorough}`;
 function gatherMemorySnippets(root) {
   const snippets = [];
   const dirs = [
-    join122(root, ".oa", "memory"),
-    join122(root, ".open-agents", "memory")
+    join123(root, ".oa", "memory"),
+    join123(root, ".open-agents", "memory")
   ];
   for (const dir of dirs) {
-    if (!existsSync106(dir)) continue;
+    if (!existsSync107(dir)) continue;
     try {
       for (const f2 of readdirSync37(dir).filter((f3) => f3.endsWith(".json"))) {
-        const data = JSON.parse(readFileSync86(join122(dir, f2), "utf-8"));
+        const data = JSON.parse(readFileSync87(join123(dir, f2), "utf-8"));
         for (const val of Object.values(data)) {
           const v = typeof val === "object" && val !== null && "value" in val ? String(val.value) : String(val);
           if (v.length > 10) snippets.push(v);
@@ -604375,9 +605597,9 @@ ${metabolismMemories}
   } catch {
   }
   try {
-    const archeFile = join122(repoRoot, ".oa", "arche", "variants.json");
-    if (existsSync106(archeFile)) {
-      const variants = JSON.parse(readFileSync86(archeFile, "utf8"));
+    const archeFile = join123(repoRoot, ".oa", "arche", "variants.json");
+    if (existsSync107(archeFile)) {
+      const variants = JSON.parse(readFileSync87(archeFile, "utf8"));
       if (variants.length > 0) {
         let filtered = variants;
         if (taskType) {
@@ -604549,9 +605771,9 @@ RULES:
   const compactionThreshold = Number.isFinite(envOverride) && envOverride > 0 ? envOverride : modelTier === "small" ? 12e3 : modelTier === "medium" ? 24e3 : 4e4;
   let identityInjection = "";
   try {
-    const ikStateFile = join122(repoRoot, ".oa", "identity", "self-state.json");
-    if (existsSync106(ikStateFile)) {
-      const selfState = JSON.parse(readFileSync86(ikStateFile, "utf8"));
+    const ikStateFile = join123(repoRoot, ".oa", "identity", "self-state.json");
+    if (existsSync107(ikStateFile)) {
+      const selfState = JSON.parse(readFileSync87(ikStateFile, "utf8"));
       const lines = [
         `[Identity State v${selfState.version}]`,
         `Self: ${selfState.narrative_summary}`,
@@ -605413,11 +606635,11 @@ When done, either call task_complete with your answer, or use FINAL_VAR(variable
           });
         }
         try {
-          const ikDir = join122(repoRoot, ".oa", "identity");
-          const ikFile = join122(ikDir, "self-state.json");
+          const ikDir = join123(repoRoot, ".oa", "identity");
+          const ikFile = join123(ikDir, "self-state.json");
           let ikState;
-          if (existsSync106(ikFile)) {
-            ikState = JSON.parse(readFileSync86(ikFile, "utf8"));
+          if (existsSync107(ikFile)) {
+            ikState = JSON.parse(readFileSync87(ikFile, "utf8"));
           } else {
             mkdirSync64(ikDir, { recursive: true });
             const machineId = Date.now().toString(36) + Math.random().toString(36).slice(2, 8);
@@ -605494,9 +606716,9 @@ When done, either call task_complete with your answer, or use FINAL_VAR(variable
       } else {
         renderTaskIncomplete(result.turns, result.toolCalls, result.durationMs, tokens);
         try {
-          const ikFile = join122(repoRoot, ".oa", "identity", "self-state.json");
-          if (existsSync106(ikFile)) {
-            const ikState = JSON.parse(readFileSync86(ikFile, "utf8"));
+          const ikFile = join123(repoRoot, ".oa", "identity", "self-state.json");
+          if (existsSync107(ikFile)) {
+            const ikState = JSON.parse(readFileSync87(ikFile, "utf8"));
             if (!ikState.stats) ikState.stats = { queries_served: 0 };
             ikState.stats.queries_served = (ikState.stats.queries_served || 0) + 1;
             ikState.homeostasis.uncertainty = Math.min(1, ikState.homeostasis.uncertainty + 0.03);
@@ -605752,10 +606974,10 @@ async function startInteractive(config, repoPath) {
     process.stdin.pause();
   }
   try {
-    const oaDir = join122(repoRoot, ".oa");
-    const nexusPidFile = join122(oaDir, "nexus", "daemon.pid");
-    if (existsSync106(nexusPidFile)) {
-      const pid = parseInt(readFileSync86(nexusPidFile, "utf8").trim(), 10);
+    const oaDir = join123(repoRoot, ".oa");
+    const nexusPidFile = join123(oaDir, "nexus", "daemon.pid");
