open-agents-ai 0.67.1 → 0.68.0

package/dist/index.js

@@ -14626,10 +14626,10 @@ ${marker}` : marker);
         if (!this._workingDirectory)
           return;
         try {
-          const { mkdirSync: mkdirSync16, writeFileSync: writeFileSync14 } = __require("node:fs");
-          const { join: join45 } = __require("node:path");
-          const sessionDir = join45(this._workingDirectory, ".oa", "session", this._sessionId);
-          mkdirSync16(sessionDir, { recursive: true });
+          const { mkdirSync: mkdirSync17, writeFileSync: writeFileSync15 } = __require("node:fs");
+          const { join: join46 } = __require("node:path");
+          const sessionDir = join46(this._workingDirectory, ".oa", "session", this._sessionId);
+          mkdirSync17(sessionDir, { recursive: true });
           const checkpoint = {
             timestamp: (/* @__PURE__ */ new Date()).toISOString(),
             sessionId: this._sessionId,
@@ -14641,7 +14641,7 @@ ${marker}` : marker);
             memexEntryCount: this._memexArchive.size,
             fileRegistrySize: this._fileRegistry.size
           };
-          writeFileSync14(join45(sessionDir, "checkpoint.json"), JSON.stringify(checkpoint, null, 2));
+          writeFileSync15(join46(sessionDir, "checkpoint.json"), JSON.stringify(checkpoint, null, 2));
         } catch {
         }
       }
@@ -19129,12 +19129,12 @@ var require_extension = __commonJS({
 var require_websocket = __commonJS({
   "node_modules/.pnpm/ws@8.19.0/node_modules/ws/lib/websocket.js"(exports, module) {
     "use strict";
-    var EventEmitter5 = __require("events");
+    var EventEmitter7 = __require("events");
     var https = __require("https");
     var http = __require("http");
     var net = __require("net");
     var tls = __require("tls");
-    var { randomBytes: randomBytes6, createHash: createHash2 } = __require("crypto");
+    var { randomBytes: randomBytes8, createHash: createHash4 } = __require("crypto");
     var { Duplex, Readable } = __require("stream");
     var { URL: URL3 } = __require("url");
     var PerMessageDeflate = require_permessage_deflate();
@@ -19161,7 +19161,7 @@ var require_websocket = __commonJS({
     var protocolVersions = [8, 13];
     var readyStates = ["CONNECTING", "OPEN", "CLOSING", "CLOSED"];
     var subprotocolRegex = /^[!#$%&'*+\-.0-9A-Z^_`|a-z~]+$/;
-    var WebSocket2 = class _WebSocket extends EventEmitter5 {
+    var WebSocket2 = class _WebSocket extends EventEmitter7 {
       /**
        * Create a new `WebSocket`.
        *
@@ -19664,7 +19664,7 @@ var require_websocket = __commonJS({
         }
       }
       const defaultPort = isSecure ? 443 : 80;
-      const key = randomBytes6(16).toString("base64");
+      const key = randomBytes8(16).toString("base64");
       const request = isSecure ? https.request : http.request;
       const protocolSet = /* @__PURE__ */ new Set();
       let perMessageDeflate;
@@ -19794,7 +19794,7 @@ var require_websocket = __commonJS({
           abortHandshake(websocket, socket, "Invalid Upgrade header");
           return;
         }
-        const digest = createHash2("sha1").update(key + GUID).digest("base64");
+        const digest = createHash4("sha1").update(key + GUID).digest("base64");
         if (res.headers["sec-websocket-accept"] !== digest) {
           abortHandshake(websocket, socket, "Invalid Sec-WebSocket-Accept header");
           return;
@@ -20158,10 +20158,10 @@ var require_subprotocol = __commonJS({
 var require_websocket_server = __commonJS({
   "node_modules/.pnpm/ws@8.19.0/node_modules/ws/lib/websocket-server.js"(exports, module) {
     "use strict";
-    var EventEmitter5 = __require("events");
+    var EventEmitter7 = __require("events");
     var http = __require("http");
     var { Duplex } = __require("stream");
-    var { createHash: createHash2 } = __require("crypto");
+    var { createHash: createHash4 } = __require("crypto");
     var extension = require_extension();
     var PerMessageDeflate = require_permessage_deflate();
     var subprotocol = require_subprotocol();
@@ -20171,7 +20171,7 @@ var require_websocket_server = __commonJS({
     var RUNNING = 0;
     var CLOSING = 1;
     var CLOSED = 2;
-    var WebSocketServer2 = class extends EventEmitter5 {
+    var WebSocketServer2 = class extends EventEmitter7 {
       /**
        * Create a `WebSocketServer` instance.
