open-agents-ai 0.187.535 → 0.187.537

package/dist/index.js

@@ -9457,6 +9457,45 @@ process.on('unhandledRejection', (reason) => {
     }
     connected = true;
 
+    // Register this nexus dir in the global registry so the API daemon
+    // (and any other consumer) can discover us regardless of cwd.
+    try {
+      var nodePath_reg = require('node:path');
+      var nodeFs_reg = require('node:fs');
+      var nodeOs_reg = require('node:os');
+      var regDir = nodePath_reg.join(nodeOs_reg.homedir(), '.open-agents');
+      if (!nodeFs_reg.existsSync(regDir)) nodeFs_reg.mkdirSync(regDir, { recursive: true });
+      var regFile = nodePath_reg.join(regDir, 'nexus-registry.json');
+      var existing = { dirs: [] };
+      try {
+        if (nodeFs_reg.existsSync(regFile)) existing = JSON.parse(nodeFs_reg.readFileSync(regFile, 'utf-8')) || { dirs: [] };
+        if (!Array.isArray(existing.dirs)) existing.dirs = [];
+      } catch { existing = { dirs: [] }; }
+      // Drop entries that no longer exist on disk
+      existing.dirs = existing.dirs.filter(function(e) {
+        var d = typeof e === 'string' ? e : (e && e.dir);
+        return d && nodeFs_reg.existsSync(nodePath_reg.join(d, 'status.json'));
+      });
+      // De-dup + prepend ourselves
+      var meDir = nexusDir;
+      existing.dirs = existing.dirs.filter(function(e) {
+        var d = typeof e === 'string' ? e : (e && e.dir);
+        return d !== meDir;
+      });
+      existing.dirs.unshift({
+        dir: meDir,
+        peerId: nexus.peerId || '',
+        pid: process.pid,
+        startedAt: new Date().toISOString(),
+      });
+      // Cap at 16 entries
+      if (existing.dirs.length > 16) existing.dirs = existing.dirs.slice(0, 16);
+      nodeFs_reg.writeFileSync(regFile, JSON.stringify(existing, null, 2));
+      dlog('nexus-registry: registered ' + meDir);
+    } catch (regErr) {
+      dlog('nexus-registry write failed: ' + (regErr.message || regErr));
+    }
+
     // http_tunnel capability — proxies HTTP requests from remote peers
     // to the local OA API daemon. Auth is delegated to the API key store
     // (remote sends share key in Authorization header). SSE streams are
@@ -247788,9 +247827,9 @@ print("${sentinel}")
         if (!this.proc || this.proc.killed) {
           return { success: false, path: "" };
         }
-        const { mkdirSync: mkdirSync67, writeFileSync: writeFileSync59 } = await import("node:fs");
+        const { mkdirSync: mkdirSync68, writeFileSync: writeFileSync60 } = await import("node:fs");
         const sessionDir = join28(this.cwd, ".oa", "rlm");
-        mkdirSync67(sessionDir, { recursive: true });
+        mkdirSync68(sessionDir, { recursive: true });
         const sessionPath2 = join28(sessionDir, "session.json");
         try {
           const inspectCode = `
@@ -247814,7 +247853,7 @@ print("__SESSION__" + json.dumps(_session) + "__SESSION__")
               trajectoryCount: this.trajectory.length,
               subCallCount: this.subCallCount
             };
-            writeFileSync59(sessionPath2, JSON.stringify(sessionData, null, 2), "utf8");
+            writeFileSync60(sessionPath2, JSON.stringify(sessionData, null, 2), "utf8");
             return { success: true, path: sessionPath2 };
           }
         } catch {
@@ -247826,9 +247865,9 @@ print("__SESSION__" + json.dumps(_session) + "__SESSION__")
        *  what was previously computed. */
       async loadSessionInfo() {
         try {
-          const { readFileSync: readFileSync89, existsSync: existsSync110 } = await import("node:fs");
+          const { readFileSync: readFileSync89, existsSync: existsSync111 } = await import("node:fs");
           const sessionPath2 = join28(this.cwd, ".oa", "rlm", "session.json");
-          if (!existsSync110(sessionPath2))
+          if (!existsSync111(sessionPath2))
             return null;
           return JSON.parse(readFileSync89(sessionPath2, "utf8"));
         } catch {
@@ -248394,10 +248433,10 @@ ${issues.map((i2) => `  - ${i2}`).join("\n")}` : "  No issues found."),
        * Optionally filter by task type for phase-aware context (FSM paper insight).
        */
       getTopMemoriesSync(k = 5, taskType) {
-        const { readFileSync: readFileSync89, existsSync: existsSync110 } = __require("node:fs");
+        const { readFileSync: readFileSync89, existsSync: existsSync111 } = __require("node:fs");
         const metaDir = join29(this.cwd, ".oa", "memory", "metabolism");
         const storeFile = join29(metaDir, "store.json");
-        if (!existsSync110(storeFile))
+        if (!existsSync111(storeFile))
           return "";
         let store2 = [];
         try {
@@ -248423,10 +248462,10 @@ ${issues.map((i2) => `  - ${i2}`).join("\n")}` : "  No issues found."),
       /** Update memory scores based on task outcome. Called after task completion.
        *  Memories used in successful tasks get boosted. Memories present during failures get decayed. */
       updateFromOutcomeSync(surfacedMemoryText, succeeded) {
-        const { readFileSync: readFileSync89, writeFileSync: writeFileSync59, existsSync: existsSync110, mkdirSync: mkdirSync67 } = __require("node:fs");
+        const { readFileSync: readFileSync89, writeFileSync: writeFileSync60, existsSync: existsSync111, mkdirSync: mkdirSync68 } = __require("node:fs");
         const metaDir = join29(this.cwd, ".oa", "memory", "metabolism");
         const storeFile = join29(metaDir, "store.json");
-        if (!existsSync110(storeFile))
+        if (!existsSync111(storeFile))
           return;
         let store2 = [];
         try {
@@ -248454,8 +248493,8 @@ ${issues.map((i2) => `  - ${i2}`).join("\n")}` : "  No issues found."),
           updated = true;
         }
         if (updated) {
-          mkdirSync67(metaDir, { recursive: true });
-          writeFileSync59(storeFile, JSON.stringify(store2, null, 2));
+          mkdirSync68(metaDir, { recursive: true });
+          writeFileSync60(storeFile, JSON.stringify(store2, null, 2));
         }
       }
       // ── Storage ──────────────────────────────────────────────────────────
@@ -248877,9 +248916,9 @@ Recommendation: Strategy ${scored[0].index + 1} scores highest.`;
       // Per EvoSkill (arXiv:2603.02766): retrieve relevant strategies from archive.
       /** Retrieve top-K strategies for context injection. Returns "" if none. */
       getRelevantStrategiesSync(k = 3, taskType) {
-        const { readFileSync: readFileSync89, existsSync: existsSync110 } = __require("node:fs");
+        const { readFileSync: readFileSync89, existsSync: existsSync111 } = __require("node:fs");
         const archiveFile = join31(this.cwd, ".oa", "arche", "variants.json");
-        if (!existsSync110(archiveFile))
+        if (!existsSync111(archiveFile))
           return "";
         let variants = [];
         try {
@@ -248901,12 +248940,12 @@ Recommendation: Strategy ${scored[0].index + 1} scores highest.`;
       }
       /** Archive a strategy variant synchronously (for task completion path) */
       archiveVariantSync(strategy, outcome, tags = []) {
-        const { readFileSync: readFileSync89, writeFileSync: writeFileSync59, existsSync: existsSync110, mkdirSync: mkdirSync67 } = __require("node:fs");
+        const { readFileSync: readFileSync89, writeFileSync: writeFileSync60, existsSync: existsSync111, mkdirSync: mkdirSync68 } = __require("node:fs");
         const dir = join31(this.cwd, ".oa", "arche");
         const archiveFile = join31(dir, "variants.json");
         let variants = [];
         try {
-          if (existsSync110(archiveFile))
+          if (existsSync111(archiveFile))
             variants = JSON.parse(readFileSync89(archiveFile, "utf8"));
         } catch {
         }
@@ -248922,8 +248961,8 @@ Recommendation: Strategy ${scored[0].index + 1} scores highest.`;
         });
         if (variants.length > 50)
           variants = variants.slice(-50);
-        mkdirSync67(dir, { recursive: true });
-        writeFileSync59(archiveFile, JSON.stringify(variants, null, 2));
+        mkdirSync68(dir, { recursive: true });
+        writeFileSync60(archiveFile, JSON.stringify(variants, null, 2));
       }
       async saveArchive(variants) {
         const dir = join31(this.cwd, ".oa", "arche");
@@ -257187,7 +257226,7 @@ var require_util9 = __commonJS({
       return path8;
     }
     exports.normalize = normalize2;
-    function join128(aRoot, aPath) {
+    function join129(aRoot, aPath) {
       if (aRoot === "") {
         aRoot = ".";
       }
@@ -257219,7 +257258,7 @@ var require_util9 = __commonJS({
       }
       return joined;
     }
-    exports.join = join128;
+    exports.join = join129;
     exports.isAbsolute = function(aPath) {
       return aPath.charAt(0) === "/" || urlRegexp.test(aPath);
     };
@@ -257392,7 +257431,7 @@ var require_util9 = __commonJS({
             parsed.path = parsed.path.substring(0, index + 1);
           }
         }
-        sourceURL = join128(urlGenerate(parsed), sourceURL);
+        sourceURL = join129(urlGenerate(parsed), sourceURL);
       }
       return normalize2(sourceURL);
     }
@@ -472295,10 +472334,10 @@ var require_commonjs3 = __commonJS({
         let ai = 0;
         let bi = 0;
         let result = [];
-        let which = "";
+        let which2 = "";
         while (ai < a2.length && bi < b.length) {
           if (a2[ai] === b[bi]) {
-            result.push(which === "b" ? b[bi] : a2[ai]);
+            result.push(which2 === "b" ? b[bi] : a2[ai]);
             ai++;
             bi++;
           } else if (emptyGSMatch && a2[ai] === "**" && b[bi] === a2[ai + 1]) {
@@ -472308,16 +472347,16 @@ var require_commonjs3 = __commonJS({
             result.push(b[bi]);
             bi++;
           } else if (a2[ai] === "*" && b[bi] && (this.options.dot || !b[bi].startsWith(".")) && b[bi] !== "**") {
-            if (which === "b")
+            if (which2 === "b")
               return false;
-            which = "a";
+            which2 = "a";
             result.push(a2[ai]);
             ai++;
             bi++;
           } else if (b[bi] === "*" && a2[ai] && (this.options.dot || !a2[ai].startsWith(".")) && a2[ai] !== "**") {
-            if (which === "a")
+            if (which2 === "a")
               return false;
-            which = "b";
+            which2 = "b";
             result.push(b[bi]);
             ai++;
             bi++;
@@ -472812,7 +472851,7 @@ var require_path_browserify = __commonJS({
         assertPath(path8);
         return path8.length > 0 && path8.charCodeAt(0) === 47;
       },
-      join: function join128() {
+      join: function join129() {
         if (arguments.length === 0)
           return ".";
         var joined;
@@ -507800,7 +507839,7 @@ var init_agent_tool = __esm({
         })();
         if (isolation === "worktree") {
           this.callbacks.onViewRegister?.(agentId, label);
-          const spawn27 = this.callbacks.spawnSubprocess({
+          const spawn28 = this.callbacks.spawnSubprocess({
             id: agentId,
             task: composedPrompt,
             model,
@@ -507810,7 +507849,7 @@ var init_agent_tool = __esm({
             success: true,
             output: `Agent spawned (subprocess, worktree): ${agentId}
   Type: ${subagentType}
-  PID: ${spawn27.pid}
+  PID: ${spawn28.pid}
   Task: ${prompt.slice(0, 100)}
   Use task_status("${agentId}") to check progress.`,
             durationMs: performance.now() - start2
@@ -522926,8 +522965,8 @@ var init_reflectionBuffer = __esm({
         this.persistPath = persistPath ?? null;
         if (this.persistPath) {
           try {
-            const { readFileSync: readFileSync89, existsSync: existsSync110 } = __require("node:fs");
-            if (existsSync110(this.persistPath)) {
+            const { readFileSync: readFileSync89, existsSync: existsSync111 } = __require("node:fs");
+            if (existsSync111(this.persistPath)) {
               this.state = JSON.parse(readFileSync89(this.persistPath, "utf-8"));
               return;
             }
@@ -523161,12 +523200,12 @@ var init_reflectionBuffer = __esm({
         if (!this.persistPath)
           return;
         try {
-          const { writeFileSync: writeFileSync59, mkdirSync: mkdirSync67, existsSync: existsSync110 } = __require("node:fs");
-          const { join: join128 } = __require("node:path");
-          const dir = join128(this.persistPath, "..");
-          if (!existsSync110(dir))
-            mkdirSync67(dir, { recursive: true });
-          writeFileSync59(this.persistPath, JSON.stringify(this.state, null, 2));
+          const { writeFileSync: writeFileSync60, mkdirSync: mkdirSync68, existsSync: existsSync111 } = __require("node:fs");
+          const { join: join129 } = __require("node:path");
+          const dir = join129(this.persistPath, "..");
+          if (!existsSync111(dir))
+            mkdirSync68(dir, { recursive: true });
+          writeFileSync60(this.persistPath, JSON.stringify(this.state, null, 2));
         } catch {
         }
       }
@@ -533706,10 +533745,10 @@ Full content available via: repl_exec(code="data = retrieve('${handleId}')")  or
               if (nodes > 0) {
                 this.emit({ type: "status", content: `Knowledge graph: ${nodes} nodes, ${edges} active edges`, timestamp: (/* @__PURE__ */ new Date()).toISOString() });
                 try {
-                  const { mkdirSync: mkdirSync67, writeFileSync: writeFileSync59 } = __require("node:fs");
-                  const { join: join128 } = __require("node:path");
-                  const contextDir = join128(this._workingDirectory || process.cwd(), ".oa", "context");
-                  mkdirSync67(contextDir, { recursive: true });
+                  const { mkdirSync: mkdirSync68, writeFileSync: writeFileSync60 } = __require("node:fs");
+                  const { join: join129 } = __require("node:path");
+                  const contextDir = join129(this._workingDirectory || process.cwd(), ".oa", "context");
+                  mkdirSync68(contextDir, { recursive: true });
                   const topEntities = this._temporalGraph.nodesByType("entity", 3);
                   const topFiles = this._temporalGraph.nodesByType("file", 3);
                   const topConcepts = this._temporalGraph.nodesByType("concept", 3);
@@ -533749,9 +533788,9 @@ Full content available via: repl_exec(code="data = retrieve('${handleId}')")  or
                   section("Top Files", topFiles);
                   section("Top Concepts", topConcepts);
                   lines.push("(Use file_read on this file for quick recall. See provenance JSON for full edge detail.)");
-                  const outPath = join128(contextDir, `kg-summary-${this._sessionId}.md`);
-                  writeFileSync59(outPath, lines.join("\n"), "utf-8");
-                  writeFileSync59(join128(contextDir, `kg-summary-latest.md`), lines.join("\n"), "utf-8");
+                  const outPath = join129(contextDir, `kg-summary-${this._sessionId}.md`);
+                  writeFileSync60(outPath, lines.join("\n"), "utf-8");
+                  writeFileSync60(join129(contextDir, `kg-summary-latest.md`), lines.join("\n"), "utf-8");
                 } catch {
                 }
               }
@@ -533919,11 +533958,11 @@ ${errOutput}`;
           timestamp: (/* @__PURE__ */ new Date()).toISOString()
         });
         try {
-          const { mkdirSync: mkdirSync67, writeFileSync: writeFileSync59 } = __require("node:fs");
-          const { join: join128 } = __require("node:path");
-          const resultsDir = join128(process.cwd(), ".oa", "tool-results");
-          mkdirSync67(resultsDir, { recursive: true });
-          writeFileSync59(join128(resultsDir, `${handleId}.txt`), `# Tool: ${toolName}
+          const { mkdirSync: mkdirSync68, writeFileSync: writeFileSync60 } = __require("node:fs");
+          const { join: join129 } = __require("node:path");
+          const resultsDir = join129(process.cwd(), ".oa", "tool-results");
+          mkdirSync68(resultsDir, { recursive: true });
+          writeFileSync60(join129(resultsDir, `${handleId}.txt`), `# Tool: ${toolName}
 # Turn: ${turn}
 # Timestamp: ${(/* @__PURE__ */ new Date()).toISOString()}
 # Size: ${result.output.length} chars, ${lineCount} lines
@@ -534139,10 +534178,10 @@ Actions: (1) list_directory on the parent directory to see what's there, (2) Che
         if (!this._workingDirectory)
           return;
         try {
-          const { mkdirSync: mkdirSync67, writeFileSync: writeFileSync59 } = __require("node:fs");
-          const { join: join128 } = __require("node:path");
-          const sessionDir = join128(this._workingDirectory, ".oa", "session", this._sessionId);
-          mkdirSync67(sessionDir, { recursive: true });
+          const { mkdirSync: mkdirSync68, writeFileSync: writeFileSync60 } = __require("node:fs");
+          const { join: join129 } = __require("node:path");
+          const sessionDir = join129(this._workingDirectory, ".oa", "session", this._sessionId);
+          mkdirSync68(sessionDir, { recursive: true });
           const checkpoint = {
             timestamp: (/* @__PURE__ */ new Date()).toISOString(),
             sessionId: this._sessionId,
@@ -534154,7 +534193,7 @@ Actions: (1) list_directory on the parent directory to see what's there, (2) Che
             memexEntryCount: this._memexArchive.size,
             fileRegistrySize: this._fileRegistry.size
           };
-          writeFileSync59(join128(sessionDir, "checkpoint.json"), JSON.stringify(checkpoint, null, 2));
+          writeFileSync60(join129(sessionDir, "checkpoint.json"), JSON.stringify(checkpoint, null, 2));
         } catch {
         }
       }
@@ -535981,12 +536020,12 @@ ${result}`
             let resizedBase64 = null;
             try {
               const { execSync: execSync59 } = await import("node:child_process");
-              const { writeFileSync: writeFileSync59, readFileSync: readFileSync89, unlinkSync: unlinkSync25 } = await import("node:fs");
-              const { join: join128 } = await import("node:path");
-              const { tmpdir: tmpdir22 } = await import("node:os");
-              const tmpIn = join128(tmpdir22(), `oa_img_in_${Date.now()}.png`);
-              const tmpOut = join128(tmpdir22(), `oa_img_out_${Date.now()}.jpg`);
-              writeFileSync59(tmpIn, buffer2);
+              const { writeFileSync: writeFileSync60, readFileSync: readFileSync89, unlinkSync: unlinkSync25 } = await import("node:fs");
+              const { join: join129 } = await import("node:path");
+              const { tmpdir: tmpdir23 } = await import("node:os");
+              const tmpIn = join129(tmpdir23(), `oa_img_in_${Date.now()}.png`);
+              const tmpOut = join129(tmpdir23(), `oa_img_out_${Date.now()}.jpg`);
+              writeFileSync60(tmpIn, buffer2);
               const pyBin = process.platform === "win32" ? "python" : "python3";
               const escapedIn = tmpIn.replace(/\\/g, "\\\\");
               const escapedOut = tmpOut.replace(/\\/g, "\\\\");
@@ -544531,23 +544570,23 @@ async function fetchOpenAIModels(baseUrl, apiKey) {
 async function fetchPeerModels(peerId, authKey) {
   try {
     const { NexusTool: NexusTool2 } = await Promise.resolve().then(() => (init_dist5(), dist_exports));
-    const { existsSync: existsSync110, readFileSync: readFileSync89 } = await import("node:fs");
-    const { join: join128 } = await import("node:path");
+    const { existsSync: existsSync111, readFileSync: readFileSync89 } = await import("node:fs");
+    const { join: join129 } = await import("node:path");
     const cwd4 = process.cwd();
     const nexusTool = new NexusTool2(cwd4);
     const nexusDir = nexusTool.getNexusDir();
     let isLocalPeer = false;
     try {
-      const statusPath = join128(nexusDir, "status.json");
-      if (existsSync110(statusPath)) {
+      const statusPath = join129(nexusDir, "status.json");
+      if (existsSync111(statusPath)) {
         const status = JSON.parse(readFileSync89(statusPath, "utf8"));
         if (status.peerId === peerId) isLocalPeer = true;
       }
     } catch {
     }
     if (isLocalPeer) {
-      const pricingPath = join128(nexusDir, "pricing.json");
-      if (existsSync110(pricingPath)) {