+    if (existsSync107(nexusPidFile)) {
+      const pid = parseInt(readFileSync87(nexusPidFile, "utf8").trim(), 10);
       if (pid > 0) {
         try {
           process.kill(pid, 0);
@@ -606415,7 +607637,7 @@ ${result.summary}`
   let p2pGateway = null;
   let peerMesh = null;
   let inferenceRouter = null;
-  const secretVault = new SecretVault(join122(repoRoot, ".oa", "vault.enc"));
+  const secretVault = new SecretVault(join123(repoRoot, ".oa", "vault.enc"));
   let adminSessionKey = null;
   const callSubAgents = /* @__PURE__ */ new Map();
   const streamRenderer = new StreamRenderer();
@@ -606646,13 +607868,13 @@ Rationale: ${proposal.rationale}${provenanceNote}`;
     const hits = allCompletions.filter((c9) => c9.toLowerCase().startsWith(lower));
     return [hits, line];
   }
-  const HISTORY_DIR = join122(homedir43(), ".open-agents");
-  const HISTORY_FILE = join122(HISTORY_DIR, "repl-history");
+  const HISTORY_DIR = join123(homedir44(), ".open-agents");
+  const HISTORY_FILE = join123(HISTORY_DIR, "repl-history");
   const MAX_HISTORY_LINES = 500;
   let savedHistory = [];
   try {
-    if (existsSync106(HISTORY_FILE)) {
-      const raw = readFileSync86(HISTORY_FILE, "utf8").trim();
+    if (existsSync107(HISTORY_FILE)) {
+      const raw = readFileSync87(HISTORY_FILE, "utf8").trim();
       if (raw) savedHistory = raw.split("\n").reverse();
     }
   } catch {
@@ -606802,7 +608024,7 @@ Rationale: ${proposal.rationale}${provenanceNote}`;
       mkdirSync64(HISTORY_DIR, { recursive: true });
       appendFileSync8(HISTORY_FILE, line + "\n", "utf8");
       if (Math.random() < 0.02) {
-        const all2 = readFileSync86(HISTORY_FILE, "utf8").trim().split("\n");
+        const all2 = readFileSync87(HISTORY_FILE, "utf8").trim().split("\n");
         if (all2.length > MAX_HISTORY_LINES) {
           writeFileSync56(HISTORY_FILE, all2.slice(-MAX_HISTORY_LINES).join("\n") + "\n", "utf8");
         }
@@ -606989,10 +608211,10 @@ Rationale: ${proposal.rationale}${provenanceNote}`;
       const { unlinkSync: _rmStale } = await import("node:fs");
       const { homedir: _hdir } = await import("node:os");
       for (const dp of [
-        join122(repoRoot, ".oa", "nexus", "nexus-daemon.mjs"),
-        join122(_hdir(), ".open-agents", ".oa", "nexus", "nexus-daemon.mjs")
+        join123(repoRoot, ".oa", "nexus", "nexus-daemon.mjs"),
+        join123(_hdir(), ".open-agents", ".oa", "nexus", "nexus-daemon.mjs")
       ]) {
-        if (existsSync106(dp)) try {
+        if (existsSync107(dp)) try {
           _rmStale(dp);
         } catch {
         }
@@ -607003,9 +608225,9 @@ Rationale: ${proposal.rationale}${provenanceNote}`;
       const autoNexus = new NexusTool(repoRoot);
       const _registerNexusDaemon = () => {
         try {
-          const nexusPidFile = join122(repoRoot, ".oa", "nexus", "daemon.pid");
-          if (existsSync106(nexusPidFile)) {
-            const nPid = parseInt(readFileSync86(nexusPidFile, "utf8").trim(), 10);
+          const nexusPidFile = join123(repoRoot, ".oa", "nexus", "daemon.pid");
+          if (existsSync107(nexusPidFile)) {
+            const nPid = parseInt(readFileSync87(nexusPidFile, "utf8").trim(), 10);
             if (nPid > 0 && !registry2.daemons.has("Nexus")) {
               registry2.register({ name: "Nexus", pid: nPid, startedAt: Date.now(), status: "running" });
               statusBar.ensureMonitorTimer();
@@ -607062,7 +608284,7 @@ Rationale: ${proposal.rationale}${provenanceNote}`;
     } catch {
     }
     try {
-      const oaDir = join122(repoRoot, ".oa");
+      const oaDir = join123(repoRoot, ".oa");
       const reconnected = await ExposeGateway.checkAndReconnect(oaDir, {
         onInfo: (msg) => writeContent(() => renderInfo2(msg)),
         onError: (msg) => writeContent(() => renderWarning2(msg))
@@ -607094,7 +608316,7 @@ Rationale: ${proposal.rationale}${provenanceNote}`;
     } catch {
     }
     try {
-      const oaDir = join122(repoRoot, ".oa");
+      const oaDir = join123(repoRoot, ".oa");
       const reconnectedP2P = await ExposeP2PGateway.checkAndReconnect(oaDir, new NexusTool(repoRoot), {
         onInfo: (msg) => writeContent(() => renderInfo2(msg)),