        *
@@ -20462,7 +20462,7 @@ var require_websocket_server = __commonJS({
           );
         }
         if (this._state > RUNNING) return abortHandshake(socket, 503);
-        const digest = createHash2("sha1").update(key + GUID).digest("base64");
+        const digest = createHash4("sha1").update(key + GUID).digest("base64");
         const headers = [
           "HTTP/1.1 101 Switching Protocols",
           "Upgrade: websocket",
@@ -22440,8 +22440,958 @@ var init_expose = __esm({
   }
 });
 
-// packages/cli/dist/tui/call-agent.js
+// packages/cli/dist/tui/p2p/types.js
+function trustLevel(tier) {
+  return TRUST_ORDER.indexOf(tier);
+}
+var TRUST_ORDER;
+var init_types = __esm({
+  "packages/cli/dist/tui/p2p/types.js"() {
+    "use strict";
+    TRUST_ORDER = ["public", "verified", "tee", "local"];
+  }
+});
+
+// packages/cli/dist/tui/p2p/secret-vault.js
+import { createCipheriv, createDecipheriv, randomBytes as randomBytes6, scryptSync, createHash } from "node:crypto";
+import { readFileSync as readFileSync15, writeFileSync as writeFileSync7, existsSync as existsSync21, mkdirSync as mkdirSync7 } from "node:fs";
+import { join as join29, dirname as dirname11 } from "node:path";
+var PLACEHOLDER_PREFIX, PLACEHOLDER_SUFFIX, CIPHER_ALGO, SALT_LEN, IV_LEN, KEY_LEN, SecretVault;
+var init_secret_vault = __esm({
+  "packages/cli/dist/tui/p2p/secret-vault.js"() {
+    "use strict";
+    init_types();
+    PLACEHOLDER_PREFIX = "{{OA_VAR_";
+    PLACEHOLDER_SUFFIX = "}}";
+    CIPHER_ALGO = "aes-256-gcm";
+    SALT_LEN = 16;
+    IV_LEN = 12;
+    KEY_LEN = 32;
+    SecretVault = class {
+      storePath;
+      secrets = /* @__PURE__ */ new Map();
+      /** Regex cache — rebuilt when secrets change */
+      _redactRegex = null;
+      /** Reverse map: placeholder → secret name (for injection) */
+      _placeholderToName = /* @__PURE__ */ new Map();
+      constructor(storePath) {
+        this.storePath = storePath;
+      }
+      // ── Core API ────────────────────────────────────────────────────────────
+      /**
+       * Register a secret. The value will be redacted from all text sent to
+       * peers below the specified trust tier.
+       */
+      set(name, value, minTrust = "verified") {
+        const normalized = name.toUpperCase().replace(/[^A-Z0-9_]/g, "_");
+        const placeholder = `${PLACEHOLDER_PREFIX}${normalized}${PLACEHOLDER_SUFFIX}`;
+        this.secrets.set(normalized, {
+          name: normalized,
+          value,
+          placeholder,
+          minTrust,
+          createdAt: (/* @__PURE__ */ new Date()).toISOString()
+        });
+        this._redactRegex = null;
+        this._placeholderToName.set(placeholder, normalized);
+      }
+      /** Remove a secret from the vault */
+      delete(name) {
+        const normalized = name.toUpperCase().replace(/[^A-Z0-9_]/g, "_");
+        const entry = this.secrets.get(normalized);
+        if (entry) {
+          this._placeholderToName.delete(entry.placeholder);
+          this.secrets.delete(normalized);
+          this._redactRegex = null;
+          return true;
+        }
+        return false;
+      }
+      /** Get a secret value by name */
+      get(name) {
+        const normalized = name.toUpperCase().replace(/[^A-Z0-9_]/g, "_");
+        return this.secrets.get(normalized)?.value;
+      }
+      /** List all secret names (never exposes values) */
+      list() {
+        return Array.from(this.secrets.values()).map((s) => ({
+          name: s.name,
+          minTrust: s.minTrust,
+          createdAt: s.createdAt
+        }));
+      }
+      /** Number of registered secrets */
+      get size() {
+        return this.secrets.size;
+      }
+      // ── Redaction & Injection ───────────────────────────────────────────────
+      /**
+       * Redact all known secret values from text, replacing with placeholders.