+      const pricingPath = join129(nexusDir, "pricing.json");
+      if (existsSync111(pricingPath)) {
         try {
           const pricing = JSON.parse(readFileSync89(pricingPath, "utf8"));
           const localModels = (pricing.models || []).map((m2) => ({
@@ -544562,8 +544601,8 @@ async function fetchPeerModels(peerId, authKey) {
         }
       }
     }
-    const cachePath = join128(nexusDir, "peer-models-cache.json");
-    if (existsSync110(cachePath)) {
+    const cachePath = join129(nexusDir, "peer-models-cache.json");
+    if (existsSync111(cachePath)) {
       try {
         const cache8 = JSON.parse(readFileSync89(cachePath, "utf8"));
         if (cache8.peerId === peerId && cache8.models?.length > 0) {
@@ -544677,8 +544716,8 @@ async function fetchPeerModels(peerId, authKey) {
     } catch {
     }
     if (isLocalPeer) {
-      const pricingPath = join128(nexusDir, "pricing.json");
-      if (existsSync110(pricingPath)) {
+      const pricingPath = join129(nexusDir, "pricing.json");
+      if (existsSync111(pricingPath)) {
         try {
           const pricing = JSON.parse(readFileSync89(pricingPath, "utf8"));
           return (pricing.models || []).map((m2) => ({
@@ -562459,13 +562498,13 @@ async function runSudoScript(ctx3, script) {
   } catch {
   }
   try {
-    const { spawn: spawn27 } = await import("node:child_process");
+    const { spawn: spawn28 } = await import("node:child_process");
     const full = `set -e; ${script}`;
     await new Promise((resolve43) => {
       const usePkexec = process.platform === "linux";
       const cmd = usePkexec ? "pkexec" : "sudo";
       const args = usePkexec ? ["bash", "-lc", full] : ["-n", "bash", "-lc", full];
-      const child = spawn27(cmd, args, { stdio: ["ignore", "pipe", "pipe"] });
+      const child = spawn28(cmd, args, { stdio: ["ignore", "pipe", "pipe"] });
       let stdout = "";
       let stderr = "";
       child.stdout?.on("data", (data) => {
@@ -562499,9 +562538,9 @@ async function ensureVoiceDeps(ctx3) {
     }
     if (typeof mod2.getVenvPython === "function") {
       const { dirname: dirname39 } = await import("node:path");
-      const { existsSync: existsSync110 } = await import("node:fs");
+      const { existsSync: existsSync111 } = await import("node:fs");
       const venvPy = mod2.getVenvPython();
-      if (existsSync110(venvPy)) {
+      if (existsSync111(venvPy)) {
         process.env.TRANSCRIBE_PYTHON = venvPy;
         const venvBin = dirname39(venvPy);
         const sep2 = process.platform === "win32" ? ";" : ":";
@@ -562820,10 +562859,10 @@ async function handleSlashCommand(input, ctx3) {
         if (!key) {
           try {
             const { homedir: homedir46 } = await import("node:os");
-            const { readFileSync: readFileSync89, existsSync: existsSync110 } = await import("node:fs");
-            const { join: join128 } = await import("node:path");
-            const p2 = join128(homedir46(), ".open-agents", "api.key");
-            if (existsSync110(p2)) key = readFileSync89(p2, "utf8").trim();
+            const { readFileSync: readFileSync89, existsSync: existsSync111 } = await import("node:fs");
+            const { join: join129 } = await import("node:path");
+            const p2 = join129(homedir46(), ".open-agents", "api.key");
+            if (existsSync111(p2)) key = readFileSync89(p2, "utf8").trim();
           } catch {
           }
         }
@@ -562862,13 +562901,13 @@ async function handleSlashCommand(input, ctx3) {
           try {
             const { randomBytes: randomBytes25 } = await import("node:crypto");
             const { homedir: homedir46 } = await import("node:os");
-            const { mkdirSync: mkdirSync67, writeFileSync: writeFileSync59 } = await import("node:fs");
-            const { join: join128 } = await import("node:path");
+            const { mkdirSync: mkdirSync68, writeFileSync: writeFileSync60 } = await import("node:fs");
+            const { join: join129 } = await import("node:path");
             const newKey = randomBytes25(16).toString("hex");
             process.env["OA_API_KEY"] = newKey;
-            const dir = join128(homedir46(), ".open-agents");
-            mkdirSync67(dir, { recursive: true });
-            writeFileSync59(join128(dir, "api.key"), newKey + "\n", "utf8");
+            const dir = join129(homedir46(), ".open-agents");
+            mkdirSync68(dir, { recursive: true });
+            writeFileSync60(join129(dir, "api.key"), newKey + "\n", "utf8");
             renderInfo2(`New API key: ${c3.bold(c3.yellow(newKey))}`);
             renderInfo2("Restart the daemon to apply if needed. Use /access any to restart quickly.");
           } catch (e2) {
@@ -563056,11 +563095,11 @@ async function handleSlashCommand(input, ctx3) {
             renderInfo2("Use the Web UI ‘key’ button to paste this token, or set Authorization: Bearer <key> in your client.");
             try {
               const { homedir: homedir47 } = await import("node:os");
-              const { mkdirSync: mkdirSync68, writeFileSync: writeFileSync60 } = await import("node:fs");
-              const { join: join129 } = await import("node:path");
-              const dir = join129(homedir47(), ".open-agents");
-              mkdirSync68(dir, { recursive: true });
-              writeFileSync60(join129(dir, "api.key"), apiKey + "\n", "utf8");
+              const { mkdirSync: mkdirSync69, writeFileSync: writeFileSync61 } = await import("node:fs");
+              const { join: join130 } = await import("node:path");
+              const dir = join130(homedir47(), ".open-agents");
+              mkdirSync69(dir, { recursive: true });
+              writeFileSync61(join130(dir, "api.key"), apiKey + "\n", "utf8");
             } catch {
             }
           }
@@ -563072,11 +563111,11 @@ async function handleSlashCommand(input, ctx3) {
           const port2 = parseInt(process.env["OA_PORT"] || "11435", 10);
           try {
             const { homedir: homedir47 } = await import("node:os");
-            const { mkdirSync: mkdirSync68, writeFileSync: writeFileSync60 } = await import("node:fs");
-            const { join: join129 } = await import("node:path");
-            const dir = join129(homedir47(), ".open-agents");
-            mkdirSync68(dir, { recursive: true });
-            writeFileSync60(join129(dir, "access"), `${val2}
+            const { mkdirSync: mkdirSync69, writeFileSync: writeFileSync61 } = await import("node:fs");
+            const { join: join130 } = await import("node:path");
+            const dir = join130(homedir47(), ".open-agents");
+            mkdirSync69(dir, { recursive: true });
+            writeFileSync61(join130(dir, "access"), `${val2}
 `, "utf8");
           } catch {
           }
@@ -563158,11 +563197,11 @@ async function handleSlashCommand(input, ctx3) {
         renderInfo2("Use the Web UI ‘key’ button to paste this token, or set Authorization: Bearer <key> in your client.");
         try {
           const { homedir: homedir47 } = await import("node:os");
-          const { mkdirSync: mkdirSync68, writeFileSync: writeFileSync60 } = await import("node:fs");
-          const { join: join129 } = await import("node:path");
-          const dir = join129(homedir47(), ".open-agents");
-          mkdirSync68(dir, { recursive: true });
-          writeFileSync60(join129(dir, "api.key"), apiKey + "\n", "utf8");
+          const { mkdirSync: mkdirSync69, writeFileSync: writeFileSync61 } = await import("node:fs");
+          const { join: join130 } = await import("node:path");
+          const dir = join130(homedir47(), ".open-agents");
+          mkdirSync69(dir, { recursive: true });
+          writeFileSync61(join130(dir, "api.key"), apiKey + "\n", "utf8");
         } catch {
         }
       }
@@ -563173,12 +563212,12 @@ async function handleSlashCommand(input, ctx3) {
       }
       const port = parseInt(process.env["OA_PORT"] || "11435", 10);
       const { homedir: homedir46 } = await import("node:os");
-      const { mkdirSync: mkdirSync67, writeFileSync: writeFileSync59 } = await import("node:fs");
-      const { join: join128 } = await import("node:path");
+      const { mkdirSync: mkdirSync68, writeFileSync: writeFileSync60 } = await import("node:fs");
+      const { join: join129 } = await import("node:path");
       try {
-        const dir = join128(homedir46(), ".open-agents");
-        mkdirSync67(dir, { recursive: true });
-        writeFileSync59(join128(dir, "access"), `${val}
+        const dir = join129(homedir46(), ".open-agents");
+        mkdirSync68(dir, { recursive: true });
+        writeFileSync60(join129(dir, "access"), `${val}
 `, "utf8");
       } catch (e2) {
         renderWarning2(`Could not persist ~/.open-agents/access: ${e2 instanceof Error ? e2.message : String(e2)}`);
@@ -564230,8 +564269,8 @@ async function handleSlashCommand(input, ctx3) {
         writeFileSync41(jwtFile, JSON.stringify(jwtPayload, null, 2));
         renderInfo2(`Launching fortemi-react from ${fDir}...`);
         try {
-          const { spawn: spawn27 } = __require("node:child_process");
-          const child = spawn27("npx", ["vite", "dev", "--host", "0.0.0.0", "--port", "3000"], {
+          const { spawn: spawn28 } = __require("node:child_process");
+          const child = spawn28("npx", ["vite", "dev", "--host", "0.0.0.0", "--port", "3000"], {
             cwd: join99(fDir, "apps", "standalone"),
             stdio: "ignore",
             detached: true,
@@ -564956,9 +564995,9 @@ systemctl --user daemon-reload || true
 systemctl --user enable --now open-agents-daemon.service || true
 sleep 1
 `;
-          const { spawn: spawn27 } = await import("node:child_process");
+          const { spawn: spawn28 } = await import("node:child_process");
           await new Promise((resolve43) => {
-            const child = spawn27("bash", ["-lc", takeover], { stdio: "inherit" });
+            const child = spawn28("bash", ["-lc", takeover], { stdio: "inherit" });
             onChildExit(child, () => resolve43());
           });
           renderInfo2("Daemon takeover complete.");
@@ -567395,11 +567434,11 @@ async function handleVoiceMenu(ctx3, save2, hasLocal) {
               continue;
             }
             const { basename: basename21, join: pathJoin } = await import("node:path");
-            const { copyFileSync: copyFileSync3, mkdirSync: mkdirSync67, existsSync: exists2 } = await import("node:fs");
+            const { copyFileSync: copyFileSync3, mkdirSync: mkdirSync68, existsSync: exists2 } = await import("node:fs");
             const { homedir: homedir46 } = await import("node:os");
             const modelName = basename21(onnxDrop.path, ".onnx").replace(/[^a-zA-Z0-9_-]/g, "-");
             const destDir = pathJoin(homedir46(), ".open-agents", "voice", "models", modelName);
-            if (!exists2(destDir)) mkdirSync67(destDir, { recursive: true });
+            if (!exists2(destDir)) mkdirSync68(destDir, { recursive: true });
             copyFileSync3(onnxDrop.path, pathJoin(destDir, "model.onnx"));
             copyFileSync3(jsonDrop.path, pathJoin(destDir, "config.json"));
             const { registerCustomOnnxModel: registerCustomOnnxModel2 } = await Promise.resolve().then(() => (init_voice(), voice_exports));
@@ -568149,10 +568188,10 @@ async function handleSponsoredEndpoint(ctx3, local) {
     sponsors.push(...verified);
     if (verified.length > 0) {
       try {
-        const { mkdirSync: mkdirSync67, writeFileSync: writeFileSync59 } = __require("node:fs");
-        mkdirSync67(sponsorDir2, { recursive: true });
+        const { mkdirSync: mkdirSync68, writeFileSync: writeFileSync60 } = __require("node:fs");
+        mkdirSync68(sponsorDir2, { recursive: true });
         const cached = verified.map((s2) => ({ ...s2, lastVerified: Date.now() }));
-        writeFileSync59(knownFile, JSON.stringify(cached, null, 2));
+        writeFileSync60(knownFile, JSON.stringify(cached, null, 2));
       } catch {
       }
     }
@@ -568325,11 +568364,11 @@ async function handlePeerEndpoint(peerId, authKey, ctx3, local) {
     const models = await fetchModels(peerUrl, authKey);
     if (models.length > 0) {
       try {
-        const { writeFileSync: writeFileSync59, mkdirSync: mkdirSync67 } = await import("node:fs");
-        const { join: join128, dirname: dirname39 } = await import("node:path");
-        const cachePath = join128(ctx3.repoRoot || process.cwd(), ".oa", "nexus", "peer-models-cache.json");
-        mkdirSync67(dirname39(cachePath), { recursive: true });
-        writeFileSync59(cachePath, JSON.stringify({
+        const { writeFileSync: writeFileSync60, mkdirSync: mkdirSync68 } = await import("node:fs");
+        const { join: join129, dirname: dirname39 } = await import("node:path");
+        const cachePath = join129(ctx3.repoRoot || process.cwd(), ".oa", "nexus", "peer-models-cache.json");
+        mkdirSync68(dirname39(cachePath), { recursive: true });
+        writeFileSync60(cachePath, JSON.stringify({
           peerId,
           cachedAt: (/* @__PURE__ */ new Date()).toISOString(),
           models: models.map((m2) => ({ name: m2.name, size: m2.size, parameterSize: m2.parameterSize }))
@@ -568481,8 +568520,8 @@ ${escapedContent}EOF'`, { timeoutMs: 3e4 });
       }
       await new Promise((r2) => setTimeout(r2, 1e3));
       process.env.OLLAMA_NUM_PARALLEL = String(n2);
-      const { spawn: spawn27 } = await import("node:child_process");
-      const child = spawn27("ollama", ["serve"], {
+      const { spawn: spawn28 } = await import("node:child_process");
+      const child = spawn28("ollama", ["serve"], {
         stdio: "ignore",
         detached: true,
         env: { ...process.env, OLLAMA_NUM_PARALLEL: String(n2) }
@@ -568898,17 +568937,17 @@ async function handleUpdate(subcommand, ctx3) {
   try {
     const { createRequire: createRequire8 } = await import("node:module");
     const { fileURLToPath: fileURLToPath20 } = await import("node:url");
-    const { dirname: dirname39, join: join128 } = await import("node:path");
-    const { existsSync: existsSync110 } = await import("node:fs");
+    const { dirname: dirname39, join: join129 } = await import("node:path");
+    const { existsSync: existsSync111 } = await import("node:fs");
     const req2 = createRequire8(import.meta.url);
     const thisDir = dirname39(fileURLToPath20(import.meta.url));
     const candidates = [
-      join128(thisDir, "..", "package.json"),
-      join128(thisDir, "..", "..", "package.json"),
-      join128(thisDir, "..", "..", "..", "package.json")
+      join129(thisDir, "..", "package.json"),
+      join129(thisDir, "..", "..", "package.json"),
+      join129(thisDir, "..", "..", "..", "package.json")
     ];
     for (const pkgPath of candidates) {
-      if (existsSync110(pkgPath)) {
+      if (existsSync111(pkgPath)) {
         const pkg = req2(pkgPath);
         if (pkg.name === "open-agents-ai" || pkg.name === "@open-agents/cli") {
           currentVersion = pkg.version ?? "0.0.0";
@@ -570056,13 +570095,13 @@ var init_commands = __esm({
             try {
               const { randomBytes: randomBytes25 } = await import("node:crypto");
               const { homedir: homedir46 } = await import("node:os");
-              const { mkdirSync: mkdirSync67, writeFileSync: writeFileSync59 } = await import("node:fs");
-              const { join: join128 } = await import("node:path");
+              const { mkdirSync: mkdirSync68, writeFileSync: writeFileSync60 } = await import("node:fs");
+              const { join: join129 } = await import("node:path");
               const apiKey = randomBytes25(16).toString("hex");
               process.env["OA_API_KEY"] = apiKey;
-              const dir = join128(homedir46(), ".open-agents");
-              mkdirSync67(dir, { recursive: true });
-              writeFileSync59(join128(dir, "api.key"), apiKey + "\n", "utf8");
+              const dir = join129(homedir46(), ".open-agents");
+              mkdirSync68(dir, { recursive: true });
+              writeFileSync60(join129(dir, "api.key"), apiKey + "\n", "utf8");
               renderInfo2(`Generated API key: ${c3.bold(c3.yellow(apiKey))}`);
               renderInfo2("Use Authorization: Bearer <key> or click 'key' in the Web UI header to paste it.");
             } catch (e2) {
@@ -570077,11 +570116,11 @@ var init_commands = __esm({
           const port = parseInt(process.env["OA_PORT"] || "11435", 10);
           try {
             const { homedir: homedir46 } = await import("node:os");
-            const { mkdirSync: mkdirSync67, writeFileSync: writeFileSync59 } = await import("node:fs");
-            const { join: join128 } = await import("node:path");
-            const dir = join128(homedir46(), ".open-agents");
-            mkdirSync67(dir, { recursive: true });
-            writeFileSync59(join128(dir, "access"), `${val}
+            const { mkdirSync: mkdirSync68, writeFileSync: writeFileSync60 } = await import("node:fs");
+            const { join: join129 } = await import("node:path");
+            const dir = join129(homedir46(), ".open-agents");
+            mkdirSync68(dir, { recursive: true });
+            writeFileSync60(join129(dir, "access"), `${val}
 `, "utf8");
           } catch {
           }
@@ -581893,11 +581932,11 @@ Telegram admin: @${msg.username}` : `Telegram ${isGroup ? "group" : "public"} ch
           let mimeType = "audio/wav";
           try {
             const { execSync: execSyncLocal } = await import("node:child_process");
-            const { tmpdir: tmpdir22 } = await import("node:os");
+            const { tmpdir: tmpdir23 } = await import("node:os");
             const { join: joinPath } = await import("node:path");
             const { writeFileSync: writeFs, readFileSync: readFs, unlinkSync: unlinkFs } = await import("node:fs");
-            const tmpWav = joinPath(tmpdir22(), `oa-tg-voice-${Date.now()}.wav`);
-            const tmpOgg = joinPath(tmpdir22(), `oa-tg-voice-${Date.now()}.ogg`);
+            const tmpWav = joinPath(tmpdir23(), `oa-tg-voice-${Date.now()}.wav`);
+            const tmpOgg = joinPath(tmpdir23(), `oa-tg-voice-${Date.now()}.ogg`);
             writeFs(tmpWav, wavBuffer);
             execSyncLocal(`ffmpeg -i "${tmpWav}" -c:a libopus -b:a 48k -ar 48000 -ac 1 "${tmpOgg}" -y 2>/dev/null`, {
               timeout: 15e3,
@@ -585772,9 +585811,131 @@ var init_tor_fallback = __esm({
   }
 });
 
+// packages/cli/src/api/graphical-sudo.ts
+var graphical_sudo_exports = {};
+__export(graphical_sudo_exports, {
+  detectSudoHelper: () => detectSudoHelper,
+  runGraphicalSudo: () => runGraphicalSudo
+});
+import { spawn as spawn24 } from "node:child_process";
+import { existsSync as existsSync102, mkdirSync as mkdirSync60, writeFileSync as writeFileSync52, chmodSync as chmodSync2 } from "node:fs";
+import { join as join118 } from "node:path";
+import { tmpdir as tmpdir21 } from "node:os";
+function detectSudoHelper() {
+  if (process.platform === "win32") return null;
+  if (process.platform === "darwin") return "osascript";
+  if (which("pkexec")) return "pkexec";
+  if (which("ssh-askpass")) return "ssh-askpass";
+  if (which("zenity")) return "zenity";
+  if (which("kdialog")) return "kdialog";
+  if (which("sudo")) return "sudo-tty";
+  return null;
+}
+function which(cmd) {
+  const path8 = process.env["PATH"] || "/usr/bin:/bin:/usr/local/bin";
+  for (const dir of path8.split(":")) {
+    if (!dir) continue;
+    const full = join118(dir, cmd);
+    if (existsSync102(full)) return full;
+  }
+  return null;
+}
+function ensureAskpassShim(helper, description) {
+  const shimDir = join118(tmpdir21(), "oa-askpass");
+  mkdirSync60(shimDir, { recursive: true });
+  const shim = join118(shimDir, `${helper}.sh`);
+  let body;
+  if (helper === "zenity") {
+    body = `#!/bin/sh
+exec zenity --password --title="OA needs sudo" --text="${description.replace(/"/g, '\\"')}" 2>/dev/null
+`;
+  } else {
+    body = `#!/bin/sh
+exec kdialog --password "${description.replace(/"/g, '\\"')}" 2>/dev/null
+`;
+  }
+  writeFileSync52(shim, body, "utf-8");
+  chmodSync2(shim, 493);
+  return shim;
+}
+async function runGraphicalSudo(opts) {
+  const helper = detectSudoHelper();
+  const description = opts.description || "Open Agents needs admin access to set up Tor (.onion hidden service)";