         onError: (msg) => writeContent(() => renderWarning2(msg))
@@ -607135,10 +608357,10 @@ Rationale: ${proposal.rationale}${provenanceNote}`;
     }
     try {
       const { homedir: _hd, hostname: _hn, userInfo: _ui } = await import("node:os");
-      const globalNamePath = join122(_hd(), ".open-agents", "agent-name");
+      const globalNamePath = join123(_hd(), ".open-agents", "agent-name");
       let agName = "";
       try {
-        if (existsSync106(globalNamePath)) agName = readFileSync86(globalNamePath, "utf8").trim();
+        if (existsSync107(globalNamePath)) agName = readFileSync87(globalNamePath, "utf8").trim();
       } catch {
       }
       if (!agName) {
@@ -607167,11 +608389,11 @@ Rationale: ${proposal.rationale}${provenanceNote}`;
         }
         if (!ollamaAlive) {
           try {
-            const savedSponsorsPath = join122(repoRoot, ".oa", "sponsor", "known-sponsors.json");
+            const savedSponsorsPath = join123(repoRoot, ".oa", "sponsor", "known-sponsors.json");
             let savedSponsors = [];
             try {
-              if (existsSync106(savedSponsorsPath)) {
-                savedSponsors = JSON.parse(readFileSync86(savedSponsorsPath, "utf8"));
+              if (existsSync107(savedSponsorsPath)) {
+                savedSponsors = JSON.parse(readFileSync87(savedSponsorsPath, "utf8"));
                 const oneHourAgo = Date.now() - 36e5;
                 savedSponsors = savedSponsors.filter((s2) => (s2.lastVerified || 0) > oneHourAgo);
               }
@@ -608263,10 +609485,10 @@ Respond concisely and safely. Remember: you are talking to the general public.`;
               if (name10 === "voice_list_files") {
                 const baseDir = String(args?.dir ?? ".");
                 const { readdirSync: readdirSync39, statSync: statSync36 } = __require("node:fs");
-                const { join: join127, resolve: resolve43 } = __require("node:path");
-                const base3 = baseDir.startsWith("/") ? baseDir : resolve43(join127(repoRoot, baseDir));
+                const { join: join128, resolve: resolve43 } = __require("node:path");
+                const base3 = baseDir.startsWith("/") ? baseDir : resolve43(join128(repoRoot, baseDir));
                 const items = readdirSync39(base3).slice(0, 200).map((f2) => {
-                  const s2 = statSync36(join127(base3, f2));
+                  const s2 = statSync36(join128(base3, f2));
                   return { name: f2, dir: s2.isDirectory(), size: s2.size };
                 });
                 return JSON.stringify({ dir: base3, items }, null, 2);
@@ -608354,7 +609576,7 @@ Respond concisely and safely. Remember: you are talking to the general public.`;
           kind,
           targetUrl,
           authKey,
-          stateDir: join122(repoRoot, ".oa"),
+          stateDir: join123(repoRoot, ".oa"),
           passthrough: passthrough ?? false,
           loadbalance: loadbalance ?? false,
           endpointAuth: passthrough ? currentConfig.apiKey : void 0,
@@ -608400,7 +609622,7 @@ Respond concisely and safely. Remember: you are talking to the general public.`;
         await tunnelGateway.stop();
         tunnelGateway = null;
       }
-      const newTunnel = new ExposeGateway({ kind, targetUrl, authKey, fullAccess, stateDir: join122(repoRoot, ".oa") });
+      const newTunnel = new ExposeGateway({ kind, targetUrl, authKey, fullAccess, stateDir: join123(repoRoot, ".oa") });
       newTunnel.on("stats", (stats) => {
         statusBar.setExposeStatus({
           status: stats.status,
@@ -608487,9 +609709,9 @@ Respond concisely and safely. Remember: you are talking to the general public.`;
       });
       if (!result.success) throw new Error(result.error || "Connect failed");
       try {
-        const nexusPidFile = join122(repoRoot, ".oa", "nexus", "daemon.pid");
-        if (existsSync106(nexusPidFile)) {
-          const pid = parseInt(readFileSync86(nexusPidFile, "utf8").trim(), 10);
+        const nexusPidFile = join123(repoRoot, ".oa", "nexus", "daemon.pid");
+        if (existsSync107(nexusPidFile)) {
+          const pid = parseInt(readFileSync87(nexusPidFile, "utf8").trim(), 10);
           if (pid > 0) {