+       * Only redacts secrets whose minTrust is above the given peer trust level.
+       *
+       * @param text - The text to redact
+       * @param peerTrust - The trust tier of the destination peer
+       * @returns Redacted text with {{OA_VAR_*}} placeholders
+       */
+      redact(text, peerTrust = "public") {
+        if (this.secrets.size === 0)
+          return text;
+        const peerLevel = trustLevel(peerTrust);
+        let result = text;
+        const sorted = Array.from(this.secrets.values()).filter((s) => trustLevel(s.minTrust) > peerLevel).sort((a, b) => b.value.length - a.value.length);
+        for (const secret of sorted) {
+          if (secret.value.length < 3)
+            continue;
+          const escaped = secret.value.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+          result = result.replace(new RegExp(escaped, "g"), secret.placeholder);
+        }
+        return result;
+      }
+      /**
+       * Inject real secret values back into text containing placeholders.
+       * This is the "last-mile" operation that happens ONLY on the trusted local machine.
+       *
+       * @param text - Text with {{OA_VAR_*}} placeholders
+       * @returns Text with real secret values restored
+       */
+      inject(text) {
+        if (this.secrets.size === 0 || !text.includes(PLACEHOLDER_PREFIX))
+          return text;
+        let result = text;
+        for (const [placeholder, name] of this._placeholderToName) {
+          const secret = this.secrets.get(name);
+          if (secret) {
+            result = result.split(placeholder).join(secret.value);
+          }
+        }
+        return result;
+      }
+      /**
+       * Scan text for potential secrets that should be registered.
+       * Returns patterns that look like API keys, tokens, passwords, etc.
+       */
+      scan(text) {
+        const patterns = [];
+        const seen = /* @__PURE__ */ new Set();
+        const regexes = [
+          /\b(sk-[a-zA-Z0-9]{20,})\b/g,
+          // OpenAI-style
+          /\b(cpk_[a-zA-Z0-9]{20,})\b/g,
+          // Chutes-style
+          /\b(gsk_[a-zA-Z0-9]{20,})\b/g,
+          // Groq-style
+          /\b(xai-[a-zA-Z0-9]{20,})\b/g,
+          // xAI-style
+          /\b(ghp_[a-zA-Z0-9]{36,})\b/g,
+          // GitHub PAT
+          /\b(glpat-[a-zA-Z0-9_-]{20,})\b/g,
+          // GitLab PAT
+          /\b(AKIA[0-9A-Z]{16})\b/g,
+          // AWS access key
+          /\b(0x[a-fA-F0-9]{40})\b/g,
+          // ETH address
+          /\b(0x[a-fA-F0-9]{64})\b/g,
+          // ETH private key
+          /\b([a-zA-Z0-9+/]{40,}={0,2})\b/g,
+          // Base64 tokens (40+ chars)
+          /\b(eyJ[a-zA-Z0-9_-]{10,}\.[a-zA-Z0-9_-]{10,})/g
+          // JWT tokens
+        ];
+        for (const re of regexes) {
+          let match;
+          while ((match = re.exec(text)) !== null) {
+            const val = match[1];
+            if (!seen.has(val) && !this.isRegistered(val)) {
+              seen.add(val);
+              patterns.push(val);
+            }
+          }
+        }
+        return patterns;
+      }
+      /** Check if a value is already registered as a secret */
+      isRegistered(value) {
+        for (const s of this.secrets.values()) {
+          if (s.value === value)
+            return true;
+        }
+        return false;
+      }
+      // ── Auto-registration from environment ──────────────────────────────────
+      /**
+       * Auto-import secrets from environment variables matching common patterns.