+  const timeoutMs = opts.timeoutMs ?? 5 * 6e4;
+  if (!helper) throw new Error("No suitable sudo helper found (pkexec, zenity, kdialog, ssh-askpass).");
+  let cmd;
+  let args;
+  let extraEnv = {};
+  const envFlags = [];
+  for (const [k, v] of Object.entries(opts.env || {})) envFlags.push(`${k}=${v}`);
+  if (helper === "pkexec") {
+    cmd = "pkexec";
+    args = [];
+    if (envFlags.length) args.push(...envFlags.flatMap((e2) => ["--user", "root", "env", e2]));
+    args = ["env", ...envFlags, "/bin/bash", opts.scriptPath, ...opts.args ?? []];
+  } else if (helper === "osascript") {
+    const inner = `${envFlags.map((e2) => `${e2}`).join(" ")} /bin/bash ${shellQuote(opts.scriptPath)} ${shellQuote((opts.args ?? []).join(" "))}`.trim();
+    cmd = "osascript";
+    args = ["-e", `do shell script "${inner.replace(/"/g, '\\"')}" with administrator privileges`];
+  } else if (helper === "ssh-askpass" || helper === "zenity" || helper === "kdialog") {
+    const shim = helper === "ssh-askpass" ? which("ssh-askpass") : ensureAskpassShim(helper, description);
+    extraEnv = { ...extraEnv, SUDO_ASKPASS: shim, DISPLAY: process.env["DISPLAY"] || ":0" };
+    cmd = "sudo";
+    args = ["-A", "-E", "/bin/bash", opts.scriptPath, ...opts.args ?? []];
+  } else {
+    cmd = "sudo";
+    args = ["/bin/bash", opts.scriptPath, ...opts.args ?? []];
+  }
+  return new Promise((resolve43, reject) => {
+    const child = spawn24(cmd, args, {
+      env: { ...process.env, ...opts.env || {}, ...extraEnv },
+      stdio: ["ignore", "pipe", "pipe"]
+    });
+    let stdout = "";
+    let stderr = "";
+    let timedOut = false;
+    const timer = setTimeout(() => {
+      timedOut = true;
+      try {
+        child.kill("SIGTERM");
+      } catch {
+      }
+      setTimeout(() => {
+        try {
+          child.kill("SIGKILL");
+        } catch {
+        }
+      }, 2e3);
+    }, timeoutMs);
+    child.stdout.on("data", (d2) => {
+      stdout += d2.toString("utf-8");
+    });
+    child.stderr.on("data", (d2) => {
+      stderr += d2.toString("utf-8");
+    });
+    child.on("error", (e2) => {
+      clearTimeout(timer);
+      reject(e2);
+    });
+    child.on("close", (code8) => {
+      clearTimeout(timer);
+      if (timedOut) return reject(new Error(`graphical sudo timed out after ${timeoutMs}ms`));
+      resolve43({ code: code8 ?? -1, stdout, stderr, helper });
+    });
+  });
+}
+function shellQuote(s2) {
+  return "'" + s2.replace(/'/g, "'\\''") + "'";
+}
+var init_graphical_sudo = __esm({
+  "packages/cli/src/api/graphical-sudo.ts"() {
+    "use strict";
+  }
+});
+
 // packages/cli/src/api/routes-v1.ts
-import { existsSync as existsSync102, readFileSync as readFileSync83, readdirSync as readdirSync34, statSync as statSync34 } from "node:fs";
-import { join as join118, resolve as pathResolve2 } from "node:path";
+import { existsSync as existsSync103, readFileSync as readFileSync83, readdirSync as readdirSync34, statSync as statSync34 } from "node:fs";
+import { join as join119, resolve as pathResolve2 } from "node:path";
 import { homedir as homedir40 } from "node:os";
 async function tryRouteV1(ctx3) {
   const { pathname, method } = ctx3;
@@ -585859,6 +586020,9 @@ async function tryRouteV1(ctx3) {
   }
   if (pathname === "/v1/share/generate" && method === "POST") return handleGenerateShare(ctx3);
   if (pathname === "/v1/remote-proxy" && method === "POST") return handleRemoteProxy(ctx3);
+  if (pathname === "/v1/tor/status" && method === "GET") return handleTorStatus(ctx3);
+  if (pathname === "/v1/tor/enable" && method === "POST") return handleTorEnable(ctx3);
+  if (pathname === "/v1/tor/disable" && method === "POST") return handleTorDisable(ctx3);
   if (pathname === "/v1/tools" && method === "GET") {
     return handleListTools(ctx3);
   }
@@ -586005,11 +586169,11 @@ async function handleGetSkill(ctx3, name10) {
 async function fallbackDiscoverSkills() {
   return (_root) => {
     const roots = [
-      join118(homedir40(), ".local", "share", "ai-writing-guide")
+      join119(homedir40(), ".local", "share", "ai-writing-guide")
     ];
     const out = [];
     for (const root of roots) {
-      if (!existsSync102(root)) continue;
+      if (!existsSync103(root)) continue;
       walkForSkills(root, out, 0);
     }
     return out;
@@ -586020,7 +586184,7 @@ function walkForSkills(dir, out, depth) {
   try {
     for (const e2 of readdirSync34(dir, { withFileTypes: true })) {
       if (e2.name.startsWith(".") || e2.name === "node_modules") continue;
-      const p2 = join118(dir, e2.name);
+      const p2 = join119(dir, e2.name);
       if (e2.isDirectory()) {
         walkForSkills(p2, out, depth + 1);
       } else if (e2.isFile() && e2.name === "SKILL.md") {
@@ -586209,7 +586373,7 @@ async function getMemoryStores() {
   if (memoryInitTried) return null;
   memoryInitTried = true;
   try {
-    const dbPath = join118(homedir40(), ".open-agents", "memory.db");
+    const dbPath = join119(homedir40(), ".open-agents", "memory.db");
     const sharedDb = initDb(dbPath);
     memoryStoresCache = {
       episode: new EpisodeStore(dbPath),
@@ -586467,7 +586631,7 @@ async function handleFilesRead(ctx3) {
       }));
       return true;
     }
-    if (!existsSync102(resolved)) {
+    if (!existsSync103(resolved)) {
       sendProblem(res, problemDetails({
         type: P.notFound,
         status: 404,
@@ -586732,12 +586896,12 @@ async function handleNexusStatus(ctx3) {
   const { res, requestId } = ctx3;
   try {
     const statePaths = [
-      join118(process.cwd(), ".oa", "nexus-peer-state.json"),
-      join118(homedir40(), ".open-agents", "nexus-peer-cache.json")
+      join119(process.cwd(), ".oa", "nexus-peer-state.json"),
+      join119(homedir40(), ".open-agents", "nexus-peer-cache.json")
     ];
     const states = [];
     for (const p2 of statePaths) {
-      if (!existsSync102(p2)) continue;
+      if (!existsSync103(p2)) continue;
       try {
         const raw = readFileSync83(p2, "utf-8");
         states.push({ source: p2, data: JSON.parse(raw) });
@@ -586766,8 +586930,8 @@ async function handleNexusStatus(ctx3) {
 }
 function loadAgentName() {
   try {
-    const p2 = join118(homedir40(), ".open-agents", "agent-name");
-    if (existsSync102(p2)) return readFileSync83(p2, "utf-8").trim();
+    const p2 = join119(homedir40(), ".open-agents", "agent-name");
+    if (existsSync103(p2)) return readFileSync83(p2, "utf-8").trim();
   } catch {
   }
   return null;
@@ -586776,12 +586940,12 @@ async function handleSponsors(ctx3) {
   const { req: req2, res, url, requestId } = ctx3;
   try {
     const candidates = [
-      join118(homedir40(), ".open-agents", "sponsor-cache.json"),
-      join118(homedir40(), ".open-agents", "sponsors.json")
+      join119(homedir40(), ".open-agents", "sponsor-cache.json"),
+      join119(homedir40(), ".open-agents", "sponsors.json")
     ];
     let sponsors = [];
     for (const p2 of candidates) {
-      if (!existsSync102(p2)) continue;
+      if (!existsSync103(p2)) continue;
       try {
         const raw = JSON.parse(readFileSync83(p2, "utf-8"));
         if (Array.isArray(raw)) {
@@ -586852,8 +587016,8 @@ async function handleEvaluate(ctx3) {
       }));
       return true;
     }
-    const jobPath = join118(process.cwd(), ".oa", "jobs", `${runId}.json`);
-    if (!existsSync102(jobPath)) {
+    const jobPath = join119(process.cwd(), ".oa", "jobs", `${runId}.json`);
+    if (!existsSync103(jobPath)) {
       sendProblem(res, problemDetails({
         type: P.notFound,
         status: 404,
@@ -587000,23 +587164,211 @@ async function handleMintKey(ctx3) {
   }
   return true;
 }
+function _readStatusFile(p2) {
+  if (!existsSync103(p2)) return null;
+  try {
+    const data = JSON.parse(readFileSync83(p2, "utf-8"));
+    if (data?.connected && typeof data.peerId === "string" && data.peerId.length > 10) {
+      return {
+        peerId: data.peerId,
+        agentName: typeof data.agentName === "string" ? data.agentName : null,
+        source: p2
+      };
+    }
+  } catch {
+  }
+  return null;
+}
 function resolveLocalPeerId() {
+  const override = process.env["OA_NEXUS_DIR"];
+  if (override) {
+    const r2 = _readStatusFile(join119(override, "status.json"));
+    if (r2) return r2;
+  }
+  try {
+    const regPath = join119(homedir40(), ".open-agents", "nexus-registry.json");
+    if (existsSync103(regPath)) {
+      const reg = JSON.parse(readFileSync83(regPath, "utf-8"));
+      const entries = Array.isArray(reg?.dirs) ? reg.dirs : [];
+      for (const entry of entries) {
+        const dir = typeof entry === "string" ? entry : entry?.dir;
+        if (typeof dir === "string") {
+          const r2 = _readStatusFile(join119(dir, "status.json"));
+          if (r2) return r2;
+        }
+      }
+    }
+  } catch {
+  }
   const candidates = [
-    join118(process.cwd(), ".oa", "nexus", "status.json"),
-    join118(homedir40(), ".oa", "nexus", "status.json"),
-    join118(homedir40(), ".open-agents", "nexus", "status.json")
+    join119(process.cwd(), ".oa", "nexus", "status.json"),
+    join119(homedir40(), ".oa", "nexus", "status.json"),
+    join119(homedir40(), ".open-agents", "nexus", "status.json")
   ];
   for (const p2 of candidates) {
-    if (!existsSync102(p2)) continue;
-    try {
-      const data = JSON.parse(readFileSync83(p2, "utf-8"));
-      if (data?.connected && typeof data.peerId === "string" && data.peerId.length > 10) {
-        return { peerId: data.peerId, agentName: typeof data.agentName === "string" ? data.agentName : null, source: p2 };
+    const r2 = _readStatusFile(p2);
+    if (r2) return r2;
+  }
+  const now = Date.now();
+  if (_peerIdScanCache && now - _peerIdScanCache.ts < 6e4) {
+    return _peerIdScanCache.result;
+  }
+  let scanResult = null;
+  try {
+    const { execSync: execSync59 } = __require("node:child_process");
+    const cmd = `find "${homedir40()}" -maxdepth 4 -path '*/.oa/nexus/status.json' -type f 2>/dev/null | head -50`;
+    const out = execSync59(cmd, { encoding: "utf-8", timeout: 2e3 }).trim();
+    for (const line of out.split("\n")) {
+      const f2 = line.trim();
+      if (!f2) continue;
+      const r2 = _readStatusFile(f2);
+      if (r2) {
+        scanResult = r2;
+        break;
       }
-    } catch {
     }
+  } catch {
   }
-  return null;
+  _peerIdScanCache = { ts: now, result: scanResult };
+  return scanResult;
+}
+async function handleTorStatus(ctx3) {
+  const { res } = ctx3;
+  const { getLocalOnion: getLocalOnion2, torIsReachable: torIsReachable2 } = await Promise.resolve().then(() => (init_tor_fallback(), tor_fallback_exports));
+  const { detectSudoHelper: detectSudoHelper2 } = await Promise.resolve().then(() => (init_graphical_sudo(), graphical_sudo_exports));
+  const onion = getLocalOnion2();
+  const reachable = await torIsReachable2();
+  sendJson(res, 200, {
+    onion,
+    socks5_reachable: reachable,
+    sudo_helper: detectSudoHelper2()
+  });
+  return true;
+}
+async function handleTorEnable(ctx3) {
+  const { req: req2, res, requestId } = ctx3;
+  const reqAuth = req2;
+  if (reqAuth._authScope !== "admin") {
+    sendProblem(res, problemDetails({
+      type: P.forbidden,
+      status: 403,
+      title: "Admin scope required",
+      detail: "Tor setup requires elevated privileges; only admin keys can request it.",
+      instance: requestId
+    }));
+    return true;
+  }
+  const { getLocalOnion: getLocalOnion2 } = await Promise.resolve().then(() => (init_tor_fallback(), tor_fallback_exports));
+  if (getLocalOnion2()) {
+    sendJson(res, 409, {
+      status: "already_configured",
+      onion: getLocalOnion2(),
+      _note: "Tor hidden service already exists. Use /v1/tor/disable to remove."
+    });
+    return true;
+  }
+  let scriptPath2 = null;
+  try {
+    const candidates = [
+      join119(process.cwd(), "scripts", "tor", "tor_setup.sh"),
+      join119(__dirname, "..", "..", "scripts", "tor", "tor_setup.sh"),
+      join119(__dirname, "..", "scripts", "tor", "tor_setup.sh")
+    ];
+    for (const p2 of candidates) {
+      if (existsSync103(p2)) {
+        scriptPath2 = p2;
+        break;
+      }
+    }
+    if (!scriptPath2) {
+      const { execSync: execSync59 } = __require("node:child_process");
+      const root = execSync59("npm root -g", { encoding: "utf-8", timeout: 5e3 }).trim();
+      const p2 = join119(root, "open-agents-ai", "scripts", "tor", "tor_setup.sh");
+      if (existsSync103(p2)) scriptPath2 = p2;
+    }
+  } catch {
+  }
+  if (!scriptPath2) {
+    sendProblem(res, problemDetails({
+      type: P.internalError,
+      status: 500,
+      title: "tor_setup.sh not found",
+      detail: "Could not locate the bundled Tor setup script.",
+      instance: requestId
+    }));
+    return true;
+  }
+  const { detectSudoHelper: detectSudoHelper2, runGraphicalSudo: runGraphicalSudo2 } = await Promise.resolve().then(() => (init_graphical_sudo(), graphical_sudo_exports));
+  const helper = detectSudoHelper2();
+  if (!helper) {
+    sendProblem(res, problemDetails({
+      type: P.internalError,
+      status: 503,
+      title: "No graphical sudo helper",
+      detail: "Install one of: pkexec (PolKit), zenity, kdialog, or ssh-askpass — then retry.",
+      instance: requestId
+    }));
+    return true;
+  }
+  sendJson(res, 202, {
+    status: "accepted",
+    helper,
+    script: scriptPath2,
+    poll: "/v1/tor/status"
+  });
+  const apiPort = req2.socket?.localPort || parseInt(process.env["OA_API_PORT"] || "11435", 10);
+  runGraphicalSudo2({
+    scriptPath: scriptPath2,
+    env: { OA_API_PORT: String(apiPort) },
+    description: "Open Agents needs admin access to install Tor and configure a hidden service"
+  }).then((r2) => {
+    if (r2.code !== 0) {
+      console.warn(`[tor-enable] sudo helper ${r2.helper} exited ${r2.code}: ${r2.stderr.slice(-300)}`);
+    }
+  }).catch((e2) => {
+    console.warn(`[tor-enable] failed: ${e2 instanceof Error ? e2.message : String(e2)}`);
+  });
+  return true;
+}
+async function handleTorDisable(ctx3) {
+  const { req: req2, res, requestId } = ctx3;
+  const reqAuth = req2;
+  if (reqAuth._authScope !== "admin") {
+    sendProblem(res, problemDetails({
+      type: P.forbidden,
+      status: 403,
+      title: "Admin scope required",
+      detail: "Tor teardown requires admin scope.",
+      instance: requestId
+    }));
+    return true;
+  }
+  let scriptPath2 = null;
+  const candidates = [
+    join119(process.cwd(), "scripts", "tor", "destroy_tor.sh"),
+    join119(__dirname, "..", "..", "scripts", "tor", "destroy_tor.sh"),
+    join119(__dirname, "..", "scripts", "tor", "destroy_tor.sh")
+  ];
+  for (const p2 of candidates) {
+    if (existsSync103(p2)) {
+      scriptPath2 = p2;
+      break;
+    }
+  }
+  if (!scriptPath2) {
+    sendProblem(res, problemDetails({
+      type: P.internalError,
+      status: 500,
+      title: "destroy_tor.sh not found",
+      detail: "Bundled teardown script missing.",
+      instance: requestId
+    }));
+    return true;
+  }
+  const { runGraphicalSudo: runGraphicalSudo2 } = await Promise.resolve().then(() => (init_graphical_sudo(), graphical_sudo_exports));
+  sendJson(res, 202, { status: "accepted", script: scriptPath2 });
+  runGraphicalSudo2({ scriptPath: scriptPath2, description: "Open Agents needs admin access to remove the Tor hidden service" }).catch((e2) => console.warn(`[tor-disable] failed: ${e2 instanceof Error ? e2.message : String(e2)}`));
+  return true;
 }
 async function handleGenerateShare(ctx3) {
   const { req: req2, res, requestId } = ctx3;
@@ -587085,9 +587437,11 @@ async function handleGenerateShare(ctx3) {
     if (onion) plainParams.push(`oa-onion=${encodeURIComponent(onion)}`);
     plainParams.push(`oa-share-label=${encodeURIComponent(label)}`);
     const plainUrl = `${scheme}://${hostPort}/?${plainParams.join("&")}`;
+    const torShareUrl = onion ? `oa-share-tor://${onion}#${fullKey}` : null;
     sendJson(res, 201, {
       shareUrl,
       plainUrl,
+      torShareUrl,
       mode,
       peerId: peerInfo?.peerId || null,
       onion: onion || null,
@@ -587103,7 +587457,7 @@ async function handleGenerateShare(ctx3) {
         tor: !!onion,
         direct: !peerInfo
       },
-      _note: peerInfo && onion ? "Globally reachable via libp2p (primary) and Tor (.onion fallback)." : peerInfo ? "Globally reachable via libp2p. For maximum reach add Tor: see scripts/tor/tor_setup.sh." : "Nexus daemon offline — URL is direct-HTTP only (LAN/VPN reach). Start nexus for global reach."
+      _note: peerInfo && onion ? "Globally reachable via libp2p (primary) and Tor (.onion fallback)." : peerInfo ? "Globally reachable via libp2p. For maximum reach add Tor: run `oa tor enable`." : onion ? "Globally reachable via Tor only (.onion). Start nexus for libp2p tier." : "Nexus offline + no Tor — URL is direct-HTTP only (LAN/VPN reach)."
     });
   } catch (err) {
     sendProblem(res, problemDetails({
@@ -587161,13 +587515,13 @@ async function handleRemoteProxy(ctx3) {
     return true;
   }
   const nexusCandidates = [
-    join118(process.cwd(), ".oa", "nexus"),
-    join118(homedir40(), ".oa", "nexus"),
-    join118(homedir40(), ".open-agents", "nexus")
+    join119(process.cwd(), ".oa", "nexus"),
+    join119(homedir40(), ".oa", "nexus"),
+    join119(homedir40(), ".open-agents", "nexus")
   ];
   let nexusDirPath = null;
   for (const p2 of nexusCandidates) {
-    if (existsSync102(join118(p2, "status.json"))) {
+    if (existsSync103(join119(p2, "status.json"))) {
       nexusDirPath = p2;
       break;
     }
@@ -587263,7 +587617,7 @@ async function handleRemoteProxy(ctx3) {
     }));
     return true;
   }
-  const streamFile = join118(nexusDirPath, `tunnel-${requestId}-${Date.now()}.jsonl`);
+  const streamFile = join119(nexusDirPath, `tunnel-${requestId}-${Date.now()}.jsonl`);
   try {
     const { writeFileSync: _wfs } = await import("node:fs");
     _wfs(streamFile, "");
@@ -587706,14 +588060,14 @@ async function handleListEngines(ctx3) {
   const home = homedir40();
   sendJson(res, 200, {
     engines: [
-      { name: "dream", state_file: join118(process.cwd(), ".oa", "dreams"), controllable_via: "SSE + slash commands" },
-      { name: "bless", state_file: join118(process.cwd(), ".oa", "bless-state.json"), controllable_via: "slash commands" },
-      { name: "call", state_file: join118(process.cwd(), ".oa", "call-state.json"), controllable_via: "slash commands" },
-      { name: "listen", state_file: join118(process.cwd(), ".oa", "listen-state.json"), controllable_via: "slash commands" },
-      { name: "telegram", state_file: join118(home, ".open-agents", "telegram-state.json"), controllable_via: "slash commands" },
-      { name: "expose", state_file: join118(process.cwd(), ".oa", "expose-state.json"), controllable_via: "/expose commands" },
-      { name: "nexus", state_file: join118(home, ".open-agents", "nexus-peer-cache.json"), controllable_via: "/nexus commands" },
-      { name: "ipfs", state_file: join118(process.cwd(), ".oa", "ipfs"), controllable_via: "slash commands" }
+      { name: "dream", state_file: join119(process.cwd(), ".oa", "dreams"), controllable_via: "SSE + slash commands" },
+      { name: "bless", state_file: join119(process.cwd(), ".oa", "bless-state.json"), controllable_via: "slash commands" },
+      { name: "call", state_file: join119(process.cwd(), ".oa", "call-state.json"), controllable_via: "slash commands" },
+      { name: "listen", state_file: join119(process.cwd(), ".oa", "listen-state.json"), controllable_via: "slash commands" },
+      { name: "telegram", state_file: join119(home, ".open-agents", "telegram-state.json"), controllable_via: "slash commands" },
+      { name: "expose", state_file: join119(process.cwd(), ".oa", "expose-state.json"), controllable_via: "/expose commands" },
+      { name: "nexus", state_file: join119(home, ".open-agents", "nexus-peer-cache.json"), controllable_via: "/nexus commands" },
+      { name: "ipfs", state_file: join119(process.cwd(), ".oa", "ipfs"), controllable_via: "slash commands" }
     ],
     note: "Engine instrumentation lives in the running TUI process. Full status + control requires the daemon↔TUI bridge (PT-07). See parity audit WO-PARITY-04."