             registry2.register({
               name: "Nexus",
@@ -608677,10 +609899,10 @@ Respond concisely and safely. Remember: you are talking to the general public.`;
         writeContent(() => renderInfo2(`Killed ${bgKilled} background task(s).`));
       }
       try {
-        const nexusDir = join122(repoRoot, OA_DIR, "nexus");
-        const pidFile = join122(nexusDir, "daemon.pid");
-        if (existsSync106(pidFile)) {
-          const pid = parseInt(readFileSync86(pidFile, "utf8").trim(), 10);
+        const nexusDir = join123(repoRoot, OA_DIR, "nexus");
+        const pidFile = join123(nexusDir, "daemon.pid");
+        if (existsSync107(pidFile)) {
+          const pid = parseInt(readFileSync87(pidFile, "utf8").trim(), 10);
           if (pid > 0) {
             try {
               if (process.platform === "win32") {
@@ -608702,13 +609924,13 @@ Respond concisely and safely. Remember: you are talking to the general public.`;
       } catch {
       }
       try {
-        const voiceDir2 = join122(homedir43(), ".open-agents", "voice");
+        const voiceDir2 = join123(homedir44(), ".open-agents", "voice");
         const voicePidFiles = ["luxtts-daemon.pid", "piper-daemon.pid"];
         for (const pf of voicePidFiles) {
-          const pidPath = join122(voiceDir2, pf);
-          if (existsSync106(pidPath)) {
+          const pidPath = join123(voiceDir2, pf);
+          if (existsSync107(pidPath)) {
             try {
-              const pid = parseInt(readFileSync86(pidPath, "utf8").trim(), 10);
+              const pid = parseInt(readFileSync87(pidPath, "utf8").trim(), 10);
               if (pid > 0) {
                 if (process.platform === "win32") {
                   try {
@@ -608732,8 +609954,8 @@ Respond concisely and safely. Remember: you are talking to the general public.`;
         execSync58(process.platform === "win32" ? "timeout /t 1 /nobreak >nul" : "sleep 0.5", { timeout: 3e3, stdio: "ignore" });
       } catch {
       }
-      const oaPath = join122(repoRoot, OA_DIR);
-      if (existsSync106(oaPath)) {
+      const oaPath = join123(repoRoot, OA_DIR);
+      if (existsSync107(oaPath)) {
         let deleted = false;
         for (let attempt = 0; attempt < 3; attempt++) {
           try {
@@ -608817,19 +610039,19 @@ Respond concisely and safely. Remember: you are talking to the general public.`;
   try {
     const { isPersonaPlexRunning: isPersonaPlexRunning2 } = await Promise.resolve().then(() => (init_personaplex(), personaplex_exports));
     if (isPersonaPlexRunning2()) {
-      const ppPidFile = join122(homedir43(), ".open-agents", "voice", "personaplex", "daemon.pid");
-      const ppPortFile = join122(homedir43(), ".open-agents", "voice", "personaplex", "daemon.port");
-      if (existsSync106(ppPidFile)) {
-        const ppPid = parseInt(readFileSync86(ppPidFile, "utf8").trim(), 10);
-        const ppPort = existsSync106(ppPortFile) ? parseInt(readFileSync86(ppPortFile, "utf8").trim(), 10) : void 0;
+      const ppPidFile = join123(homedir44(), ".open-agents", "voice", "personaplex", "daemon.pid");
+      const ppPortFile = join123(homedir44(), ".open-agents", "voice", "personaplex", "daemon.port");
+      if (existsSync107(ppPidFile)) {
+        const ppPid = parseInt(readFileSync87(ppPidFile, "utf8").trim(), 10);
+        const ppPort = existsSync107(ppPortFile) ? parseInt(readFileSync87(ppPortFile, "utf8").trim(), 10) : void 0;
         if (ppPid > 0 && !registry2.daemons.has("PersonaPlex")) {
           registry2.register({ name: "PersonaPlex", pid: ppPid, port: ppPort, startedAt: Date.now(), status: "running" });
         }
       }
     }
-    const nexusPidFile = join122(repoRoot, ".oa", "nexus", "daemon.pid");
-    if (existsSync106(nexusPidFile)) {
-      const nPid = parseInt(readFileSync86(nexusPidFile, "utf8").trim(), 10);
+    const nexusPidFile = join123(repoRoot, ".oa", "nexus", "daemon.pid");
+    if (existsSync107(nexusPidFile)) {
+      const nPid = parseInt(readFileSync87(nexusPidFile, "utf8").trim(), 10);
       if (nPid > 0 && !registry2.daemons.has("Nexus")) {
         try {
           process.kill(nPid, 0);
@@ -609196,9 +610418,9 @@ Execute this skill now. Follow the behavioral guidance above.`;
       }