+       * Only imports vars that look like credentials (API keys, tokens, passwords).
+       */
+      importFromEnv() {
+        const envPatterns = [
+          /^.*API[_-]?KEY$/i,
+          /^.*SECRET$/i,
+          /^.*TOKEN$/i,
+          /^.*PASSWORD$/i,
+          /^.*PRIVATE[_-]?KEY$/i,
+          /^.*AUTH$/i,
+          /^.*CREDENTIAL$/i
+        ];
+        let count = 0;
+        for (const [key, value] of Object.entries(process.env)) {
+          if (!value || value.length < 8)
+            continue;
+          if (envPatterns.some((p) => p.test(key))) {
+            if (!this.secrets.has(key)) {
+              this.set(key, value, "verified");
+              count++;
+            }
+          }
+        }
+        return count;
+      }
+      // ── Encrypted persistence ──────────────────────────────────────────────
+      /**
+       * Save vault to disk with AES-256-GCM encryption.
+       * The passphrase is used to derive the encryption key via scrypt.
+       */
+      save(passphrase) {
+        if (!this.storePath)
+          throw new Error("No store path configured");
+        const data = JSON.stringify(Array.from(this.secrets.values()).map((s) => ({
+          name: s.name,
+          value: s.value,
+          minTrust: s.minTrust,
+          createdAt: s.createdAt
+        })));
+        const salt = randomBytes6(SALT_LEN);
+        const key = scryptSync(passphrase, salt, KEY_LEN);
+        const iv = randomBytes6(IV_LEN);
+        const cipher = createCipheriv(CIPHER_ALGO, key, iv);
+        const encrypted = Buffer.concat([cipher.update(data, "utf8"), cipher.final()]);
+        const tag = cipher.getAuthTag();
+        const blob = Buffer.concat([salt, iv, tag, encrypted]);
+        const dir = dirname11(this.storePath);
+        if (!existsSync21(dir))
+          mkdirSync7(dir, { recursive: true });
+        writeFileSync7(this.storePath, blob, { mode: 384 });
+      }
+      /**
+       * Load vault from disk, decrypting with the given passphrase.
+       * Returns the number of secrets loaded.
+       */
+      load(passphrase) {
+        if (!this.storePath || !existsSync21(this.storePath))
+          return 0;
+        const blob = readFileSync15(this.storePath);
+        if (blob.length < SALT_LEN + IV_LEN + 16) {
+          throw new Error("Vault file is corrupted (too small)");
+        }
+        const salt = blob.subarray(0, SALT_LEN);
+        const iv = blob.subarray(SALT_LEN, SALT_LEN + IV_LEN);
+        const tag = blob.subarray(SALT_LEN + IV_LEN, SALT_LEN + IV_LEN + 16);
+        const encrypted = blob.subarray(SALT_LEN + IV_LEN + 16);
+        const key = scryptSync(passphrase, salt, KEY_LEN);
+        const decipher = createDecipheriv(CIPHER_ALGO, key, iv);
+        decipher.setAuthTag(tag);
+        let data;
+        try {
+          data = decipher.update(encrypted) + decipher.final("utf8");
+        } catch {
+          throw new Error("Failed to decrypt vault \u2014 wrong passphrase?");
+        }
+        const entries = JSON.parse(data);
+        for (const entry of entries) {
+          this.set(entry.name, entry.value, entry.minTrust);
+        }
+        return entries.length;
+      }
+      /** Generate a deterministic fingerprint of vault contents (for sync verification) */
+      fingerprint() {
+        const names = Array.from(this.secrets.keys()).sort();
+        const hash = createHash("sha256");
+        for (const name of names) {
+          hash.update(name + ":");
+          hash.update(this.secrets.get(name).value);
+          hash.update("\n");
+        }
+        return hash.digest("base64url").slice(0, 16);
+      }
+    };
+  }
+});
+
+// packages/cli/dist/tui/p2p/peer-mesh.js
 import { EventEmitter as EventEmitter4 } from "node:events";
+import { createServer as createServer3 } from "node:http";
+import { randomBytes as randomBytes7, createHash as createHash2, generateKeyPairSync } from "node:crypto";