   });
@@ -587796,21 +588150,21 @@ async function tryAimsRoute(ctx3) {
   return false;
 }
 function aimsDir() {
-  return join118(homedir40(), ".open-agents", "aims");
+  return join119(homedir40(), ".open-agents", "aims");
 }
 function readAimsFile(name10, fallback) {
   try {
-    const p2 = join118(aimsDir(), name10);
-    if (existsSync102(p2)) return JSON.parse(readFileSync83(p2, "utf-8"));
+    const p2 = join119(aimsDir(), name10);
+    if (existsSync103(p2)) return JSON.parse(readFileSync83(p2, "utf-8"));
   } catch {
   }
   return fallback;
 }
 function writeAimsFile(name10, data) {
   const dir = aimsDir();
-  const { mkdirSync: mkdirSync67, writeFileSync: wf, renameSync: rn } = __require("node:fs");
-  mkdirSync67(dir, { recursive: true });
-  const finalPath = join118(dir, name10);
+  const { mkdirSync: mkdirSync68, writeFileSync: wf, renameSync: rn } = __require("node:fs");
+  mkdirSync68(dir, { recursive: true });
+  const finalPath = join119(dir, name10);
   const tmpPath = `${finalPath}.tmp.${process.pid}.${Date.now()}`;
   try {
     wf(tmpPath, JSON.stringify(data, null, 2) + "\n", { encoding: "utf-8", mode: 384 });
@@ -588140,10 +588494,10 @@ async function handleAimsSuppliers(ctx3) {
       }
     ];
     const sponsorPaths = [
-      join118(homedir40(), ".open-agents", "sponsor-cache.json")
+      join119(homedir40(), ".open-agents", "sponsor-cache.json")
     ];
     for (const p2 of sponsorPaths) {
-      if (!existsSync102(p2)) continue;
+      if (!existsSync103(p2)) continue;
       try {
         const raw = JSON.parse(readFileSync83(p2, "utf-8"));
         const list = Array.isArray(raw) ? raw : raw?.sponsors ?? [];
@@ -588287,7 +588641,7 @@ async function handleAimsConfigHistory(ctx3) {
     return true;
   }
 }
-var PROBLEM_BASE, P, mcpManagerCache, memoryStoresCache, memoryInitTried, FILE_READ_MAX_BYTES, _aimsLocks;
+var PROBLEM_BASE, P, mcpManagerCache, memoryStoresCache, memoryInitTried, FILE_READ_MAX_BYTES, _peerIdScanCache, _aimsLocks;
 var init_routes_v1 = __esm({
   "packages/cli/src/api/routes-v1.ts"() {
     "use strict";
@@ -588313,6 +588667,7 @@ var init_routes_v1 = __esm({
     memoryStoresCache = null;
     memoryInitTried = false;
     FILE_READ_MAX_BYTES = 2 * 1024 * 1024;
+    _peerIdScanCache = null;
     _aimsLocks = /* @__PURE__ */ new Map();
   }
 });
@@ -591669,6 +592024,19 @@ function _looksLikePeerId(s) {
 function parseShareInput(raw) {
   const v = String(raw || '').trim();
   if (!v) return null;
+  // oa-share-tor scheme — Tor-only routing via SOCKS5 to <onion>:80
+  if (v.toLowerCase().startsWith('oa-share-tor://')) {
+    const after = v.slice('oa-share-tor://'.length);
+    const hashIdx = after.indexOf('#');
+    if (hashIdx < 0) return null;
+    const onionRaw = after.slice(0, hashIdx);
+    // Strip optional :port suffix; we always dial 80 since hidden services
+    // are configured to forward 80 → local API per the leek_messenger setup.
+    const onion = onionRaw.split(':')[0];
+    const key = after.slice(hashIdx + 1);
+    if (!onion.endsWith('.onion') || !key) return null;
+    return { peerId: null, onion, host: null, key, scheme: 'tor' };
+  }
   // oa-share scheme — custom parser since URL() doesn't always honor it.
   if (v.toLowerCase().startsWith('oa-share://')) {
     const after = v.slice('oa-share://'.length);
@@ -591829,10 +592197,25 @@ async function generateShareUrl() {
     const j = await r.json();
     const safeShare = escapeHtml(j.shareUrl || '');
     const safePlain = escapeHtml(j.plainUrl || '');
+    const safeTor = escapeHtml(j.torShareUrl || '');
+    const torRow = j.torShareUrl
+      ? '<div style="margin:6px 0">' +
+          '<label style="display:block;font-size:0.7rem;color:var(--color-fg-muted);margin-bottom:2px">tor-only URL (.onion routed via SOCKS5 — works through any firewall)</label>' +
+          '<div style="display:flex;gap:6px;align-items:center">' +
+            '<input readonly value="' + safeTor + '" style="flex:1;background:var(--color-bg-input);border:1px solid var(--color-border);color:var(--color-fg);padding:5px 8px;border-radius:var(--radius-sm);font-family:var(--font-mono);font-size:0.74rem">' +
+            '<button type="button" onclick="copyShareUrl(\\'tor\\')" style="font-size:0.74rem">copy</button>' +
+          '</div>' +
+        '</div>'
+      : '<div style="margin:8px 0;padding:8px;background:var(--color-bg-input);border:1px dashed var(--color-border);border-radius:var(--radius-sm)">' +
+          '<div style="font-size:0.74rem;margin-bottom:4px">Tor (.onion) is not configured on this OA.</div>' +
+          '<div style="font-size:0.68rem;color:var(--color-fg-muted);margin-bottom:6px">Enable Tor for global reach when libp2p fails. Asks for sudo via your system password dialog.</div>' +
+          '<button type="button" onclick="enableTorShare()" style="font-size:0.74rem;background:var(--color-accent);color:#fff;border:none;padding:4px 12px;border-radius:var(--radius-sm);cursor:pointer">enable Tor</button>' +
+          '<span id="enable-tor-status" style="font-size:0.68rem;margin-left:8px;color:var(--color-fg-muted)"></span>' +
+        '</div>';
     out.innerHTML =
       '<div style="font-weight:500;margin-bottom:6px;color:var(--color-success)">✓ Share URL generated — hand off to remote</div>' +
       '<div style="margin:6px 0">' +
-        '<label style="display:block;font-size:0.7rem;color:var(--color-fg-muted);margin-bottom:2px">oa-share URL (compact, recommended for OA-to-OA)</label>' +
+        '<label style="display:block;font-size:0.7rem;color:var(--color-fg-muted);margin-bottom:2px">oa-share URL (libp2p, compact, recommended for OA-to-OA)</label>' +
         '<div style="display:flex;gap:6px;align-items:center">' +
           '<input readonly value="' + safeShare + '" style="flex:1;background:var(--color-bg-input);border:1px solid var(--color-border);color:var(--color-fg);padding:5px 8px;border-radius:var(--radius-sm);font-family:var(--font-mono);font-size:0.74rem">' +
           '<button type="button" onclick="copyShareUrl(\\'oa-share\\')" style="font-size:0.74rem">copy</button>' +
@@ -591845,17 +592228,22 @@ async function generateShareUrl() {
           '<button type="button" onclick="copyShareUrl(\\'plain\\')" style="font-size:0.74rem">copy</button>' +
         '</div>' +
       '</div>' +
-      '<p style="font-size:0.68rem;color:var(--color-fg-muted);margin:6px 0 0">Note: this URL contains the full secret. Anyone with it can use this OA. To revoke: open Advanced settings → keys → revoke the prefix <code>' + escapeHtml(j.keyPrefix || '') + '</code>.</p>';
+      torRow +
+      '<p style="font-size:0.68rem;color:var(--color-fg-muted);margin:6px 0 0">Note: these URLs contain the full secret. Anyone with one can use this OA. To revoke: Advanced settings → keys → revoke prefix <code>' + escapeHtml(j.keyPrefix || '') + '</code>.</p>';
     // Stash for the copy buttons + add to recent.
     window.__oaLastShareUrl = j.shareUrl;
     window.__oaLastPlainUrl = j.plainUrl;
+    window.__oaLastTorUrl = j.torShareUrl || null;
     saveRecentKey({ key: j.key, host: j.host + ':' + j.port, label: j.label || ('shared ' + j.host) });
   } catch (e) {
     out.innerHTML = '<div style="color:var(--color-error)">✗ ' + escapeHtml(e && e.message ? e.message : String(e)) + '</div>';
   }
 }
 function copyShareUrl(which) {
-  const v = which === 'plain' ? window.__oaLastPlainUrl : window.__oaLastShareUrl;
+  let v;
+  if (which === 'plain') v = window.__oaLastPlainUrl;
+  else if (which === 'tor') v = window.__oaLastTorUrl;
+  else v = window.__oaLastShareUrl;
   if (!v) return;
   if (navigator.clipboard && navigator.clipboard.writeText) {
     navigator.clipboard.writeText(v).then(
@@ -591875,6 +592263,46 @@ function fallbackCopy(v) {
 window.generateShareUrl = generateShareUrl;
 window.copyShareUrl = copyShareUrl;
 
+// ─── Enable Tor (graphical sudo) ────────────────────────────────────────
+async function enableTorShare() {
+  const status = document.getElementById('enable-tor-status');
+  if (status) { status.textContent = 'launching graphical sudo prompt…'; status.style.color = 'var(--color-fg-muted)'; }
+  try {
+    const r = await fetch('/v1/tor/enable', {
+      method: 'POST',
+      headers: { ...headers(), 'Content-Type': 'application/json' },
+      body: '{}',
+    });
+    const j = await r.json().catch(() => ({}));
+    if (r.status === 202) {
+      if (status) {
+        status.textContent = 'started — waiting for hidden service…';
+        status.style.color = 'var(--color-accent)';
+      }
+      // Poll up to 90s for the .onion to appear
+      for (let i = 0; i < 30; i++) {
+        await new Promise(r => setTimeout(r, 3000));
+        const s = await fetch('/v1/tor/status', { headers: headers() }).then(x => x.json()).catch(() => ({}));
+        if (s.onion) {
+          if (status) { status.textContent = '✓ Tor enabled: ' + s.onion; status.style.color = 'var(--color-success)'; }
+          // Re-generate share URL to pick up the .onion field
+          setTimeout(() => generateShareUrl(), 500);
+          return;
+        }
+      }
+      if (status) { status.textContent = '⚠ setup ran but no .onion appeared. Check journalctl -u tor for errors.'; status.style.color = 'var(--color-warning)'; }
+    } else if (r.status === 409) {
+      if (status) { status.textContent = '✓ already enabled — re-generating'; status.style.color = 'var(--color-success)'; }
+      setTimeout(() => generateShareUrl(), 500);
+    } else {
+      if (status) { status.textContent = '✗ ' + (j.detail || ('HTTP ' + r.status)); status.style.color = 'var(--color-error)'; }
+    }
+  } catch (e) {
+    if (status) { status.textContent = '✗ ' + (e && e.message ? e.message : String(e)); status.style.color = 'var(--color-error)'; }
+  }
+}
+window.enableTorShare = enableTorShare;
+
 // ─── Remote-state helpers (visual indicator on the key button) ───────
 // When localStorage carries oa.remoteHost we are in REMOTE mode: the
 // key was loaded from an oa-share URL or via on-load ?oa-key=. The key
@@ -596752,14 +597180,14 @@ var init_auth_oidc = __esm({
 });
 
 // packages/cli/src/api/usage-tracker.ts
-import { mkdirSync as mkdirSync60, readFileSync as readFileSync84, writeFileSync as writeFileSync52, existsSync as existsSync103 } from "node:fs";
-import { join as join119 } from "node:path";
+import { mkdirSync as mkdirSync61, readFileSync as readFileSync84, writeFileSync as writeFileSync53, existsSync as existsSync104 } from "node:fs";
+import { join as join120 } from "node:path";
 function initUsageTracker(oaDir) {
-  const dir = join119(oaDir, "usage");
-  mkdirSync60(dir, { recursive: true });
-  usageFile = join119(dir, "token-usage.json");
+  const dir = join120(oaDir, "usage");
+  mkdirSync61(dir, { recursive: true });
+  usageFile = join120(dir, "token-usage.json");
   try {
-    if (existsSync103(usageFile)) {
+    if (existsSync104(usageFile)) {
       store = JSON.parse(readFileSync84(usageFile, "utf-8"));
     }
   } catch {
@@ -596796,7 +597224,7 @@ function flush2() {
   if (!initialized2 || !dirty) return;
   try {
     store.lastSaved = (/* @__PURE__ */ new Date()).toISOString();
-    writeFileSync52(usageFile, JSON.stringify(store, null, 2), "utf-8");
+    writeFileSync53(usageFile, JSON.stringify(store, null, 2), "utf-8");
     dirty = false;
   } catch {
   }
@@ -596824,24 +597252,24 @@ var init_usage_tracker = __esm({
 });
 
 // packages/cli/src/api/profiles.ts
-import { existsSync as existsSync104, readFileSync as readFileSync85, writeFileSync as writeFileSync53, mkdirSync as mkdirSync61, readdirSync as readdirSync35, unlinkSync as unlinkSync23 } from "node:fs";
-import { join as join120 } from "node:path";
+import { existsSync as existsSync105, readFileSync as readFileSync85, writeFileSync as writeFileSync54, mkdirSync as mkdirSync62, readdirSync as readdirSync35, unlinkSync as unlinkSync23 } from "node:fs";
+import { join as join121 } from "node:path";
 import { homedir as homedir41 } from "node:os";
 import { createCipheriv as createCipheriv4, createDecipheriv as createDecipheriv4, randomBytes as randomBytes22, scryptSync as scryptSync3 } from "node:crypto";
 function globalProfileDir() {
-  return join120(homedir41(), ".open-agents", "profiles");
+  return join121(homedir41(), ".open-agents", "profiles");
 }
 function projectProfileDir(projectDir2) {
-  return join120(projectDir2 || process.cwd(), ".oa", "profiles");
+  return join121(projectDir2 || process.cwd(), ".oa", "profiles");
 }
 function listProfiles(projectDir2) {
   const result = [];
   const seen = /* @__PURE__ */ new Set();
   const projDir = projectProfileDir(projectDir2);
-  if (existsSync104(projDir)) {
+  if (existsSync105(projDir)) {
     for (const f2 of readdirSync35(projDir).filter((f3) => f3.endsWith(".json"))) {
       try {
-        const raw = JSON.parse(readFileSync85(join120(projDir, f2), "utf8"));
+        const raw = JSON.parse(readFileSync85(join121(projDir, f2), "utf8"));
         const name10 = f2.replace(".json", "");
         seen.add(name10);
         result.push({
@@ -596855,12 +597283,12 @@ function listProfiles(projectDir2) {
     }
   }
   const globDir = globalProfileDir();
-  if (existsSync104(globDir)) {
+  if (existsSync105(globDir)) {
     for (const f2 of readdirSync35(globDir).filter((f3) => f3.endsWith(".json"))) {
       const name10 = f2.replace(".json", "");
       if (seen.has(name10)) continue;
       try {
-        const raw = JSON.parse(readFileSync85(join120(globDir, f2), "utf8"));
+        const raw = JSON.parse(readFileSync85(join121(globDir, f2), "utf8"));
         result.push({
           name: name10,
           description: raw.description || "",
@@ -596875,9 +597303,9 @@ function listProfiles(projectDir2) {
 }
 function loadProfile(name10, password, projectDir2) {
   const sanitized = name10.replace(/[^a-zA-Z0-9_-]/g, "");
-  const projPath = join120(projectProfileDir(projectDir2), `${sanitized}.json`);
-  const globPath = join120(globalProfileDir(), `${sanitized}.json`);
-  const filePath = existsSync104(projPath) ? projPath : existsSync104(globPath) ? globPath : null;
+  const projPath = join121(projectProfileDir(projectDir2), `${sanitized}.json`);
+  const globPath = join121(globalProfileDir(), `${sanitized}.json`);
+  const filePath = existsSync105(projPath) ? projPath : existsSync105(globPath) ? globPath : null;
   if (!filePath) return null;
   const raw = JSON.parse(readFileSync85(filePath, "utf8"));
   if (raw.encrypted === true) {
@@ -596888,23 +597316,23 @@ function loadProfile(name10, password, projectDir2) {
 }
 function saveProfile(profile, password, scope = "global", projectDir2) {
   const dir = scope === "project" ? projectProfileDir(projectDir2) : globalProfileDir();
-  mkdirSync61(dir, { recursive: true });
+  mkdirSync62(dir, { recursive: true });
   const sanitized = profile.name.replace(/[^a-zA-Z0-9_-]/g, "");
-  const filePath = join120(dir, `${sanitized}.json`);
+  const filePath = join121(dir, `${sanitized}.json`);
   profile.modified = (/* @__PURE__ */ new Date()).toISOString();
   if (password) {
     const encrypted = encryptProfile(profile, password);
-    writeFileSync53(filePath, JSON.stringify(encrypted, null, 2), { mode: 384 });
+    writeFileSync54(filePath, JSON.stringify(encrypted, null, 2), { mode: 384 });
   } else {
     profile.encrypted = false;
-    writeFileSync53(filePath, JSON.stringify(profile, null, 2), { mode: 420 });
+    writeFileSync54(filePath, JSON.stringify(profile, null, 2), { mode: 420 });
   }
 }
 function deleteProfile(name10, scope = "global", projectDir2) {
   const sanitized = name10.replace(/[^a-zA-Z0-9_-]/g, "");
   const dir = scope === "project" ? projectProfileDir(projectDir2) : globalProfileDir();
-  const filePath = join120(dir, `${sanitized}.json`);
-  if (existsSync104(filePath)) {
+  const filePath = join121(dir, `${sanitized}.json`);
+  if (existsSync105(filePath)) {
     unlinkSync23(filePath);
     return true;
   }
@@ -597018,24 +597446,24 @@ var init_profiles = __esm({
 });
 
 // packages/cli/src/docker.ts
-import { execSync as execSync56, spawn as spawn24 } from "node:child_process";
-import { existsSync as existsSync105, mkdirSync as mkdirSync62, writeFileSync as writeFileSync54 } from "node:fs";
-import { join as join121, resolve as resolve37, dirname as dirname35 } from "node:path";
+import { execSync as execSync56, spawn as spawn25 } from "node:child_process";
+import { existsSync as existsSync106, mkdirSync as mkdirSync63, writeFileSync as writeFileSync55 } from "node:fs";
+import { join as join122, resolve as resolve37, dirname as dirname35 } from "node:path";
 import { homedir as homedir42 } from "node:os";
 import { fileURLToPath as fileURLToPath16 } from "node:url";
 function getDockerDir() {
   try {
     if (typeof __dirname !== "undefined") {
-      return join121(__dirname, "..", "..", "..", "docker");
+      return join122(__dirname, "..", "..", "..", "docker");
     }
   } catch {
   }
   try {
     const thisDir = dirname35(fileURLToPath16(import.meta.url));
-    return join121(thisDir, "..", "..", "..", "docker");
+    return join122(thisDir, "..", "..", "..", "docker");
   } catch {
   }
-  return join121(process.cwd(), "docker");
+  return join122(process.cwd(), "docker");
 }
 function isDockerAvailable() {
   try {
@@ -597166,11 +597594,11 @@ async function ensureOaImage(force = false) {
   }
   let buildContext;
   const dockerDir = getDockerDir();
-  if (existsSync105(join121(dockerDir, "Dockerfile"))) {
+  if (existsSync106(join122(dockerDir, "Dockerfile"))) {
     buildContext = dockerDir;
   } else {
-    buildContext = join121(homedir42(), ".oa", "docker-build");
-    mkdirSync62(buildContext, { recursive: true });
+    buildContext = join122(homedir42(), ".oa", "docker-build");
+    mkdirSync63(buildContext, { recursive: true });
     writeDockerfiles(buildContext);
   }
   try {
@@ -597244,8 +597672,8 @@ chown -R node:node /workspace /home/node/.oa /home/node/.open-agents 2>/dev/null
 if [ "$1" = "oa" ]; then shift; exec su - node -c "cd /workspace && oa $*"; fi
 exec "$@"
 `;
-  writeFileSync54(join121(dir, "Dockerfile"), dockerfile);
-  writeFileSync54(join121(dir, "docker-entrypoint.sh"), entrypoint, { mode: 493 });
+  writeFileSync55(join122(dir, "Dockerfile"), dockerfile);
+  writeFileSync55(join122(dir, "docker-entrypoint.sh"), entrypoint, { mode: 493 });
 }
 function hasNvidiaGpu() {
   try {
@@ -597299,7 +597727,7 @@ function runInContainer(opts) {
   if (opts.maxTurns) oaArgs.push("--max-turns", String(opts.maxTurns));
   if (opts.timeoutS) oaArgs.push("--timeout", String(opts.timeoutS));
   args.push(...oaArgs);
-  return spawn24("docker", args, {
+  return spawn25("docker", args, {
     stdio: ["ignore", "pipe", "pipe"]
   });
 }
@@ -597498,23 +597926,23 @@ import * as http5 from "node:http";
 import * as https3 from "node:https";
 import { createRequire as createRequire5 } from "node:module";
 import { fileURLToPath as fileURLToPath17 } from "node:url";
-import { dirname as dirname36, join as join122, resolve as resolve38 } from "node:path";