     }
     const cleanPath = input.replace(/^['"]|['"]$/g, "").trim();
-    const isImage = isImagePath(cleanPath) && existsSync106(resolve39(repoRoot, cleanPath));
-    const isMedia = !isImage && isTranscribablePath(cleanPath) && existsSync106(resolve39(repoRoot, cleanPath));
-    const isMarkdown = !isImage && !isMedia && /\.(md|markdown)$/i.test(cleanPath) && existsSync106(resolve39(repoRoot, cleanPath));
+    const isImage = isImagePath(cleanPath) && existsSync107(resolve39(repoRoot, cleanPath));
+    const isMedia = !isImage && isTranscribablePath(cleanPath) && existsSync107(resolve39(repoRoot, cleanPath));
+    const isMarkdown = !isImage && !isMedia && /\.(md|markdown)$/i.test(cleanPath) && existsSync107(resolve39(repoRoot, cleanPath));
     if (activeTask) {
       if (activeTask.runner.isPaused) {
         activeTask.runner.resume();
@@ -609207,7 +610429,7 @@ Execute this skill now. Follow the behavioral guidance above.`;
       if (isImage) {
         try {
           const imgPath = resolve39(repoRoot, cleanPath);
-          const imgBuffer = readFileSync86(imgPath);
+          const imgBuffer = readFileSync87(imgPath);
           const base642 = imgBuffer.toString("base64");
           const ext = extname12(cleanPath).toLowerCase();
           const mime = ext === ".png" ? "image/png" : ext === ".gif" ? "image/gif" : ext === ".webp" ? "image/webp" : "image/jpeg";
@@ -609363,7 +610585,7 @@ ${result.text}`;
     if (isMarkdown && fullInput === input) {
       try {
         const mdPath = resolve39(repoRoot, cleanPath);
-        const mdContent = readFileSync86(mdPath, "utf8");
+        const mdContent = readFileSync87(mdPath, "utf8");
         const { parseMcpMarkdown: parseMcpMarkdown2 } = await Promise.resolve().then(() => (init_dist5(), dist_exports));
         const result = parseMcpMarkdown2(mdContent);
         if (result.servers.length > 0) {
@@ -609785,11 +611007,11 @@ async function runWithTUI(task, config, repoPath, callbacks) {
     const handle2 = startTask(task, config, repoRoot);
     await handle2.promise;
     try {
-      const ikDir = join122(repoRoot, ".oa", "identity");
-      const ikFile = join122(ikDir, "self-state.json");
+      const ikDir = join123(repoRoot, ".oa", "identity");
+      const ikFile = join123(ikDir, "self-state.json");
       let ikState;
-      if (existsSync106(ikFile)) {
-        ikState = JSON.parse(readFileSync86(ikFile, "utf8"));
+      if (existsSync107(ikFile)) {
+        ikState = JSON.parse(readFileSync87(ikFile, "utf8"));
       } else {
         mkdirSync64(ikDir, { recursive: true });
         ikState = {
@@ -609826,11 +611048,11 @@ async function runWithTUI(task, config, repoPath, callbacks) {
       );
     } catch {
       try {
-        const archeDir = join122(repoRoot, ".oa", "arche");
-        const archeFile = join122(archeDir, "variants.json");
+        const archeDir = join123(repoRoot, ".oa", "arche");
+        const archeFile = join123(archeDir, "variants.json");
         let variants = [];
         try {
-          if (existsSync106(archeFile)) variants = JSON.parse(readFileSync86(archeFile, "utf8"));
+          if (existsSync107(archeFile)) variants = JSON.parse(readFileSync87(archeFile, "utf8"));
         } catch {
         }
         variants.push({
@@ -609850,9 +611072,9 @@ async function runWithTUI(task, config, repoPath, callbacks) {
       }
     }
     try {
-      const metaFile = join122(repoRoot, ".oa", "memory", "metabolism", "store.json");
-      if (existsSync106(metaFile)) {
-        const store2 = JSON.parse(readFileSync86(metaFile, "utf8"));
+      const metaFile = join123(repoRoot, ".oa", "memory", "metabolism", "store.json");
+      if (existsSync107(metaFile)) {
+        const store2 = JSON.parse(readFileSync87(metaFile, "utf8"));
         const surfaced = store2.filter((m2) => m2.type !== "quarantine" && m2.scores?.confidence > 0.15).sort((a2, b) => b.scores.utility * b.scores.confidence - a2.scores.utility * a2.scores.confidence).slice(0, 5);
         let updated = false;
         for (const item of surfaced) {
@@ -609916,9 +611138,9 @@ Rules:
           try {
             const { initDb: initDb2 } = __require("@open-agents/memory");