+var PING_INTERVAL_MS, PEER_TIMEOUT_MS, GOSSIP_INTERVAL_MS, MAX_PEERS, PeerMesh;
+var init_peer_mesh = __esm({
+  "packages/cli/dist/tui/p2p/peer-mesh.js"() {
+    "use strict";
+    init_wrapper();
+    PING_INTERVAL_MS = 3e4;
+    PEER_TIMEOUT_MS = 9e4;
+    GOSSIP_INTERVAL_MS = 6e4;
+    MAX_PEERS = 50;
+    PeerMesh = class extends EventEmitter4 {
+      options;
+      /** This node's unique peer ID (hash of public key) */
+      peerId;
+      /** Ed25519 keypair for identity */
+      privateKey;
+      publicKey;
+      /** Known peers (peerId → PeerInfo) */
+      peers = /* @__PURE__ */ new Map();
+      /** Active WebSocket connections (peerId → WebSocket) */
+      connections = /* @__PURE__ */ new Map();
+      /** Pending inference request callbacks (msgId → resolver) */
+      pendingRequests = /* @__PURE__ */ new Map();
+      server = null;
+      wss = null;
+      pingTimer = null;
+      gossipTimer = null;
+      _port = 0;
+      _authKey;
+      capabilities;
+      displayName;
+      get port() {
+        return this._port;
+      }
+      get authKey() {
+        return this._authKey;
+      }
+      get peerCount() {
+        return this.peers.size;
+      }
+      get connectedCount() {
+        return this.connections.size;
+      }
+      constructor(options) {
+        super();
+        this.options = options;
+        const { publicKey, privateKey } = generateKeyPairSync("ed25519");
+        this.publicKey = publicKey.export({ type: "spki", format: "der" });
+        this.privateKey = privateKey.export({ type: "pkcs8", format: "der" });
+        this.peerId = createHash2("sha256").update(this.publicKey).digest("base64url").slice(0, 22);
+        this.capabilities = options.capabilities;
+        this.displayName = options.displayName;
+        this._authKey = options.authKey ?? randomBytes7(24).toString("base64url");
+      }
+      // ── Lifecycle ───────────────────────────────────────────────────────────
+      /** Start the mesh node — creates WS server and connects to bootstrap peers */
+      async start() {
+        const port = await this.findFreePort();
+        this._port = port;
+        this.server = createServer3();
+        this.wss = new import_websocket_server.default({ server: this.server });
+        this.wss.on("connection", (ws, req) => {
+          this.handleInboundConnection(ws, req.url ?? "");
+        });
+        await new Promise((resolve28, reject) => {
+          this.server.listen(port, "127.0.0.1", () => resolve28());
+          this.server.on("error", reject);
+        });
+        this.pingTimer = setInterval(() => this.pingAll(), PING_INTERVAL_MS);
+        this.gossipTimer = setInterval(() => this.gossip(), GOSSIP_INTERVAL_MS);
+        if (this.options.bootstrapPeers) {
+          for (const endpoint of this.options.bootstrapPeers) {
+            this.connectToPeer(endpoint).catch(() => {
+            });
+          }
+        }
+        this.emit("started", port);
+        return port;
+      }
+      /** Stop the mesh node */
+      async stop() {
+        if (this.pingTimer) {
+          clearInterval(this.pingTimer);
+          this.pingTimer = null;
+        }
+        if (this.gossipTimer) {
+          clearInterval(this.gossipTimer);
+          this.gossipTimer = null;
+        }
+        for (const [peerId, ws] of this.connections) {
+          this.sendMsg(ws, "bye", {});
+          ws.close(1e3, "shutting down");
+        }
+        this.connections.clear();
+        for (const [, pending] of this.pendingRequests) {
+          clearTimeout(pending.timeout);
+          pending.reject(new Error("Mesh shutting down"));
+        }
+        this.pendingRequests.clear();
+        if (this.wss) {
+          this.wss.close();
+          this.wss = null;
+        }
+        if (this.server) {
+          await new Promise((resolve28) => this.server.close(() => resolve28()));