+import { dirname as dirname36, join as join123, resolve as resolve38 } from "node:path";
 import { homedir as homedir43 } from "node:os";
-import { spawn as spawn25, execSync as execSync57 } from "node:child_process";
-import { mkdirSync as mkdirSync63, writeFileSync as writeFileSync55, readFileSync as readFileSync86, readdirSync as readdirSync36, existsSync as existsSync106, watch as fsWatch3, renameSync as renameSync8, unlinkSync as unlinkSync24 } from "node:fs";
+import { spawn as spawn26, execSync as execSync57 } from "node:child_process";
+import { mkdirSync as mkdirSync64, writeFileSync as writeFileSync56, readFileSync as readFileSync86, readdirSync as readdirSync36, existsSync as existsSync107, watch as fsWatch3, renameSync as renameSync8, unlinkSync as unlinkSync24 } from "node:fs";
 import { randomBytes as randomBytes23, randomUUID as randomUUID16 } from "node:crypto";
 import { createHash as createHash19 } from "node:crypto";
 function getVersion3() {
   try {
     const thisDir = dirname36(fileURLToPath17(import.meta.url));
     const candidates = [
-      join122(thisDir, "..", "package.json"),
-      join122(thisDir, "..", "..", "package.json"),
-      join122(thisDir, "..", "..", "..", "package.json")
+      join123(thisDir, "..", "package.json"),
+      join123(thisDir, "..", "..", "package.json"),
+      join123(thisDir, "..", "..", "..", "package.json")
     ];
     for (const pkgPath of candidates) {
       try {
-        if (!existsSync106(pkgPath)) continue;
+        if (!existsSync107(pkgPath)) continue;
         const pkg = require3(pkgPath);
         if (pkg.name === "open-agents-ai" || pkg.name === "@open-agents/cli" || pkg.name === "@open-agents/monorepo") {
           return pkg.version ?? "0.0.0";
@@ -597716,8 +598144,8 @@ function isOriginAllowed(origin) {
   if (!origin) return true;
   let accessMode = (process.env["OA_ACCESS"] || "").toLowerCase().trim();
   try {
-    const accessFile = join122(homedir43(), ".open-agents", "access");
-    if (existsSync106(accessFile)) {
+    const accessFile = join123(homedir43(), ".open-agents", "access");
+    if (existsSync107(accessFile)) {
       const persisted = readFileSync86(accessFile, "utf8").trim().toLowerCase();
       if (persisted === "any" || persisted === "lan" || persisted === "loopback") {
         accessMode = persisted;
@@ -597778,7 +598206,7 @@ async function retrieveMemoryContext(userMessage, sessionId, maxEpisodes = 5) {
     if (!memMod || !memMod.EpisodeStore) {
       return { contextBlock: "", retrieved: [] };
     }
-    const dbPath = join122(homedir43(), ".open-agents", "memory.db");
+    const dbPath = join123(homedir43(), ".open-agents", "memory.db");
     const store2 = new memMod.EpisodeStore(dbPath);
     const recent = store2.search({ limit: 30, sessionId: void 0 }) ?? [];
     const qLower = userMessage.toLowerCase();
@@ -597821,7 +598249,7 @@ async function writeMemoryEpisodes(sessionId, userMessage, assistantContent, too
   try {
     const memMod = await Promise.resolve().then(() => (init_dist7(), dist_exports2)).catch(() => null);
     if (!memMod || !memMod.EpisodeStore) return 0;
-    const dbPath = join122(homedir43(), ".open-agents", "memory.db");
+    const dbPath = join123(homedir43(), ".open-agents", "memory.db");
     const store2 = new memMod.EpisodeStore(dbPath);
     let written = 0;
     try {
@@ -598143,13 +598571,13 @@ function ollamaStream(ollamaUrl, path8, method, body, onData, onEnd, onError, ti
 }
 function jobsDir() {
   const root = resolve38(process.cwd());
-  const dir = join122(root, ".oa", "jobs");
-  mkdirSync63(dir, { recursive: true });
+  const dir = join123(root, ".oa", "jobs");
+  mkdirSync64(dir, { recursive: true });
   return dir;
 }
 function loadJob(id) {
-  const file = join122(jobsDir(), `${id}.json`);
-  if (!existsSync106(file)) return null;
+  const file = join123(jobsDir(), `${id}.json`);
+  if (!existsSync107(file)) return null;
   try {
     return JSON.parse(readFileSync86(file, "utf-8"));
   } catch {
@@ -598158,12 +598586,12 @@ function loadJob(id) {
 }
 function listJobs() {
   const dir = jobsDir();
-  if (!existsSync106(dir)) return [];
+  if (!existsSync107(dir)) return [];
   const files = readdirSync36(dir).filter((f2) => f2.endsWith(".json")).sort();
   const jobs = [];
   for (const file of files) {
     try {
-      jobs.push(JSON.parse(readFileSync86(join122(dir, file), "utf-8")));
+      jobs.push(JSON.parse(readFileSync86(join123(dir, file), "utf-8")));
     } catch {
     }
   }
@@ -598173,12 +598601,12 @@ function pruneOldJobs() {
   const retentionH = parseFloat(process.env["OA_RUN_RETENTION_H"] || "24");
   const cutoffMs = Date.now() - (Number.isFinite(retentionH) && retentionH > 0 ? retentionH : 24) * 36e5;
   const dir = jobsDir();
-  if (!existsSync106(dir)) return { pruned: 0, kept: 0 };
+  if (!existsSync107(dir)) return { pruned: 0, kept: 0 };
   let pruned = 0;
   let kept = 0;
   for (const file of readdirSync36(dir)) {
     if (!file.endsWith(".json")) continue;
-    const path8 = join122(dir, file);
+    const path8 = join123(dir, file);
     try {
       const job = JSON.parse(readFileSync86(path8, "utf-8"));
       if (job.status === "running") {
@@ -598193,7 +598621,7 @@ function pruneOldJobs() {
         } catch {
         }
         const outFile = path8.replace(/\.json$/, ".output");
-        if (existsSync106(outFile)) {
+        if (existsSync107(outFile)) {
           try {
             unlinkSync24(outFile);
           } catch {
@@ -598486,14 +598914,14 @@ function autoSeedTodosFromPrompt(prompt) {
   return [];
 }
 function atomicJobWrite(dir, id, job) {
-  const finalPath = join122(dir, `${id}.json`);
+  const finalPath = join123(dir, `${id}.json`);
   const tmpPath = `${finalPath}.tmp.${process.pid}.${Date.now()}`;
   try {
-    writeFileSync55(tmpPath, JSON.stringify(job, null, 2), "utf-8");
+    writeFileSync56(tmpPath, JSON.stringify(job, null, 2), "utf-8");
     renameSync8(tmpPath, finalPath);
   } catch {
     try {
-      writeFileSync55(finalPath, JSON.stringify(job, null, 2), "utf-8");
+      writeFileSync56(finalPath, JSON.stringify(job, null, 2), "utf-8");
     } catch {
     }
     try {
@@ -599695,7 +600123,7 @@ ${task}` : task;
   runEnv["OA_RUN_SCOPE"] = req2._authScope || "admin";
   runEnv["OLLAMA_HOST"] = currentCfg.backendUrl || process.env["OLLAMA_HOST"] || "http://127.0.0.1:11434";
   if (currentCfg.apiKey) runEnv["OA_API_KEY_INHERIT"] = currentCfg.apiKey;
-  const child = spawn25(process.execPath, [oaBin, ...args], {
+  const child = spawn26(process.execPath, [oaBin, ...args], {
     cwd: resolve38(process.cwd()),
     env: runEnv,
     stdio: ["ignore", "pipe", "pipe"]
@@ -599912,15 +600340,15 @@ ${task}` : task;
   });
 }
 function updateStateFile() {
-  return join122(homedir43(), ".open-agents", "update-state.json");
+  return join123(homedir43(), ".open-agents", "update-state.json");
 }
 function updateLogPath() {
-  return join122(homedir43(), ".open-agents", "update.log");
+  return join123(homedir43(), ".open-agents", "update.log");
 }
 function readUpdateState() {
   try {
     const p2 = updateStateFile();
-    if (!existsSync106(p2)) return null;
+    if (!existsSync107(p2)) return null;
     return JSON.parse(readFileSync86(p2, "utf-8"));
   } catch {
     return null;
@@ -599928,11 +600356,11 @@ function readUpdateState() {
 }
 function writeUpdateState(state) {
   try {
-    const dir = join122(homedir43(), ".open-agents");
-    mkdirSync63(dir, { recursive: true });
+    const dir = join123(homedir43(), ".open-agents");
+    mkdirSync64(dir, { recursive: true });
     const finalPath = updateStateFile();
     const tmpPath = `${finalPath}.tmp.${process.pid}`;
-    writeFileSync55(tmpPath, JSON.stringify(state, null, 2), "utf-8");
+    writeFileSync56(tmpPath, JSON.stringify(state, null, 2), "utf-8");
     renameSync8(tmpPath, finalPath);
   } catch {
   }
@@ -599976,15 +600404,15 @@ async function handleV1Update(req2, res, requestId) {
     const { execSync: es } = require3("node:child_process");
     const isWin2 = process.platform === "win32";
     let npmBin = "";
-    for (const candidate of isWin2 ? [join122(nodeDir, "npm.cmd"), join122(nodeDir, "npm")] : [join122(nodeDir, "npm"), "/usr/local/bin/npm", "/usr/bin/npm"]) {
-      if (existsSync106(candidate)) {
+    for (const candidate of isWin2 ? [join123(nodeDir, "npm.cmd"), join123(nodeDir, "npm")] : [join123(nodeDir, "npm"), "/usr/local/bin/npm", "/usr/bin/npm"]) {
+      if (existsSync107(candidate)) {
         npmBin = candidate;
         break;
       }
     }
     if (!npmBin) npmBin = isWin2 ? "npm.cmd" : "npm";
     const pkgSpec = `open-agents-ai@${targetVersion}`;
-    const dir = join122(homedir43(), ".open-agents");
+    const dir = join123(homedir43(), ".open-agents");
     fs7.mkdirSync(dir, { recursive: true });
     const logFd = fs7.openSync(logPath3, "w");
     const npmPrefix = dirname36(nodeDir);
@@ -599994,13 +600422,13 @@ async function handleV1Update(req2, res, requestId) {
         globalBinDir = es(`${npmBin} bin -g`, { encoding: "utf8", timeout: 5e3, stdio: "pipe" }).trim();
       } else {
         const npmCliCandidates = [
-          join122(nodeDir, "..", "lib", "node_modules", "npm", "bin", "npm-cli.js"),
-          join122(npmBin, "..", "..", "lib", "node_modules", "npm", "bin", "npm-cli.js")
+          join123(nodeDir, "..", "lib", "node_modules", "npm", "bin", "npm-cli.js"),
+          join123(npmBin, "..", "..", "lib", "node_modules", "npm", "bin", "npm-cli.js")
         ];
         let npmCli = "";
         for (const c9 of npmCliCandidates) {
           try {
-            if (existsSync106(c9)) {
+            if (existsSync107(c9)) {
               npmCli = c9;
               break;
             }
@@ -600024,7 +600452,7 @@ async function handleV1Update(req2, res, requestId) {
     cleanEnv.PATH = pathParts.join(":");
     let child;
     if (isWin2) {
-      child = spawn25(npmBin, ["install", "-g", pkgSpec, "--no-audit", "--no-fund", "--no-progress"], {
+      child = spawn26(npmBin, ["install", "-g", pkgSpec, "--no-audit", "--no-fund", "--no-progress"], {
         detached: true,
         stdio: ["ignore", logFd, logFd],
         windowsHide: true,
@@ -600032,13 +600460,13 @@ async function handleV1Update(req2, res, requestId) {
       });
     } else {
       const npmCliCandidates = [
-        join122(nodeDir, "..", "lib", "node_modules", "npm", "bin", "npm-cli.js"),
-        join122(npmBin, "..", "..", "lib", "node_modules", "npm", "bin", "npm-cli.js")
+        join123(nodeDir, "..", "lib", "node_modules", "npm", "bin", "npm-cli.js"),
+        join123(npmBin, "..", "..", "lib", "node_modules", "npm", "bin", "npm-cli.js")
       ];
       let npmCli = "";
       for (const c9 of npmCliCandidates) {
         try {
-          if (existsSync106(c9)) {
+          if (existsSync107(c9)) {
             npmCli = c9;
             break;
           }
@@ -600046,13 +600474,13 @@ async function handleV1Update(req2, res, requestId) {
         }
       }
       if (npmCli) {
-        child = spawn25(nodeBin, [npmCli, "install", "-g", pkgSpec, "--no-audit", "--no-fund", "--no-progress"], {
+        child = spawn26(nodeBin, [npmCli, "install", "-g", pkgSpec, "--no-audit", "--no-fund", "--no-progress"], {
           detached: true,
           stdio: ["ignore", logFd, logFd],
           env: cleanEnv
         });
       } else {
-        child = spawn25(npmBin, ["install", "-g", pkgSpec, "--no-audit", "--no-fund", "--no-progress"], {
+        child = spawn26(npmBin, ["install", "-g", pkgSpec, "--no-audit", "--no-fund", "--no-progress"], {
           detached: true,
           stdio: ["ignore", logFd, logFd],
           env: cleanEnv
@@ -600063,7 +600491,7 @@ async function handleV1Update(req2, res, requestId) {
     const installPid = child.pid ?? 0;
     if (installPid > 0 && !isWin2) {
       try {
-        const follower = spawn25("bash", ["-c", `while kill -0 ${installPid} 2>/dev/null; do sleep 1; done; echo "__EXIT_CODE=0" >> "${logPath3}"`], {
+        const follower = spawn26("bash", ["-c", `while kill -0 ${installPid} 2>/dev/null; do sleep 1; done; echo "__EXIT_CODE=0" >> "${logPath3}"`], {
           detached: true,
           stdio: "ignore"
         });
@@ -600076,8 +600504,8 @@ async function handleV1Update(req2, res, requestId) {
         }
         let oaAbs = "oa";
         try {
-          const which = es("command -v oa 2>/dev/null || which oa 2>/dev/null", { encoding: "utf8", timeout: 2e3, stdio: "pipe", env: cleanEnv }).trim();
-          if (which) oaAbs = which;
+          const which2 = es("command -v oa 2>/dev/null || which oa 2>/dev/null", { encoding: "utf8", timeout: 2e3, stdio: "pipe", env: cleanEnv }).trim();
+          if (which2) oaAbs = which2;
         } catch {
         }
         const relaunchScript = [
@@ -600086,7 +600514,7 @@ async function handleV1Update(req2, res, requestId) {
           hasSystemdUnit ? `systemctl --user restart open-agents-daemon.service >/dev/null 2>&1 || true` : `${JSON.stringify(oaAbs)} serve --quiet --daemon >/dev/null 2>&1 & disown`,
           `kill -TERM ${process.pid} >/dev/null 2>&1 || true`
         ].join("; ");
-        const relauncher = spawn25("bash", ["-c", relaunchScript], {
+        const relauncher = spawn26("bash", ["-c", relaunchScript], {
           detached: true,
           stdio: "ignore",
           env: cleanEnv
@@ -600135,7 +600563,7 @@ function handleV1UpdateStatus(res) {
   let logTail = "";
   let exitCode = null;
   try {
-    if (existsSync106(logPath3)) {
+    if (existsSync107(logPath3)) {
       const raw = readFileSync86(logPath3, "utf-8");
       const m2 = raw.match(/__EXIT_CODE=(\d+)/);
       if (m2) exitCode = parseInt(m2[1], 10);
@@ -600232,8 +600660,8 @@ async function handleV1Run(req2, res) {
   if (workingDir) {
     cwd4 = resolve38(workingDir);
   } else if (isolate) {
-    const wsDir = join122(dir, "..", "workspaces", id);
-    mkdirSync63(wsDir, { recursive: true });
+    const wsDir = join123(dir, "..", "workspaces", id);
+    mkdirSync64(wsDir, { recursive: true });
     cwd4 = wsDir;
   } else {
     cwd4 = resolve38(process.cwd());
@@ -600308,7 +600736,7 @@ async function handleV1Run(req2, res) {
     });
     job.sandbox = "container";
   } else {
-    child = spawn25(process.execPath, [oaBin, ...args], {
+    child = spawn26(process.execPath, [oaBin, ...args], {
       cwd: cwd4,
       env: runEnv,
       stdio: ["ignore", "pipe", "pipe"],
@@ -600419,7 +600847,7 @@ async function handleV1Run(req2, res) {
     let output = "";
     let tailBytes = 0;
     const TAIL_BUDGET = 1048576;
-    const outputWriter = new DiskTaskOutput(join122(dir, `${id}.output`));
+    const outputWriter = new DiskTaskOutput(join123(dir, `${id}.output`));
     job.outputFile = outputWriter.path;
     atomicJobWrite(dir, id, job);
     child.stdout?.on("data", (chunk) => {
@@ -600818,7 +601246,7 @@ async function handlePostCommand(res, cmd) {
     return;
   }
   try {
-    const child = spawn25("node", [oaBin, "run", `/${cmd}`, "--json"], {
+    const child = spawn26("node", [oaBin, "run", `/${cmd}`, "--json"], {
       env: { ...process.env, __OPEN_AGENTS_NO_AUTO_RUN: "" },
       stdio: ["ignore", "pipe", "pipe"],
       timeout: 3e4
@@ -601335,11 +601763,11 @@ async function handleRequest(req2, res, ollamaUrl, verbose) {
           jsonResponse(res, 400, { error: "audio_too_small", message: "Reference audio must be at least ~4 KB" });
           return;
         }
-        const { tmpdir: tmpdir22 } = await import("node:os");
-        const { writeFileSync: writeFileSync59, unlinkSync: unlinkSync25 } = await import("node:fs");
+        const { tmpdir: tmpdir23 } = await import("node:os");
+        const { writeFileSync: writeFileSync60, unlinkSync: unlinkSync25 } = await import("node:fs");
         const { join: pjoin } = await import("node:path");
-        const tmpPath = pjoin(tmpdir22(), `oa-clone-upload-${Date.now()}-${safeName}`);
-        writeFileSync59(tmpPath, buf);
+        const tmpPath = pjoin(tmpdir23(), `oa-clone-upload-${Date.now()}-${safeName}`);
+        writeFileSync60(tmpPath, buf);
         try {
           const ve = getVoiceEngine();
           const msg = await ve.setCloneVoice(tmpPath);
@@ -601889,7 +602317,7 @@ data: ${JSON.stringify(data)}
         }
         for (const f2 of seenFiles) {
           try {
-            writeFileSync55(f2, JSON.stringify({ tasks: [] }, null, 2));
+            writeFileSync56(f2, JSON.stringify({ tasks: [] }, null, 2));
             deleted++;
           } catch {
           }
@@ -602190,7 +602618,7 @@ ${historyLines}
       }
       runEnv["OLLAMA_HOST"] = currentCfg.backendUrl || process.env["OLLAMA_HOST"] || "http://127.0.0.1:11434";
       if (currentCfg.apiKey) runEnv["OA_API_KEY_INHERIT"] = currentCfg.apiKey;
-      const child = spawn25(process.execPath, [oaBin, ...args], {
+      const child = spawn26(process.execPath, [oaBin, ...args], {
         cwd: cwdPath,
         env: runEnv,
         stdio: ["ignore", "pipe", "pipe"],
@@ -602993,7 +603421,7 @@ ${steering}`;
 function getScheduleRoots() {
   const rootsEnv = process.env["OA_SCHEDULE_ROOTS"] || "";
   const roots = rootsEnv.split(rootsEnv.includes(";") ? ";" : ":").filter(Boolean);
-  const defaults3 = [process.cwd(), join122(homedir43(), "Documents")];
+  const defaults3 = [process.cwd(), join123(homedir43(), "Documents")];
   const set = /* @__PURE__ */ new Set([...defaults3, ...roots]);
   return [...set];
 }
@@ -603005,8 +603433,8 @@ function listScheduledTasks() {
   for (const root of roots) {
     try {
       walk(root, 0, (dir) => {
-        if (dir.endsWith(`${join122(".oa", "scheduled")}`) || dir.includes(`${join122(".oa", "scheduled")}`)) {
-          const file = join122(dir, "tasks.json");
+        if (dir.endsWith(`${join123(".oa", "scheduled")}`) || dir.includes(`${join123(".oa", "scheduled")}`)) {
+          const file = join123(dir, "tasks.json");
           try {
             const raw = readFileSync86(file, "utf-8");
             const json = JSON.parse(raw);
@@ -603073,7 +603501,7 @@ function walk(dir, depth, onDir, maxDepth) {
     if (e2.name === "node_modules" || e2.name.startsWith(".")) {
       if (e2.name !== ".oa") continue;
     }
-    const child = join122(dir, e2.name);
+    const child = join123(dir, e2.name);
     walk(child, depth + 1, onDir, maxDepth);
   }
 }
@@ -603089,11 +603517,11 @@ function setScheduledEnabled(id, enabled2) {
     arr[target.index].enabled = enabled2;
     if (Array.isArray(json?.tasks)) {
       json.tasks = arr;
-      writeFileSync55(target.file, JSON.stringify(json, null, 2));
+      writeFileSync56(target.file, JSON.stringify(json, null, 2));
     } else if (Array.isArray(json)) {
-      writeFileSync55(target.file, JSON.stringify(arr, null, 2));
+      writeFileSync56(target.file, JSON.stringify(arr, null, 2));
     } else {
-      writeFileSync55(target.file, JSON.stringify({ tasks: arr }, null, 2));
+      writeFileSync56(target.file, JSON.stringify({ tasks: arr }, null, 2));
     }