             const { ProceduralMemoryStore: ProceduralMemoryStore2 } = __require("@open-agents/memory");
-            const dbDir = join122(repoRoot, ".oa", "memory");
+            const dbDir = join123(repoRoot, ".oa", "memory");
             mkdirSync64(dbDir, { recursive: true });
-            const db = initDb2(join122(dbDir, "structured.db"));
+            const db = initDb2(join123(dbDir, "structured.db"));
             const memStore = new ProceduralMemoryStore2(db);
             memStore.createWithEmbedding({
               content: content.slice(0, 600),
@@ -609933,11 +611155,11 @@ Rules:
             db.close();
           } catch {
           }
-          const metaDir = join122(repoRoot, ".oa", "memory", "metabolism");
-          const storeFile = join122(metaDir, "store.json");
+          const metaDir = join123(repoRoot, ".oa", "memory", "metabolism");
+          const storeFile = join123(metaDir, "store.json");
           let store2 = [];
           try {
-            if (existsSync106(storeFile)) store2 = JSON.parse(readFileSync86(storeFile, "utf8"));
+            if (existsSync107(storeFile)) store2 = JSON.parse(readFileSync87(storeFile, "utf8"));
           } catch {
           }
           store2.push({
@@ -609959,19 +611181,19 @@ Rules:
     } catch {
     }
     try {
-      const cohereSettingsFile = join122(repoRoot, ".oa", "settings.json");
+      const cohereSettingsFile = join123(repoRoot, ".oa", "settings.json");
       let cohereActive = false;
       try {
-        if (existsSync106(cohereSettingsFile)) {
-          const settings = JSON.parse(readFileSync86(cohereSettingsFile, "utf8"));
+        if (existsSync107(cohereSettingsFile)) {
+          const settings = JSON.parse(readFileSync87(cohereSettingsFile, "utf8"));
           cohereActive = settings.cohere === true;
         }
       } catch {
       }
       if (cohereActive) {
-        const metaFile = join122(repoRoot, ".oa", "memory", "metabolism", "store.json");
-        if (existsSync106(metaFile)) {
-          const store2 = JSON.parse(readFileSync86(metaFile, "utf8"));
+        const metaFile = join123(repoRoot, ".oa", "memory", "metabolism", "store.json");
+        if (existsSync107(metaFile)) {
+          const store2 = JSON.parse(readFileSync87(metaFile, "utf8"));
           const latest = store2.filter((m2) => m2.sourceTrace === "trajectory-extraction" || m2.sourceTrace === "llm-trajectory-extraction").slice(-1)[0];
           if (latest && latest.scores?.confidence >= 0.6) {
             try {
@@ -609996,18 +611218,18 @@ Rules:
     }
   } catch (err) {
     try {
-      const ikFile = join122(repoRoot, ".oa", "identity", "self-state.json");
-      if (existsSync106(ikFile)) {
-        const ikState = JSON.parse(readFileSync86(ikFile, "utf8"));
+      const ikFile = join123(repoRoot, ".oa", "identity", "self-state.json");
+      if (existsSync107(ikFile)) {
+        const ikState = JSON.parse(readFileSync87(ikFile, "utf8"));
         ikState.homeostasis.uncertainty = Math.min(1, ikState.homeostasis.uncertainty + 0.1);
         ikState.homeostasis.coherence = Math.max(0, ikState.homeostasis.coherence - 0.05);
         ikState.session_count = (ikState.session_count || 0) + 1;
         ikState.updated_at = (/* @__PURE__ */ new Date()).toISOString();
         writeFileSync56(ikFile, JSON.stringify(ikState, null, 2));
       }
-      const metaFile = join122(repoRoot, ".oa", "memory", "metabolism", "store.json");
-      if (existsSync106(metaFile)) {
-        const store2 = JSON.parse(readFileSync86(metaFile, "utf8"));
+      const metaFile = join123(repoRoot, ".oa", "memory", "metabolism", "store.json");
+      if (existsSync107(metaFile)) {
+        const store2 = JSON.parse(readFileSync87(metaFile, "utf8"));
         const surfaced = store2.filter((m2) => m2.type !== "quarantine" && m2.scores?.confidence > 0.15).sort((a2, b) => b.scores.utility * b.scores.confidence - a2.scores.utility * a2.scores.confidence).slice(0, 5);
         for (const item of surfaced) {
           item.accessCount = (item.accessCount || 0) + 1;
@@ -610018,11 +611240,11 @@ Rules:
         writeFileSync56(metaFile, JSON.stringify(store2, null, 2));
       }
       try {
-        const archeDir = join122(repoRoot, ".oa", "arche");