     if (!enabled2) {
       try {
@@ -603123,11 +603551,11 @@ function deleteScheduledById(id) {
     arr.splice(target.index, 1);
     if (Array.isArray(json?.tasks)) {
       json.tasks = arr;
-      writeFileSync55(target.file, JSON.stringify(json, null, 2));
+      writeFileSync56(target.file, JSON.stringify(json, null, 2));
     } else if (Array.isArray(json)) {
-      writeFileSync55(target.file, JSON.stringify(arr, null, 2));
+      writeFileSync56(target.file, JSON.stringify(arr, null, 2));
     } else {
-      writeFileSync55(target.file, JSON.stringify({ tasks: arr }, null, 2));
+      writeFileSync56(target.file, JSON.stringify({ tasks: arr }, null, 2));
     }
     const candidates = [];
     if (id) candidates.push(id);
@@ -603380,7 +603808,7 @@ function reconcileScheduledTasks(apply) {
   const errors = [];
   for (const f2 of found) {
     const wdir = f2.workingDir || process.cwd();
-    const file = join122(wdir, ".oa", "scheduled", "tasks.json");
+    const file = join123(wdir, ".oa", "scheduled", "tasks.json");
     try {
       let json = { tasks: [] };
       try {
@@ -603395,9 +603823,9 @@ function reconcileScheduledTasks(apply) {
           const entry = { task: f2.task || `legacy ${f2.id}`, schedule: f2.cron, enabled: true };
           arr.push(entry);
           const toWrite = Array.isArray(json?.tasks) ? { ...json, tasks: arr } : Array.isArray(json) ? arr : { tasks: arr };
-          mkdirSync63(join122(wdir, ".oa", "scheduled"), { recursive: true });
-          mkdirSync63(join122(wdir, ".oa", "scheduled", "logs"), { recursive: true });
-          writeFileSync55(file, JSON.stringify(toWrite, null, 2));
+          mkdirSync64(join123(wdir, ".oa", "scheduled"), { recursive: true });
+          mkdirSync64(join123(wdir, ".oa", "scheduled", "logs"), { recursive: true });
+          writeFileSync56(file, JSON.stringify(toWrite, null, 2));
           adopted.push({ file, index: arr.length - 1 });
         }
       } else {
@@ -603441,32 +603869,32 @@ function writeCrontabLines(lines) {
 }
 function canonicalCronLine(rec) {
   const oaBin = findOaBinary4();
-  const logDir = join122(rec.workingDir, ".oa", "scheduled", "logs");
-  const logFile = join122(logDir, `${rec.id}.log`);
-  const storeFile = join122(rec.workingDir, ".oa", "scheduled", "tasks.json");
+  const logDir = join123(rec.workingDir, ".oa", "scheduled", "logs");
+  const logFile = join123(logDir, `${rec.id}.log`);
+  const storeFile = join123(rec.workingDir, ".oa", "scheduled", "tasks.json");
   const taskEsc = rec.task.replace(/'/g, "'\\''");
-  const lockDir = join122(rec.workingDir, ".oa", "run");
-  const lockPath = join122(lockDir, `${rec.id}.lock`);
+  const lockDir = join123(rec.workingDir, ".oa", "run");
+  const lockPath = join123(lockDir, `${rec.id}.lock`);
   const wrapper = [
     `cd ${JSON.stringify(rec.workingDir)}`,
     `mkdir -p ${JSON.stringify(logDir)}`,
     `mkdir -p ${JSON.stringify(lockDir)}`,
     `if mkdir ${JSON.stringify(lockPath)} 2>/dev/null; then`,
-    `  echo $$ > ${JSON.stringify(join122(lockPath, "pid"))}`,
+    `  echo $$ > ${JSON.stringify(join123(lockPath, "pid"))}`,
     `  trap 'rm -rf ${lockPath}' EXIT`,
     `else`,
-    `  if [ -f ${JSON.stringify(join122(lockPath, "pid"))} ]; then`,
-    `    oldpid=$(cat ${JSON.stringify(join122(lockPath, "pid"))} 2>/dev/null || echo)`,
+    `  if [ -f ${JSON.stringify(join123(lockPath, "pid"))} ]; then`,
+    `    oldpid=$(cat ${JSON.stringify(join123(lockPath, "pid"))} 2>/dev/null || echo)`,
     `    if [ -n "$oldpid" ] && kill -0 "$oldpid" 2>/dev/null; then`,
     `      echo "[oa-scheduler] ${rec.id} already running as PID $oldpid; skipping" >> ${JSON.stringify(logFile)}`,
     `      exit 0`,
     `    else`,
     `      rm -rf ${JSON.stringify(lockPath)} 2>/dev/null || true`,
-    `      mkdir -p ${JSON.stringify(lockPath)} && echo $$ > ${JSON.stringify(join122(lockPath, "pid"))} && trap 'rm -rf ${lockPath}' EXIT`,
+    `      mkdir -p ${JSON.stringify(lockPath)} && echo $$ > ${JSON.stringify(join123(lockPath, "pid"))} && trap 'rm -rf ${lockPath}' EXIT`,
     `    fi`,
     `  else`,
     `    rm -rf ${JSON.stringify(lockPath)} 2>/dev/null || true`,
-    `    mkdir -p ${JSON.stringify(lockPath)} && echo $$ > ${JSON.stringify(join122(lockPath, "pid"))} && trap 'rm -rf ${lockPath}' EXIT`,
+    `    mkdir -p ${JSON.stringify(lockPath)} && echo $$ > ${JSON.stringify(join123(lockPath, "pid"))} && trap 'rm -rf ${lockPath}' EXIT`,
     `  fi`,
     `fi`,
     `${oaBin} '${taskEsc}' >> ${JSON.stringify(logFile)} 2>&1; _oa_exit=$?`,
@@ -603498,9 +603926,9 @@ function fixupOrMigrateScheduled(mode, dryRun) {
       try {
         if (!f2.workingDir || !f2.task) continue;
         const unitBase = `oa-${f2.id}`;
-        const unitDir = join122(homedir43(), ".config", "systemd", "user");
-        const svc = join122(unitDir, `${unitBase}.service`);
-        const tim = join122(unitDir, `${unitBase}.timer`);
+        const unitDir = join123(homedir43(), ".config", "systemd", "user");
+        const svc = join123(unitDir, `${unitBase}.service`);
+        const tim = join123(unitDir, `${unitBase}.timer`);
         const oaBin = findOaBinary4();
         const rec = { id: f2.id, cron: f2.cron, workingDir: f2.workingDir, task: f2.task };
         const cmd = canonicalCronLine(rec).split(" ").slice(5).join(" ");
@@ -603530,9 +603958,9 @@ Persistent=true
 WantedBy=timers.target
 `;
         if (!dryRun) {
-          mkdirSync63(unitDir, { recursive: true });
-          writeFileSync55(svc, svcText);
-          writeFileSync55(tim, timText);
+          mkdirSync64(unitDir, { recursive: true });
+          writeFileSync56(svc, svcText);
+          writeFileSync56(tim, timText);
           try {
             const { execSync: es } = require3("node:child_process");
             es("systemctl --user daemon-reload", { stdio: "pipe" });
@@ -603626,8 +604054,8 @@ function startApiServer(options2 = {}) {
   const config = loadConfig();
   const ollamaUrl = options2.ollamaUrl ?? config.backendUrl;
   const cwd4 = process.cwd();
-  initAuditLog(join122(cwd4, ".oa"));
-  initUsageTracker(join122(cwd4, ".oa"));
+  initAuditLog(join123(cwd4, ".oa"));
+  initUsageTracker(join123(cwd4, ".oa"));
   try {
     const taskMgr = getSharedTaskManager();
     taskMgr.setEventPublisher((type, data, opts) => {
@@ -603669,7 +604097,7 @@ function startApiServer(options2 = {}) {
   try {
     const dir = todoDir();
     try {
-      mkdirSync63(dir, { recursive: true });
+      mkdirSync64(dir, { recursive: true });
     } catch {
     }
     const cache8 = /* @__PURE__ */ new Map();
@@ -603678,7 +604106,7 @@ function startApiServer(options2 = {}) {
         if (!f2.endsWith(".json") || f2.includes(".tmp.")) continue;
         const sid = f2.replace(/\.json$/, "");
         try {
-          const items = JSON.parse(readFileSync86(join122(dir, f2), "utf-8"));
+          const items = JSON.parse(readFileSync86(join123(dir, f2), "utf-8"));
           if (Array.isArray(items)) {
             cache8.set(sid, new Map(items.map((t2) => [t2.id, t2])));
           }
@@ -603690,10 +604118,10 @@ function startApiServer(options2 = {}) {
     const watcher = fsWatch3(dir, (_evt, fname) => {
       if (!fname || !fname.endsWith(".json") || fname.includes(".tmp.")) return;
       const sid = fname.replace(/\.json$/, "");
-      const fp = join122(dir, fname);
+      const fp = join123(dir, fname);
       let next = [];
       try {
-        if (!existsSync106(fp)) {
+        if (!existsSync107(fp)) {
           const old = cache8.get(sid);
           if (old) {
             for (const t2 of old.values()) {
@@ -603745,13 +604173,13 @@ function startApiServer(options2 = {}) {
   const retentionDays = parseInt(process.env["OA_JOB_RETENTION_DAYS"] ?? "30", 10);
   if (retentionDays > 0) {
     try {
-      const jobsDir3 = join122(cwd4, ".oa", "jobs");
-      if (existsSync106(jobsDir3)) {
+      const jobsDir3 = join123(cwd4, ".oa", "jobs");
+      if (existsSync107(jobsDir3)) {
         const cutoff = Date.now() - retentionDays * 864e5;
         for (const f2 of readdirSync36(jobsDir3)) {
           if (!f2.endsWith(".json")) continue;
           try {
-            const jobPath = join122(jobsDir3, f2);
+            const jobPath = join123(jobsDir3, f2);
             const job = JSON.parse(readFileSync86(jobPath, "utf-8"));
             const jobTime = new Date(job.startedAt ?? job.completedAt ?? 0).getTime();
             if (jobTime > 0 && jobTime < cutoff && job.status !== "running") {
@@ -603784,8 +604212,8 @@ function startApiServer(options2 = {}) {
   }
   let runtimeAccessMode = resolveAccessMode(process.env["OA_ACCESS"], host);
   try {
-    const accessFile = join122(homedir43(), ".open-agents", "access");
-    if (existsSync106(accessFile)) {
+    const accessFile = join123(homedir43(), ".open-agents", "access");
+    if (existsSync107(accessFile)) {
       const persisted = readFileSync86(accessFile, "utf8").trim();
       const resolved = resolveAccessMode(persisted, host);
       if (resolved) runtimeAccessMode = resolved;
@@ -603839,9 +604267,9 @@ function startApiServer(options2 = {}) {
             const previous = runtimeAccessMode;
             runtimeAccessMode = requested;
             try {
-              const dir = join122(homedir43(), ".open-agents");
-              mkdirSync63(dir, { recursive: true });
-              writeFileSync55(join122(dir, "access"), `${runtimeAccessMode}
+              const dir = join123(homedir43(), ".open-agents");
+              mkdirSync64(dir, { recursive: true });
+              writeFileSync56(join123(dir, "access"), `${runtimeAccessMode}
 `, "utf8");
             } catch {
             }
@@ -604054,9 +604482,9 @@ function startApiServer(options2 = {}) {
       try {
         const { startEmbeddingWorkers: startEmbeddingWorkers2 } = await Promise.resolve().then(() => (init_embedding_workers(), embedding_workers_exports));
         const { ensureEmbedDeps: ensureEmbedDeps2, runEmbedImage: runEmbedImage2, runEmbedAudio: runEmbedAudio2 } = await Promise.resolve().then(() => (init_py_embed(), py_embed_exports));
-        const dbBase = join122(cwd4, ".oa");
-        const epStore = new mem.EpisodeStore(join122(dbBase, "memory.db"));
-        const kg = new mem.TemporalGraph(join122(dbBase, "kg.db"));
+        const dbBase = join123(cwd4, ".oa");
+        const epStore = new mem.EpisodeStore(join123(dbBase, "memory.db"));
+        const kg = new mem.TemporalGraph(join123(dbBase, "kg.db"));
         try {
           ensureEmbedDeps2();
         } catch {
@@ -604134,7 +604562,7 @@ function startApiServer(options2 = {}) {
     log22(`  Primary: ${config.backendUrl} (${config.backendType || "ollama"})
 `);
     try {
-      const { writeFileSync: writeFileSync59, mkdirSync: mkdirSync67, existsSync: _exists } = require3("node:fs");
+      const { writeFileSync: writeFileSync60, mkdirSync: mkdirSync68, existsSync: _exists, readFileSync: _rfs } = require3("node:fs");
       const { join: _join } = require3("node:path");
       const { homedir: _homedir } = require3("node:os");
       const apiHint = JSON.stringify({
@@ -604145,22 +604573,111 @@ function startApiServer(options2 = {}) {
         startedAt: (/* @__PURE__ */ new Date()).toISOString(),
         version: version4
       }, null, 2);
-      const candidates = [
-        _join(process.cwd(), ".oa", "nexus"),
-        _join(_homedir(), ".oa", "nexus"),
-        _join(_homedir(), ".open-agents", "nexus")
-      ];
-      for (const dir of candidates) {
+      const dirSet = /* @__PURE__ */ new Set();
+      try {
+        const regPath = _join(_homedir(), ".open-agents", "nexus-registry.json");
+        if (_exists(regPath)) {
+          const reg = JSON.parse(_rfs(regPath, "utf-8"));
+          for (const e2 of reg?.dirs || []) {
+            const d2 = typeof e2 === "string" ? e2 : e2?.dir;
+            if (typeof d2 === "string") dirSet.add(d2);
+          }
+        }
+      } catch {
+      }
+      if (process.env["OA_NEXUS_DIR"]) dirSet.add(process.env["OA_NEXUS_DIR"]);
+      dirSet.add(_join(process.cwd(), ".oa", "nexus"));
+      dirSet.add(_join(_homedir(), ".oa", "nexus"));
+      dirSet.add(_join(_homedir(), ".open-agents", "nexus"));
+      let written = 0;
+      for (const dir of dirSet) {
         try {
-          if (!_exists(dir)) mkdirSync67(dir, { recursive: true });
-          writeFileSync59(_join(dir, "api-port.json"), apiHint);
+          if (!_exists(dir)) mkdirSync68(dir, { recursive: true });
+          writeFileSync60(_join(dir, "api-port.json"), apiHint);
+          written++;
         } catch {
         }
       }
+      if (written > 0) log22(`  api-port hint: wrote to ${written} nexus dir(s)
+`);
     } catch (e2) {
       log22(`  WARN: api-port hint write failed: ${e2.message}
 `);
     }
+    if (process.env["OA_AUTO_NEXUS"] !== "0") {
+      (async () => {
+        try {
+          const { join: _j } = require3("node:path");
+          const { homedir: _hd } = require3("node:os");
+          const { existsSync: _ex, readFileSync: _rf, statSync: _st } = require3("node:fs");
+          const { execSync: _ex2 } = require3("node:child_process");
+          let chosenNexusDir = null;
+          if (process.env["OA_NEXUS_DIR"]) chosenNexusDir = process.env["OA_NEXUS_DIR"];
+          if (!chosenNexusDir) {
+            try {
+              const regPath = _j(_hd(), ".open-agents", "nexus-registry.json");
+              if (_ex(regPath)) {
+                const reg = JSON.parse(_rf(regPath, "utf-8"));
+                for (const e2 of reg?.dirs || []) {
+                  const d2 = typeof e2 === "string" ? e2 : e2?.dir;
+                  if (typeof d2 === "string" && _ex(d2)) {
+                    chosenNexusDir = d2;
+                    break;
+                  }
+                }
+              }
+            } catch {
+            }
+          }
+          if (!chosenNexusDir) {
+            try {
+              const cmd = `find "${_hd()}" -maxdepth 4 -path '*/.oa/nexus' -type d 2>/dev/null | head -10`;
+              const out = _ex2(cmd, { encoding: "utf-8", timeout: 2e3 }).trim();
+              for (const ln of out.split("\n").filter(Boolean)) {
+                if (_ex(_j(ln, "status.json"))) {
+                  chosenNexusDir = ln;
+                  break;
+                }
+              }
+              if (!chosenNexusDir && out) chosenNexusDir = out.split("\n")[0]?.trim() || null;
+            } catch {
+            }
+          }
+          const finalNexusDir = chosenNexusDir ?? _j(_hd(), ".oa", "nexus");
+          chosenNexusDir = finalNexusDir;
+          const repoRoot = finalNexusDir.replace(/[\\/]\.oa[\\/]nexus$/, "");
+          log22(`  Nexus auto-recover: target ${finalNexusDir}
+`);
+          const { NexusTool: NexusTool2 } = await Promise.resolve().then(() => (init_dist5(), dist_exports));
+          const tool = new NexusTool2(repoRoot);
+          const result = await tool.execute({ action: "connect" });
+          const status = result?.success ? "ok" : "fail";
+          const detail = result?.output || result?.error || "";
+          log22(`  Nexus auto-recover: ${status}${detail ? " — " + String(detail).split("\n")[0].slice(0, 120) : ""}
+`);
+          if (status === "ok") {
+            try {
+              const { writeFileSync: _wfs2, mkdirSync: _mks, existsSync: _exf } = require3("node:fs");
+              const apiHint2 = JSON.stringify({
+                port,
+                host: host === "0.0.0.0" ? "127.0.0.1" : host,
+                scheme: proto,
+                pid: process.pid,
+                startedAt: (/* @__PURE__ */ new Date()).toISOString(),
+                version: version4
+              }, null, 2);
+              const dirOut = chosenNexusDir;
+              if (!_exf(dirOut)) _mks(dirOut, { recursive: true });
+              _wfs2(_j(dirOut, "api-port.json"), apiHint2);
+            } catch {
+            }
+          }
+        } catch (e2) {
+          log22(`  Nexus auto-recover: skipped (${e2.message.slice(0, 80)})
+`);
+        }
+      })();
+    }
     try {
       adoptHandoffRuns();
     } catch (e2) {
@@ -604394,10 +604911,10 @@ async function handleMemoryIngest(req2, res, ollamaUrl) {
     const labels = Array.isArray(b.labels) ? b.labels : [];
     const mediaPath = typeof b.media_path === "string" ? b.media_path : void 0;
     const cwd4 = process.cwd();
-    const dbBase = join122(cwd4, ".oa");
+    const dbBase = join123(cwd4, ".oa");
     const { EpisodeStore: EpisodeStore3, TemporalGraph: TemporalGraph3 } = await Promise.resolve().then(() => (init_dist7(), dist_exports2));
-    const epStore = new EpisodeStore3(join122(dbBase, "memory.db"));
-    const kg = new TemporalGraph3(join122(dbBase, "kg.db"));
+    const epStore = new EpisodeStore3(join123(dbBase, "memory.db"));
+    const kg = new TemporalGraph3(join123(dbBase, "kg.db"));
     const meta = {};
     if (mediaPath) meta.media_path = mediaPath;
     const epId = epStore.insert({ modality, content: content || (mediaPath || ""), metadata: meta, toolName: "memory_ingest" });
@@ -604464,7 +604981,7 @@ async function handleEntitiesList(req2, res) {
     const type = url.searchParams.get("type") || "person";
     const limit = Math.max(1, Math.min(1e3, parseInt(url.searchParams.get("limit") || "100", 10)));
     const { TemporalGraph: TemporalGraph3 } = await Promise.resolve().then(() => (init_dist7(), dist_exports2));
-    const kg = new TemporalGraph3(join122(process.cwd(), ".oa", "kg.db"));
+    const kg = new TemporalGraph3(join123(process.cwd(), ".oa", "kg.db"));
     const nodes = kg.nodesByType(type, limit).map((n2) => ({ id: n2.id, text: n2.text, mentionCount: n2.mentionCount, firstSeen: n2.firstSeen, lastSeen: n2.lastSeen }));
     jsonResponse(res, 200, { object: "list", data: nodes });
   } catch (err) {
@@ -604486,7 +605003,7 @@ async function handleMemorySearch2(req2, res) {
     const wLex = typeof b.lexical_weight === "number" ? b.lexical_weight : 1;
     const wEmb = typeof b.embedding_weight === "number" ? b.embedding_weight : 1;
     const { EpisodeStore: EpisodeStore3 } = await Promise.resolve().then(() => (init_dist7(), dist_exports2));
-    const epStore = new EpisodeStore3(join122(process.cwd(), ".oa", "memory.db"));
+    const epStore = new EpisodeStore3(join123(process.cwd(), ".oa", "memory.db"));
     const results = epStore.search({ query, modality, limit }, { queryEmbedding: qEmb, lexicalWeight: wLex, embeddingWeight: wEmb });
     jsonResponse(res, 200, { object: "list", data: results.map((e2) => ({ id: e2.id, modality: e2.modality, content: e2.content, timestamp: e2.timestamp })) });
   } catch (err) {
@@ -604603,11 +605120,11 @@ var init_serve = __esm({
 
 // packages/cli/src/tui/interactive.ts
 import { cwd } from "node:process";
-import { resolve as resolve39, join as join123, dirname as dirname37, extname as extname12 } from "node:path";
+import { resolve as resolve39, join as join124, dirname as dirname37, extname as extname12 } from "node:path";
 import { createRequire as createRequire6 } from "node:module";
 import { fileURLToPath as fileURLToPath18 } from "node:url";
-import { readFileSync as readFileSync87, writeFileSync as writeFileSync56, appendFileSync as appendFileSync8, rmSync as rmSync5, readdirSync as readdirSync37, mkdirSync as mkdirSync64 } from "node:fs";
-import { existsSync as existsSync107 } from "node:fs";
+import { readFileSync as readFileSync87, writeFileSync as writeFileSync57, appendFileSync as appendFileSync8, rmSync as rmSync5, readdirSync as readdirSync37, mkdirSync as mkdirSync65 } from "node:fs";
+import { existsSync as existsSync108 } from "node:fs";
 import { execSync as execSync58 } from "node:child_process";
 import { homedir as homedir44 } from "node:os";
 function formatTimeAgo2(date) {
@@ -604625,12 +605142,12 @@ function getVersion4() {
     const require4 = createRequire6(import.meta.url);
     const thisDir = dirname37(fileURLToPath18(import.meta.url));
     const candidates = [
-      join123(thisDir, "..", "package.json"),
-      join123(thisDir, "..", "..", "package.json"),
-      join123(thisDir, "..", "..", "..", "package.json")
+      join124(thisDir, "..", "package.json"),
+      join124(thisDir, "..", "..", "package.json"),
+      join124(thisDir, "..", "..", "..", "package.json")
     ];
     for (const pkgPath of candidates) {
-      if (existsSync107(pkgPath)) {
+      if (existsSync108(pkgPath)) {
         const pkg = require4(pkgPath);
         if (pkg.name === "open-agents-ai" || pkg.name === "@open-agents/cli" || pkg.name === "@open-agents/monorepo") {
           return pkg.version ?? "0.0.0";
@@ -605436,14 +605953,14 @@ Meta-critique: quality ${meta.quality}/5, thorough: ${meta.thorough}`;
 function gatherMemorySnippets(root) {
   const snippets = [];
   const dirs = [
-    join123(root, ".oa", "memory"),
-    join123(root, ".open-agents", "memory")
+    join124(root, ".oa", "memory"),
+    join124(root, ".open-agents", "memory")
   ];
   for (const dir of dirs) {
-    if (!existsSync107(dir)) continue;
+    if (!existsSync108(dir)) continue;
     try {
       for (const f2 of readdirSync37(dir).filter((f3) => f3.endsWith(".json"))) {
-        const data = JSON.parse(readFileSync87(join123(dir, f2), "utf-8"));
+        const data = JSON.parse(readFileSync87(join124(dir, f2), "utf-8"));
         for (const val of Object.values(data)) {
           const v = typeof val === "object" && val !== null && "value" in val ? String(val.value) : String(val);
           if (v.length > 10) snippets.push(v);
@@ -605597,8 +606114,8 @@ ${metabolismMemories}
   } catch {
   }
   try {
-    const archeFile = join123(repoRoot, ".oa", "arche", "variants.json");
-    if (existsSync107(archeFile)) {
+    const archeFile = join124(repoRoot, ".oa", "arche", "variants.json");
+    if (existsSync108(archeFile)) {
       const variants = JSON.parse(readFileSync87(archeFile, "utf8"));
       if (variants.length > 0) {
         let filtered = variants;
@@ -605771,8 +606288,8 @@ RULES:
   const compactionThreshold = Number.isFinite(envOverride) && envOverride > 0 ? envOverride : modelTier === "small" ? 12e3 : modelTier === "medium" ? 24e3 : 4e4;
   let identityInjection = "";
   try {
-    const ikStateFile = join123(repoRoot, ".oa", "identity", "self-state.json");
-    if (existsSync107(ikStateFile)) {
+    const ikStateFile = join124(repoRoot, ".oa", "identity", "self-state.json");
+    if (existsSync108(ikStateFile)) {
       const selfState = JSON.parse(readFileSync87(ikStateFile, "utf8"));
       const lines = [
         `[Identity State v${selfState.version}]`,
@@ -606635,13 +607152,13 @@ When done, either call task_complete with your answer, or use FINAL_VAR(variable
           });
         }
         try {
-          const ikDir = join123(repoRoot, ".oa", "identity");
-          const ikFile = join123(ikDir, "self-state.json");
+          const ikDir = join124(repoRoot, ".oa", "identity");
+          const ikFile = join124(ikDir, "self-state.json");
           let ikState;
-          if (existsSync107(ikFile)) {
+          if (existsSync108(ikFile)) {
             ikState = JSON.parse(readFileSync87(ikFile, "utf8"));
           } else {
-            mkdirSync64(ikDir, { recursive: true });
+            mkdirSync65(ikDir, { recursive: true });
             const machineId = Date.now().toString(36) + Math.random().toString(36).slice(2, 8);
             ikState = {
               self_id: `oa-${machineId}`,
@@ -606697,7 +607214,7 @@ When done, either call task_complete with your answer, or use FINAL_VAR(variable
           }
           ikState.session_count = (ikState.session_count || 0) + 1;
           ikState.updated_at = (/* @__PURE__ */ new Date()).toISOString();
-          writeFileSync56(ikFile, JSON.stringify(ikState, null, 2));
+          writeFileSync57(ikFile, JSON.stringify(ikState, null, 2));
         } catch (ikErr) {
           try {
             console.error("[IK-OBSERVE]", ikErr);
@@ -606716,8 +607233,8 @@ When done, either call task_complete with your answer, or use FINAL_VAR(variable
       } else {
         renderTaskIncomplete(result.turns, result.toolCalls, result.durationMs, tokens);
         try {
-          const ikFile = join123(repoRoot, ".oa", "identity", "self-state.json");
-          if (existsSync107(ikFile)) {
+          const ikFile = join124(repoRoot, ".oa", "identity", "self-state.json");
+          if (existsSync108(ikFile)) {
             const ikState = JSON.parse(readFileSync87(ikFile, "utf8"));
             if (!ikState.stats) ikState.stats = { queries_served: 0 };
             ikState.stats.queries_served = (ikState.stats.queries_served || 0) + 1;
@@ -606729,7 +607246,7 @@ When done, either call task_complete with your answer, or use FINAL_VAR(variable
             if (ikState.version_history.length > 200) ikState.version_history = ikState.version_history.slice(-200);
             ikState.session_count = (ikState.session_count || 0) + 1;
             ikState.updated_at = (/* @__PURE__ */ new Date()).toISOString();
-            writeFileSync56(ikFile, JSON.stringify(ikState, null, 2));
+            writeFileSync57(ikFile, JSON.stringify(ikState, null, 2));
           }
         } catch {
         }
@@ -606974,9 +607491,9 @@ async function startInteractive(config, repoPath) {
     process.stdin.pause();
   }
   try {
-    const oaDir = join123(repoRoot, ".oa");
-    const nexusPidFile = join123(oaDir, "nexus", "daemon.pid");
-    if (existsSync107(nexusPidFile)) {
+    const oaDir = join124(repoRoot, ".oa");
+    const nexusPidFile = join124(oaDir, "nexus", "daemon.pid");
+    if (existsSync108(nexusPidFile)) {
       const pid = parseInt(readFileSync87(nexusPidFile, "utf8").trim(), 10);
       if (pid > 0) {
         try {
@@ -607637,7 +608154,7 @@ ${result.summary}`
   let p2pGateway = null;
   let peerMesh = null;
   let inferenceRouter = null;
-  const secretVault = new SecretVault(join123(repoRoot, ".oa", "vault.enc"));
+  const secretVault = new SecretVault(join124(repoRoot, ".oa", "vault.enc"));
   let adminSessionKey = null;
   const callSubAgents = /* @__PURE__ */ new Map();
   const streamRenderer = new StreamRenderer();
@@ -607868,12 +608385,12 @@ Rationale: ${proposal.rationale}${provenanceNote}`;
     const hits = allCompletions.filter((c9) => c9.toLowerCase().startsWith(lower));
     return [hits, line];
   }
-  const HISTORY_DIR = join123(homedir44(), ".open-agents");
-  const HISTORY_FILE = join123(HISTORY_DIR, "repl-history");
+  const HISTORY_DIR = join124(homedir44(), ".open-agents");
+  const HISTORY_FILE = join124(HISTORY_DIR, "repl-history");
   const MAX_HISTORY_LINES = 500;
   let savedHistory = [];
   try {
-    if (existsSync107(HISTORY_FILE)) {
+    if (existsSync108(HISTORY_FILE)) {
       const raw = readFileSync87(HISTORY_FILE, "utf8").trim();
       if (raw) savedHistory = raw.split("\n").reverse();
     }
@@ -608021,12 +608538,12 @@ Rationale: ${proposal.rationale}${provenanceNote}`;
   function persistHistoryLine(line) {
     if (!line.trim()) return;
     try {
-      mkdirSync64(HISTORY_DIR, { recursive: true });
+      mkdirSync65(HISTORY_DIR, { recursive: true });
       appendFileSync8(HISTORY_FILE, line + "\n", "utf8");
       if (Math.random() < 0.02) {
         const all2 = readFileSync87(HISTORY_FILE, "utf8").trim().split("\n");
         if (all2.length > MAX_HISTORY_LINES) {
-          writeFileSync56(HISTORY_FILE, all2.slice(-MAX_HISTORY_LINES).join("\n") + "\n", "utf8");
+          writeFileSync57(HISTORY_FILE, all2.slice(-MAX_HISTORY_LINES).join("\n") + "\n", "utf8");
         }
       }
     } catch {
@@ -608211,10 +608728,10 @@ Rationale: ${proposal.rationale}${provenanceNote}`;
       const { unlinkSync: _rmStale } = await import("node:fs");
       const { homedir: _hdir } = await import("node:os");
       for (const dp of [
-        join123(repoRoot, ".oa", "nexus", "nexus-daemon.mjs"),
-        join123(_hdir(), ".open-agents", ".oa", "nexus", "nexus-daemon.mjs")
+        join124(repoRoot, ".oa", "nexus", "nexus-daemon.mjs"),
+        join124(_hdir(), ".open-agents", ".oa", "nexus", "nexus-daemon.mjs")
       ]) {
-        if (existsSync107(dp)) try {
+        if (existsSync108(dp)) try {
           _rmStale(dp);
         } catch {
         }
@@ -608225,8 +608742,8 @@ Rationale: ${proposal.rationale}${provenanceNote}`;
       const autoNexus = new NexusTool(repoRoot);
       const _registerNexusDaemon = () => {
         try {
-          const nexusPidFile = join123(repoRoot, ".oa", "nexus", "daemon.pid");
-          if (existsSync107(nexusPidFile)) {
+          const nexusPidFile = join124(repoRoot, ".oa", "nexus", "daemon.pid");
+          if (existsSync108(nexusPidFile)) {
             const nPid = parseInt(readFileSync87(nexusPidFile, "utf8").trim(), 10);
             if (nPid > 0 && !registry2.daemons.has("Nexus")) {
               registry2.register({ name: "Nexus", pid: nPid, startedAt: Date.now(), status: "running" });
@@ -608284,7 +608801,7 @@ Rationale: ${proposal.rationale}${provenanceNote}`;
     } catch {
     }
     try {
-      const oaDir = join123(repoRoot, ".oa");
+      const oaDir = join124(repoRoot, ".oa");
       const reconnected = await ExposeGateway.checkAndReconnect(oaDir, {
         onInfo: (msg) => writeContent(() => renderInfo2(msg)),
         onError: (msg) => writeContent(() => renderWarning2(msg))
@@ -608316,7 +608833,7 @@ Rationale: ${proposal.rationale}${provenanceNote}`;
     } catch {
     }
     try {
-      const oaDir = join123(repoRoot, ".oa");
+      const oaDir = join124(repoRoot, ".oa");
       const reconnectedP2P = await ExposeP2PGateway.checkAndReconnect(oaDir, new NexusTool(repoRoot), {
         onInfo: (msg) => writeContent(() => renderInfo2(msg)),
         onError: (msg) => writeContent(() => renderWarning2(msg))
@@ -608357,10 +608874,10 @@ Rationale: ${proposal.rationale}${provenanceNote}`;
     }
     try {
       const { homedir: _hd, hostname: _hn, userInfo: _ui } = await import("node:os");
-      const globalNamePath = join123(_hd(), ".open-agents", "agent-name");
+      const globalNamePath = join124(_hd(), ".open-agents", "agent-name");
       let agName = "";
       try {
-        if (existsSync107(globalNamePath)) agName = readFileSync87(globalNamePath, "utf8").trim();
+        if (existsSync108(globalNamePath)) agName = readFileSync87(globalNamePath, "utf8").trim();
       } catch {
       }
       if (!agName) {
@@ -608389,10 +608906,10 @@ Rationale: ${proposal.rationale}${provenanceNote}`;
         }
         if (!ollamaAlive) {
           try {
-            const savedSponsorsPath = join123(repoRoot, ".oa", "sponsor", "known-sponsors.json");
+            const savedSponsorsPath = join124(repoRoot, ".oa", "sponsor", "known-sponsors.json");
             let savedSponsors = [];
             try {
-              if (existsSync107(savedSponsorsPath)) {
+              if (existsSync108(savedSponsorsPath)) {
                 savedSponsors = JSON.parse(readFileSync87(savedSponsorsPath, "utf8"));
                 const oneHourAgo = Date.now() - 36e5;
                 savedSponsors = savedSponsors.filter((s2) => (s2.lastVerified || 0) > oneHourAgo);
@@ -609485,10 +610002,10 @@ Respond concisely and safely. Remember: you are talking to the general public.`;
               if (name10 === "voice_list_files") {
                 const baseDir = String(args?.dir ?? ".");
                 const { readdirSync: readdirSync39, statSync: statSync36 } = __require("node:fs");
-                const { join: join128, resolve: resolve43 } = __require("node:path");
-                const base3 = baseDir.startsWith("/") ? baseDir : resolve43(join128(repoRoot, baseDir));
+                const { join: join129, resolve: resolve43 } = __require("node:path");
+                const base3 = baseDir.startsWith("/") ? baseDir : resolve43(join129(repoRoot, baseDir));
                 const items = readdirSync39(base3).slice(0, 200).map((f2) => {
-                  const s2 = statSync36(join128(base3, f2));
+                  const s2 = statSync36(join129(base3, f2));
                   return { name: f2, dir: s2.isDirectory(), size: s2.size };
                 });
                 return JSON.stringify({ dir: base3, items }, null, 2);
@@ -609576,7 +610093,7 @@ Respond concisely and safely. Remember: you are talking to the general public.`;
           kind,
           targetUrl,
           authKey,
-          stateDir: join123(repoRoot, ".oa"),
+          stateDir: join124(repoRoot, ".oa"),
           passthrough: passthrough ?? false,
           loadbalance: loadbalance ?? false,
           endpointAuth: passthrough ? currentConfig.apiKey : void 0,
@@ -609622,7 +610139,7 @@ Respond concisely and safely. Remember: you are talking to the general public.`;
         await tunnelGateway.stop();
         tunnelGateway = null;
       }
-      const newTunnel = new ExposeGateway({ kind, targetUrl, authKey, fullAccess, stateDir: join123(repoRoot, ".oa") });
+      const newTunnel = new ExposeGateway({ kind, targetUrl, authKey, fullAccess, stateDir: join124(repoRoot, ".oa") });
       newTunnel.on("stats", (stats) => {
         statusBar.setExposeStatus({
           status: stats.status,
@@ -609643,14 +610160,14 @@ Respond concisely and safely. Remember: you are talking to the general public.`;
         throw err;
       }
     },
-    async exposeStop(which) {
-      if (!which || which === "tunnel") {
+    async exposeStop(which2) {
+      if (!which2 || which2 === "tunnel") {
         if (tunnelGateway) {
           await tunnelGateway.stop();
           tunnelGateway = null;
         }
       }
-      if (!which || which === "libp2p") {
+      if (!which2 || which2 === "libp2p") {
         if (p2pGateway) {
           await p2pGateway.stop();
           p2pGateway = null;
@@ -609709,8 +610226,8 @@ Respond concisely and safely. Remember: you are talking to the general public.`;
       });
       if (!result.success) throw new Error(result.error || "Connect failed");
       try {
-        const nexusPidFile = join123(repoRoot, ".oa", "nexus", "daemon.pid");
-        if (existsSync107(nexusPidFile)) {
+        const nexusPidFile = join124(repoRoot, ".oa", "nexus", "daemon.pid");
+        if (existsSync108(nexusPidFile)) {
           const pid = parseInt(readFileSync87(nexusPidFile, "utf8").trim(), 10);
           if (pid > 0) {
             registry2.register({
@@ -609899,9 +610416,9 @@ Respond concisely and safely. Remember: you are talking to the general public.`;
         writeContent(() => renderInfo2(`Killed ${bgKilled} background task(s).`));
       }
       try {
-        const nexusDir = join123(repoRoot, OA_DIR, "nexus");
-        const pidFile = join123(nexusDir, "daemon.pid");
-        if (existsSync107(pidFile)) {
+        const nexusDir = join124(repoRoot, OA_DIR, "nexus");
+        const pidFile = join124(nexusDir, "daemon.pid");
+        if (existsSync108(pidFile)) {
           const pid = parseInt(readFileSync87(pidFile, "utf8").trim(), 10);
           if (pid > 0) {
             try {
@@ -609924,11 +610441,11 @@ Respond concisely and safely. Remember: you are talking to the general public.`;
       } catch {
       }
       try {
-        const voiceDir2 = join123(homedir44(), ".open-agents", "voice");
+        const voiceDir2 = join124(homedir44(), ".open-agents", "voice");
         const voicePidFiles = ["luxtts-daemon.pid", "piper-daemon.pid"];
         for (const pf of voicePidFiles) {
-          const pidPath = join123(voiceDir2, pf);
-          if (existsSync107(pidPath)) {
+          const pidPath = join124(voiceDir2, pf);
+          if (existsSync108(pidPath)) {
             try {
               const pid = parseInt(readFileSync87(pidPath, "utf8").trim(), 10);
               if (pid > 0) {
@@ -609954,8 +610471,8 @@ Respond concisely and safely. Remember: you are talking to the general public.`;
         execSync58(process.platform === "win32" ? "timeout /t 1 /nobreak >nul" : "sleep 0.5", { timeout: 3e3, stdio: "ignore" });
       } catch {
       }
-      const oaPath = join123(repoRoot, OA_DIR);
-      if (existsSync107(oaPath)) {
+      const oaPath = join124(repoRoot, OA_DIR);
+      if (existsSync108(oaPath)) {
         let deleted = false;
         for (let attempt = 0; attempt < 3; attempt++) {
           try {
@@ -610039,18 +610556,18 @@ Respond concisely and safely. Remember: you are talking to the general public.`;
   try {
     const { isPersonaPlexRunning: isPersonaPlexRunning2 } = await Promise.resolve().then(() => (init_personaplex(), personaplex_exports));
     if (isPersonaPlexRunning2()) {
-      const ppPidFile = join123(homedir44(), ".open-agents", "voice", "personaplex", "daemon.pid");
-      const ppPortFile = join123(homedir44(), ".open-agents", "voice", "personaplex", "daemon.port");
-      if (existsSync107(ppPidFile)) {
+      const ppPidFile = join124(homedir44(), ".open-agents", "voice", "personaplex", "daemon.pid");
+      const ppPortFile = join124(homedir44(), ".open-agents", "voice", "personaplex", "daemon.port");
+      if (existsSync108(ppPidFile)) {
         const ppPid = parseInt(readFileSync87(ppPidFile, "utf8").trim(), 10);
-        const ppPort = existsSync107(ppPortFile) ? parseInt(readFileSync87(ppPortFile, "utf8").trim(), 10) : void 0;
+        const ppPort = existsSync108(ppPortFile) ? parseInt(readFileSync87(ppPortFile, "utf8").trim(), 10) : void 0;
         if (ppPid > 0 && !registry2.daemons.has("PersonaPlex")) {
           registry2.register({ name: "PersonaPlex", pid: ppPid, port: ppPort, startedAt: Date.now(), status: "running" });
         }
       }
     }
-    const nexusPidFile = join123(repoRoot, ".oa", "nexus", "daemon.pid");
-    if (existsSync107(nexusPidFile)) {
+    const nexusPidFile = join124(repoRoot, ".oa", "nexus", "daemon.pid");
+    if (existsSync108(nexusPidFile)) {
       const nPid = parseInt(readFileSync87(nexusPidFile, "utf8").trim(), 10);
       if (nPid > 0 && !registry2.daemons.has("Nexus")) {
         try {
@@ -610418,9 +610935,9 @@ Execute this skill now. Follow the behavioral guidance above.`;
       }
     }
     const cleanPath = input.replace(/^['"]|['"]$/g, "").trim();