-        const archeFile = join122(archeDir, "variants.json");
+        const archeDir = join123(repoRoot, ".oa", "arche");
+        const archeFile = join123(archeDir, "variants.json");
         let variants = [];
         try {
-          if (existsSync106(archeFile)) variants = JSON.parse(readFileSync86(archeFile, "utf8"));
+          if (existsSync107(archeFile)) variants = JSON.parse(readFileSync87(archeFile, "utf8"));
         } catch {
         }
         variants.push({
@@ -610126,12 +611348,12 @@ __export(run_exports, {
 });
 import { resolve as resolve40 } from "node:path";
 import { spawn as spawn26 } from "node:child_process";
-import { mkdirSync as mkdirSync65, writeFileSync as writeFileSync57, readFileSync as readFileSync87, readdirSync as readdirSync38, existsSync as existsSync107 } from "node:fs";
+import { mkdirSync as mkdirSync65, writeFileSync as writeFileSync57, readFileSync as readFileSync88, readdirSync as readdirSync38, existsSync as existsSync108 } from "node:fs";
 import { randomBytes as randomBytes24 } from "node:crypto";
-import { join as join123 } from "node:path";
+import { join as join124 } from "node:path";
 function jobsDir2(repoPath) {
   const root = resolve40(repoPath ?? process.cwd());
-  const dir = join123(root, ".oa", "jobs");
+  const dir = join124(root, ".oa", "jobs");
   mkdirSync65(dir, { recursive: true });
   return dir;
 }
@@ -610254,7 +611476,7 @@ async function runBackground(task, config, opts) {
     }
   });
   job.pid = child.pid ?? 0;
-  writeFileSync57(join123(dir, `${id}.json`), JSON.stringify(job, null, 2));
+  writeFileSync57(join124(dir, `${id}.json`), JSON.stringify(job, null, 2));
   let output = "";
   child.stdout?.on("data", (chunk) => {
     output += chunk.toString();
@@ -610270,7 +611492,7 @@ async function runBackground(task, config, opts) {
       job.summary = result.summary;
       job.durationMs = result.durationMs;
       job.error = result.error;
-      writeFileSync57(join123(dir, `${id}.json`), JSON.stringify(job, null, 2));
+      writeFileSync57(join124(dir, `${id}.json`), JSON.stringify(job, null, 2));
     } catch {
     }
   });
@@ -610286,13 +611508,13 @@ async function runBackground(task, config, opts) {
 }
 function statusCommand(jobId, repoPath) {
   const dir = jobsDir2(repoPath);
-  const file = join123(dir, `${jobId}.json`);
-  if (!existsSync107(file)) {
+  const file = join124(dir, `${jobId}.json`);
+  if (!existsSync108(file)) {
     console.error(`Job not found: ${jobId}`);
     console.log(`Available jobs: oa jobs`);
     process.exit(1);
   }
-  const job = JSON.parse(readFileSync87(file, "utf-8"));
+  const job = JSON.parse(readFileSync88(file, "utf-8"));
   const runtime = job.completedAt ? `${((new Date(job.completedAt).getTime() - new Date(job.startedAt).getTime()) / 1e3).toFixed(0)}s` : `${((Date.now() - new Date(job.startedAt).getTime()) / 1e3).toFixed(0)}s`;
   const icon = job.status === "completed" ? "✓" : job.status === "failed" ? "✗" : "●";
   console.log(`${icon} ${job.id} [${job.status}] ${runtime}`);
@@ -610313,7 +611535,7 @@ function jobsCommand(repoPath) {
   console.log("Jobs:");
   for (const file of files) {
     try {
-      const job = JSON.parse(readFileSync87(join123(dir, file), "utf-8"));
+      const job = JSON.parse(readFileSync88(join124(dir, file), "utf-8"));
       const icon = job.status === "completed" ? "✓" : job.status === "failed" ? "✗" : "●";
       const runtime = job.completedAt ? `${((new Date(job.completedAt).getTime() - new Date(job.startedAt).getTime()) / 1e3).toFixed(0)}s` : `${((Date.now() - new Date(job.startedAt).getTime()) / 1e3).toFixed(0)}s`;
       const cleanListTask = cleanForStorage(job.task) || job.task;
@@ -610337,13 +611559,13 @@ __export(index_repo_exports, {
   indexRepoCommand: () => indexRepoCommand
 });
 import { resolve as resolve41 } from "node:path";
-import { existsSync as existsSync108, statSync as statSync35 } from "node:fs";
+import { existsSync as existsSync109, statSync as statSync35 } from "node:fs";
 import { cwd as cwd2 } from "node:process";
 async function indexRepoCommand(opts, _config3) {
   const repoRoot = resolve41(opts.repoPath ?? cwd2());
   printHeader("Index Repository");