-    const isImage = isImagePath(cleanPath) && existsSync107(resolve39(repoRoot, cleanPath));
-    const isMedia = !isImage && isTranscribablePath(cleanPath) && existsSync107(resolve39(repoRoot, cleanPath));
-    const isMarkdown = !isImage && !isMedia && /\.(md|markdown)$/i.test(cleanPath) && existsSync107(resolve39(repoRoot, cleanPath));
+    const isImage = isImagePath(cleanPath) && existsSync108(resolve39(repoRoot, cleanPath));
+    const isMedia = !isImage && isTranscribablePath(cleanPath) && existsSync108(resolve39(repoRoot, cleanPath));
+    const isMarkdown = !isImage && !isMedia && /\.(md|markdown)$/i.test(cleanPath) && existsSync108(resolve39(repoRoot, cleanPath));
     if (activeTask) {
       if (activeTask.runner.isPaused) {
         activeTask.runner.resume();
@@ -611007,13 +611524,13 @@ async function runWithTUI(task, config, repoPath, callbacks) {
     const handle2 = startTask(task, config, repoRoot);
     await handle2.promise;
     try {
-      const ikDir = join123(repoRoot, ".oa", "identity");
-      const ikFile = join123(ikDir, "self-state.json");
+      const ikDir = join124(repoRoot, ".oa", "identity");
+      const ikFile = join124(ikDir, "self-state.json");
       let ikState;
-      if (existsSync107(ikFile)) {
+      if (existsSync108(ikFile)) {
         ikState = JSON.parse(readFileSync87(ikFile, "utf8"));
       } else {
-        mkdirSync64(ikDir, { recursive: true });
+        mkdirSync65(ikDir, { recursive: true });
         ikState = {
           self_id: `oa-${Date.now().toString(36)}`,
           version: 1,
@@ -611035,7 +611552,7 @@ async function runWithTUI(task, config, repoPath, callbacks) {
       ikState.homeostasis.coherence = Math.min(1, ikState.homeostasis.coherence + 0.05);
       ikState.session_count = (ikState.session_count || 0) + 1;
       ikState.updated_at = (/* @__PURE__ */ new Date()).toISOString();
-      writeFileSync56(ikFile, JSON.stringify(ikState, null, 2));
+      writeFileSync57(ikFile, JSON.stringify(ikState, null, 2));
     } catch (ikErr) {
     }
     try {
@@ -611048,11 +611565,11 @@ async function runWithTUI(task, config, repoPath, callbacks) {
       );
     } catch {
       try {
-        const archeDir = join123(repoRoot, ".oa", "arche");
-        const archeFile = join123(archeDir, "variants.json");
+        const archeDir = join124(repoRoot, ".oa", "arche");
+        const archeFile = join124(archeDir, "variants.json");
         let variants = [];
         try {
-          if (existsSync107(archeFile)) variants = JSON.parse(readFileSync87(archeFile, "utf8"));
+          if (existsSync108(archeFile)) variants = JSON.parse(readFileSync87(archeFile, "utf8"));
         } catch {
         }
         variants.push({
@@ -611066,14 +611583,14 @@ async function runWithTUI(task, config, repoPath, callbacks) {
           tags: ["general"]
         });
         if (variants.length > 50) variants = variants.slice(-50);
-        mkdirSync64(archeDir, { recursive: true });
-        writeFileSync56(archeFile, JSON.stringify(variants, null, 2));
+        mkdirSync65(archeDir, { recursive: true });
+        writeFileSync57(archeFile, JSON.stringify(variants, null, 2));
       } catch {
       }
     }
     try {
-      const metaFile = join123(repoRoot, ".oa", "memory", "metabolism", "store.json");
-      if (existsSync107(metaFile)) {
+      const metaFile = join124(repoRoot, ".oa", "memory", "metabolism", "store.json");
+      if (existsSync108(metaFile)) {
         const store2 = JSON.parse(readFileSync87(metaFile, "utf8"));
         const surfaced = store2.filter((m2) => m2.type !== "quarantine" && m2.scores?.confidence > 0.15).sort((a2, b) => b.scores.utility * b.scores.confidence - a2.scores.utility * a2.scores.confidence).slice(0, 5);
         let updated = false;
@@ -611085,7 +611602,7 @@ async function runWithTUI(task, config, repoPath, callbacks) {
           updated = true;
         }
         if (updated) {
-          writeFileSync56(metaFile, JSON.stringify(store2, null, 2));
+          writeFileSync57(metaFile, JSON.stringify(store2, null, 2));
         }
       }
     } catch {
@@ -611138,9 +611655,9 @@ Rules:
           try {
             const { initDb: initDb2 } = __require("@open-agents/memory");
             const { ProceduralMemoryStore: ProceduralMemoryStore2 } = __require("@open-agents/memory");
-            const dbDir = join123(repoRoot, ".oa", "memory");
-            mkdirSync64(dbDir, { recursive: true });
-            const db = initDb2(join123(dbDir, "structured.db"));
+            const dbDir = join124(repoRoot, ".oa", "memory");
+            mkdirSync65(dbDir, { recursive: true });
+            const db = initDb2(join124(dbDir, "structured.db"));
             const memStore = new ProceduralMemoryStore2(db);
             memStore.createWithEmbedding({
               content: content.slice(0, 600),
@@ -611155,11 +611672,11 @@ Rules:
             db.close();
           } catch {
           }
-          const metaDir = join123(repoRoot, ".oa", "memory", "metabolism");
-          const storeFile = join123(metaDir, "store.json");
+          const metaDir = join124(repoRoot, ".oa", "memory", "metabolism");
+          const storeFile = join124(metaDir, "store.json");
           let store2 = [];
           try {
-            if (existsSync107(storeFile)) store2 = JSON.parse(readFileSync87(storeFile, "utf8"));
+            if (existsSync108(storeFile)) store2 = JSON.parse(readFileSync87(storeFile, "utf8"));
           } catch {
           }
           store2.push({
@@ -611174,25 +611691,25 @@ Rules:
             accessCount: 0
           });
           if (store2.length > 100) store2 = store2.slice(-100);
-          mkdirSync64(metaDir, { recursive: true });
-          writeFileSync56(storeFile, JSON.stringify(store2, null, 2));
+          mkdirSync65(metaDir, { recursive: true });
+          writeFileSync57(storeFile, JSON.stringify(store2, null, 2));
         }
       }
     } catch {
     }
     try {
-      const cohereSettingsFile = join123(repoRoot, ".oa", "settings.json");
+      const cohereSettingsFile = join124(repoRoot, ".oa", "settings.json");
       let cohereActive = false;
       try {
-        if (existsSync107(cohereSettingsFile)) {
+        if (existsSync108(cohereSettingsFile)) {
           const settings = JSON.parse(readFileSync87(cohereSettingsFile, "utf8"));
           cohereActive = settings.cohere === true;
         }
       } catch {
       }
       if (cohereActive) {
-        const metaFile = join123(repoRoot, ".oa", "memory", "metabolism", "store.json");
-        if (existsSync107(metaFile)) {
+        const metaFile = join124(repoRoot, ".oa", "memory", "metabolism", "store.json");
+        if (existsSync108(metaFile)) {
           const store2 = JSON.parse(readFileSync87(metaFile, "utf8"));
           const latest = store2.filter((m2) => m2.sourceTrace === "trajectory-extraction" || m2.sourceTrace === "llm-trajectory-extraction").slice(-1)[0];
           if (latest && latest.scores?.confidence >= 0.6) {
@@ -611218,17 +611735,17 @@ Rules:
     }
   } catch (err) {
     try {
-      const ikFile = join123(repoRoot, ".oa", "identity", "self-state.json");
-      if (existsSync107(ikFile)) {
+      const ikFile = join124(repoRoot, ".oa", "identity", "self-state.json");
+      if (existsSync108(ikFile)) {
         const ikState = JSON.parse(readFileSync87(ikFile, "utf8"));
         ikState.homeostasis.uncertainty = Math.min(1, ikState.homeostasis.uncertainty + 0.1);
         ikState.homeostasis.coherence = Math.max(0, ikState.homeostasis.coherence - 0.05);
         ikState.session_count = (ikState.session_count || 0) + 1;
         ikState.updated_at = (/* @__PURE__ */ new Date()).toISOString();
-        writeFileSync56(ikFile, JSON.stringify(ikState, null, 2));
+        writeFileSync57(ikFile, JSON.stringify(ikState, null, 2));
       }
-      const metaFile = join123(repoRoot, ".oa", "memory", "metabolism", "store.json");
-      if (existsSync107(metaFile)) {
+      const metaFile = join124(repoRoot, ".oa", "memory", "metabolism", "store.json");
+      if (existsSync108(metaFile)) {
         const store2 = JSON.parse(readFileSync87(metaFile, "utf8"));
         const surfaced = store2.filter((m2) => m2.type !== "quarantine" && m2.scores?.confidence > 0.15).sort((a2, b) => b.scores.utility * b.scores.confidence - a2.scores.utility * a2.scores.confidence).slice(0, 5);
         for (const item of surfaced) {
@@ -611237,14 +611754,14 @@ Rules:
           item.scores.utility = Math.max(0, (item.scores.utility || 0.5) - 0.05);
           item.scores.confidence = Math.max(0, (item.scores.confidence || 0.5) - 0.02);
         }
-        writeFileSync56(metaFile, JSON.stringify(store2, null, 2));
+        writeFileSync57(metaFile, JSON.stringify(store2, null, 2));
       }
       try {
-        const archeDir = join123(repoRoot, ".oa", "arche");
-        const archeFile = join123(archeDir, "variants.json");
+        const archeDir = join124(repoRoot, ".oa", "arche");
+        const archeFile = join124(archeDir, "variants.json");
         let variants = [];
         try {
-          if (existsSync107(archeFile)) variants = JSON.parse(readFileSync87(archeFile, "utf8"));
+          if (existsSync108(archeFile)) variants = JSON.parse(readFileSync87(archeFile, "utf8"));
         } catch {
         }
         variants.push({
@@ -611258,8 +611775,8 @@ Rules:
           tags: ["general"]
         });
         if (variants.length > 50) variants = variants.slice(-50);
-        mkdirSync64(archeDir, { recursive: true });
-        writeFileSync56(archeFile, JSON.stringify(variants, null, 2));
+        mkdirSync65(archeDir, { recursive: true });
+        writeFileSync57(archeFile, JSON.stringify(variants, null, 2));
       } catch {
       }
     } catch {
@@ -611347,14 +611864,14 @@ __export(run_exports, {
   statusCommand: () => statusCommand
 });
 import { resolve as resolve40 } from "node:path";
-import { spawn as spawn26 } from "node:child_process";
-import { mkdirSync as mkdirSync65, writeFileSync as writeFileSync57, readFileSync as readFileSync88, readdirSync as readdirSync38, existsSync as existsSync108 } from "node:fs";
+import { spawn as spawn27 } from "node:child_process";
+import { mkdirSync as mkdirSync66, writeFileSync as writeFileSync58, readFileSync as readFileSync88, readdirSync as readdirSync38, existsSync as existsSync109 } from "node:fs";
 import { randomBytes as randomBytes24 } from "node:crypto";
-import { join as join124 } from "node:path";
+import { join as join125 } from "node:path";
 function jobsDir2(repoPath) {
   const root = resolve40(repoPath ?? process.cwd());
-  const dir = join124(root, ".oa", "jobs");
-  mkdirSync65(dir, { recursive: true });
+  const dir = join125(root, ".oa", "jobs");
+  mkdirSync66(dir, { recursive: true });
   return dir;
 }
 async function runCommand(opts, config) {
@@ -611460,7 +611977,7 @@ async function runBackground(task, config, opts) {
   const oaBin = process.argv[1] || "oa";
   const args = [task, "--json"];
   if (config.model) args.push("--model", config.model);
-  const child = spawn26(process.execPath, [oaBin, ...args], {
+  const child = spawn27(process.execPath, [oaBin, ...args], {
     cwd: repoRoot,
     env: { ...process.env, OA_JOB_ID: id },
     stdio: ["ignore", "pipe", "pipe"],
@@ -611476,7 +611993,7 @@ async function runBackground(task, config, opts) {
     }
   });
   job.pid = child.pid ?? 0;
-  writeFileSync57(join124(dir, `${id}.json`), JSON.stringify(job, null, 2));
+  writeFileSync58(join125(dir, `${id}.json`), JSON.stringify(job, null, 2));
   let output = "";
   child.stdout?.on("data", (chunk) => {
     output += chunk.toString();
@@ -611492,7 +612009,7 @@ async function runBackground(task, config, opts) {
       job.summary = result.summary;
       job.durationMs = result.durationMs;
       job.error = result.error;
-      writeFileSync57(join124(dir, `${id}.json`), JSON.stringify(job, null, 2));
+      writeFileSync58(join125(dir, `${id}.json`), JSON.stringify(job, null, 2));
     } catch {
     }
   });
@@ -611508,8 +612025,8 @@ async function runBackground(task, config, opts) {
 }
 function statusCommand(jobId, repoPath) {
   const dir = jobsDir2(repoPath);
-  const file = join124(dir, `${jobId}.json`);
-  if (!existsSync108(file)) {
+  const file = join125(dir, `${jobId}.json`);
+  if (!existsSync109(file)) {
     console.error(`Job not found: ${jobId}`);
     console.log(`Available jobs: oa jobs`);
     process.exit(1);
@@ -611535,7 +612052,7 @@ function jobsCommand(repoPath) {
   console.log("Jobs:");
   for (const file of files) {
     try {
-      const job = JSON.parse(readFileSync88(join124(dir, file), "utf-8"));
+      const job = JSON.parse(readFileSync88(join125(dir, file), "utf-8"));
       const icon = job.status === "completed" ? "✓" : job.status === "failed" ? "✗" : "●";
       const runtime = job.completedAt ? `${((new Date(job.completedAt).getTime() - new Date(job.startedAt).getTime()) / 1e3).toFixed(0)}s` : `${((Date.now() - new Date(job.startedAt).getTime()) / 1e3).toFixed(0)}s`;
       const cleanListTask = cleanForStorage(job.task) || job.task;
@@ -611559,13 +612076,13 @@ __export(index_repo_exports, {
   indexRepoCommand: () => indexRepoCommand
 });
 import { resolve as resolve41 } from "node:path";
-import { existsSync as existsSync109, statSync as statSync35 } from "node:fs";
+import { existsSync as existsSync110, statSync as statSync35 } from "node:fs";
 import { cwd as cwd2 } from "node:process";
 async function indexRepoCommand(opts, _config3) {
   const repoRoot = resolve41(opts.repoPath ?? cwd2());
   printHeader("Index Repository");
   printInfo(`Indexing: ${repoRoot}`);
-  if (!existsSync109(repoRoot)) {
+  if (!existsSync110(repoRoot)) {
     printError(`Path does not exist: ${repoRoot}`);
     process.exit(1);
   }
@@ -611817,7 +612334,7 @@ var config_exports2 = {};
 __export(config_exports2, {
   configCommand: () => configCommand
 });
-import { join as join125, resolve as resolve42 } from "node:path";
+import { join as join126, resolve as resolve42 } from "node:path";
 import { homedir as homedir45 } from "node:os";
 import { cwd as cwd3 } from "node:process";
 function redactIfSensitive(key, value2) {
@@ -611899,7 +612416,7 @@ function handleShow(opts, config) {
     }
   }
   printSection("Config File");
-  printInfo(`~/.open-agents/config.json (${join125(homedir45(), ".open-agents", "config.json")})`);
+  printInfo(`~/.open-agents/config.json (${join126(homedir45(), ".open-agents", "config.json")})`);
   printSection("Priority Chain");
   printInfo("  1. CLI flags (--model, --backend-url, etc.)");
   printInfo("  2. Project .oa/settings.json (--local)");
@@ -611938,7 +612455,7 @@ function handleSet(opts, _config3) {
       const coerced = coerceForSettings(key, value2);
       saveProjectSettings(repoRoot, { [key]: coerced });
       printSuccess(`Project override set: ${key} = ${redactIfSensitive(key, value2)}`);
-      printInfo(`Saved to ${join125(repoRoot, ".oa", "settings.json")}`);
+      printInfo(`Saved to ${join126(repoRoot, ".oa", "settings.json")}`);
       printInfo("This override applies only when running in this workspace.");
     } catch (err) {
       printError(`Failed to save: ${err instanceof Error ? err.message : String(err)}`);
@@ -612121,9 +612638,9 @@ var eval_exports = {};
 __export(eval_exports, {
   evalCommand: () => evalCommand
 });
-import { tmpdir as tmpdir21 } from "node:os";
-import { mkdirSync as mkdirSync66, writeFileSync as writeFileSync58 } from "node:fs";
-import { join as join126 } from "node:path";
+import { tmpdir as tmpdir22 } from "node:os";
+import { mkdirSync as mkdirSync67, writeFileSync as writeFileSync59 } from "node:fs";
+import { join as join127 } from "node:path";
 async function evalCommand(opts, config) {
   const suiteName = opts.suite ?? "basic";
   const suite = SUITES[suiteName];
@@ -612252,10 +612769,10 @@ async function evalCommand(opts, config) {
   process.exit(failed > 0 ? 1 : 0);
 }
 function createTempEvalRepo() {
-  const dir = join126(tmpdir21(), `open-agents-eval-${Date.now()}`);
-  mkdirSync66(dir, { recursive: true });
-  writeFileSync58(
-    join126(dir, "package.json"),
+  const dir = join127(tmpdir22(), `open-agents-eval-${Date.now()}`);
+  mkdirSync67(dir, { recursive: true });
+  writeFileSync59(
+    join127(dir, "package.json"),
     JSON.stringify({ name: "eval-repo", version: "0.0.0" }, null, 2) + "\n",
     "utf8"
   );
@@ -612319,7 +612836,7 @@ init_typed_node_events();
 import { parseArgs as nodeParseArgs2 } from "node:util";
 import { createRequire as createRequire7 } from "node:module";
 import { fileURLToPath as fileURLToPath19 } from "node:url";
-import { dirname as dirname38, join as join127 } from "node:path";
+import { dirname as dirname38, join as join128 } from "node:path";
 
 // packages/cli/src/cli.ts
 init_typed_node_events();
@@ -612459,7 +612976,7 @@ init_output();
 function getVersion5() {
   try {
     const require4 = createRequire7(import.meta.url);
-    const pkgPath = join127(dirname38(fileURLToPath19(import.meta.url)), "..", "package.json");
+    const pkgPath = join128(dirname38(fileURLToPath19(import.meta.url)), "..", "package.json");
     const pkg = require4(pkgPath);
     return pkg.version;
   } catch {
@@ -612648,9 +613165,9 @@ async function main() {
           const mode = process.argv[process.argv.indexOf("--self-test") + 1] || "crossmodal";
           if (mode === "crossmodal") {
             process.stdout.write("Running crossmodal smoke tests...\n");
-            const { spawn: spawn27 } = await import("node:child_process");
+            const { spawn: spawn28 } = await import("node:child_process");
             const run = (file) => new Promise((resolve43, reject) => {
-              const p2 = spawn27(process.execPath, [file], { stdio: ["ignore", "pipe", "pipe"] });
+              const p2 = spawn28(process.execPath, [file], { stdio: ["ignore", "pipe", "pipe"] });
               p2.stdout.on("data", (d2) => process.stdout.write(d2));
               p2.stderr.on("data", (d2) => process.stdout.write(d2));
               onChildExit(p2, (code8) => code8 === 0 ? resolve43() : reject(new Error(`${file} exited ${code8}`)));
@@ -612773,12 +613290,12 @@ function crashLog(label, err) {
   const logLine = `[${timestamp}] ${label}: ${msg}
 `;
   try {
-    const { appendFileSync: appendFileSync9, mkdirSync: mkdirSync67 } = __require("node:fs");
-    const { join: join128 } = __require("node:path");
+    const { appendFileSync: appendFileSync9, mkdirSync: mkdirSync68 } = __require("node:fs");
+    const { join: join129 } = __require("node:path");
     const { homedir: homedir46 } = __require("node:os");
-    const logDir = join128(homedir46(), ".open-agents");
-    mkdirSync67(logDir, { recursive: true });
-    appendFileSync9(join128(logDir, "crash.log"), logLine);
+    const logDir = join129(homedir46(), ".open-agents");
+    mkdirSync68(logDir, { recursive: true });
+    appendFileSync9(join129(logDir, "crash.log"), logLine);
   } catch {
   }
   try {