   printInfo(`Indexing: ${repoRoot}`);
-  if (!existsSync108(repoRoot)) {
+  if (!existsSync109(repoRoot)) {
     printError(`Path does not exist: ${repoRoot}`);
     process.exit(1);
   }
@@ -610595,8 +611817,8 @@ var config_exports2 = {};
 __export(config_exports2, {
   configCommand: () => configCommand
 });
-import { join as join124, resolve as resolve42 } from "node:path";
-import { homedir as homedir44 } from "node:os";
+import { join as join125, resolve as resolve42 } from "node:path";
+import { homedir as homedir45 } from "node:os";
 import { cwd as cwd3 } from "node:process";
 function redactIfSensitive(key, value2) {
   if (SENSITIVE_KEYS.has(key) && typeof value2 === "string" && value2.length > 0) {
@@ -610677,7 +611899,7 @@ function handleShow(opts, config) {
     }
   }
   printSection("Config File");
-  printInfo(`~/.open-agents/config.json (${join124(homedir44(), ".open-agents", "config.json")})`);
+  printInfo(`~/.open-agents/config.json (${join125(homedir45(), ".open-agents", "config.json")})`);
   printSection("Priority Chain");
   printInfo("  1. CLI flags (--model, --backend-url, etc.)");
   printInfo("  2. Project .oa/settings.json (--local)");
@@ -610716,7 +611938,7 @@ function handleSet(opts, _config3) {
       const coerced = coerceForSettings(key, value2);
       saveProjectSettings(repoRoot, { [key]: coerced });
       printSuccess(`Project override set: ${key} = ${redactIfSensitive(key, value2)}`);
-      printInfo(`Saved to ${join124(repoRoot, ".oa", "settings.json")}`);
+      printInfo(`Saved to ${join125(repoRoot, ".oa", "settings.json")}`);
       printInfo("This override applies only when running in this workspace.");
     } catch (err) {
       printError(`Failed to save: ${err instanceof Error ? err.message : String(err)}`);
@@ -610901,7 +612123,7 @@ __export(eval_exports, {
 });
 import { tmpdir as tmpdir21 } from "node:os";
 import { mkdirSync as mkdirSync66, writeFileSync as writeFileSync58 } from "node:fs";
-import { join as join125 } from "node:path";
+import { join as join126 } from "node:path";
 async function evalCommand(opts, config) {
   const suiteName = opts.suite ?? "basic";
   const suite = SUITES[suiteName];
@@ -611030,10 +612252,10 @@ async function evalCommand(opts, config) {
   process.exit(failed > 0 ? 1 : 0);
 }
 function createTempEvalRepo() {
-  const dir = join125(tmpdir21(), `open-agents-eval-${Date.now()}`);
+  const dir = join126(tmpdir21(), `open-agents-eval-${Date.now()}`);
   mkdirSync66(dir, { recursive: true });
   writeFileSync58(
-    join125(dir, "package.json"),
+    join126(dir, "package.json"),
     JSON.stringify({ name: "eval-repo", version: "0.0.0" }, null, 2) + "\n",
     "utf8"
   );
@@ -611097,7 +612319,7 @@ init_typed_node_events();
 import { parseArgs as nodeParseArgs2 } from "node:util";
 import { createRequire as createRequire7 } from "node:module";
 import { fileURLToPath as fileURLToPath19 } from "node:url";
-import { dirname as dirname38, join as join126 } from "node:path";
+import { dirname as dirname38, join as join127 } from "node:path";
 
 // packages/cli/src/cli.ts
 init_typed_node_events();
@@ -611237,7 +612459,7 @@ init_output();
 function getVersion5() {
   try {
     const require4 = createRequire7(import.meta.url);
-    const pkgPath = join126(dirname38(fileURLToPath19(import.meta.url)), "..", "package.json");
+    const pkgPath = join127(dirname38(fileURLToPath19(import.meta.url)), "..", "package.json");
     const pkg = require4(pkgPath);
     return pkg.version;
   } catch {
@@ -611552,11 +612774,11 @@ function crashLog(label, err) {
 `;
   try {
     const { appendFileSync: appendFileSync9, mkdirSync: mkdirSync67 } = __require("node:fs");
-    const { join: join127 } = __require("node:path");
-    const { homedir: homedir45 } = __require("node:os");
-    const logDir = join127(homedir45(), ".open-agents");
+    const { join: join128 } = __require("node:path");
+    const { homedir: homedir46 } = __require("node:os");
+    const logDir = join128(homedir46(), ".open-agents");
     mkdirSync67(logDir, { recursive: true });
-    appendFileSync9(join127(logDir, "crash.log"), logLine);
+    appendFileSync9(join128(logDir, "crash.log"), logLine);
   } catch {
   }
   try {