+          this.server = null;
+        }
+        this.emit("stopped");
+      }
+      // ── Peer connections ────────────────────────────────────────────────────
+      /** Connect to a remote peer by endpoint URL */
+      async connectToPeer(endpoint, trust = "public") {
+        let wsUrl = endpoint;
+        if (wsUrl.startsWith("https://"))
+          wsUrl = wsUrl.replace("https://", "wss://");
+        else if (wsUrl.startsWith("http://"))
+          wsUrl = wsUrl.replace("http://", "ws://");
+        else if (!wsUrl.startsWith("ws://") && !wsUrl.startsWith("wss://"))
+          wsUrl = `ws://${wsUrl}`;
+        if (!wsUrl.includes("/p2p"))
+          wsUrl += "/p2p";
+        wsUrl += `?key=${encodeURIComponent(this._authKey)}`;
+        return new Promise((resolve28, reject) => {
+          const ws = new import_websocket.default(wsUrl, { handshakeTimeout: 1e4 });
+          let resolved = false;
+          const timeout = setTimeout(() => {
+            if (!resolved) {
+              resolved = true;
+              ws.close();
+              reject(new Error("Connection timeout"));
+            }
+          }, 15e3);
+          ws.on("open", () => {
+            this.sendMsg(ws, "hello", {
+              peerId: this.peerId,
+              displayName: this.displayName,
+              capabilities: this.capabilities,
+              endpoint,
+              publicKey: this.publicKey.toString("base64url")
+            });
+          });
+          ws.on("message", (data) => {
+            try {
+              const msg = JSON.parse(data.toString());
+              if (msg.type === "hello_ack" && !resolved) {
+                resolved = true;
+                clearTimeout(timeout);
+                const payload = msg.payload;
+                const peer = {
+                  peerId: payload.peerId,
+                  displayName: payload.displayName,
+                  endpoint,
+                  trust,
+                  capabilities: payload.capabilities,
+                  lastSeen: (/* @__PURE__ */ new Date()).toISOString(),
+                  latencyMs: 0,
+                  connected: true
+                };
+                this.peers.set(peer.peerId, peer);
+                this.connections.set(peer.peerId, ws);
+                this.setupPeerHandlers(ws, peer.peerId);
+                this.emit("peer_connected", peer);
+                resolve28(peer);
+              } else {
+                this.handleMessage(msg, ws);
+              }
+            } catch {
+            }
+          });
+          ws.on("error", (err) => {
+            if (!resolved) {
+              resolved = true;
+              clearTimeout(timeout);
+              reject(err);
+            }
+          });
+          ws.on("close", () => {
+            if (!resolved) {
+              resolved = true;
+              clearTimeout(timeout);
+              reject(new Error("Connection closed before handshake"));
+            }
+          });
+        });
+      }
+      /** Set the trust tier for a known peer */
+      setTrust(peerId, trust) {
+        const peer = this.peers.get(peerId);
+        if (peer) {
+          peer.trust = trust;
+          return true;
+        }
+        return false;
+      }
+      /** Get all known peers */
+      getPeers() {
+        return Array.from(this.peers.values());
+      }
+      /** Get connected peers */
+      getConnectedPeers() {
+        return Array.from(this.peers.values()).filter((p) => p.connected);
+      }
+      /** Find peers that can serve a given model */
+      findPeersForModel(model) {
+        return this.getConnectedPeers().filter((p) => p.capabilities.models.some((m) => m === model || m.startsWith(model)));
+      }
+      // ── Inference routing ──────────────────────────────────────────────────
+      /**
+       * Send an inference request to a specific peer.
+       * Returns a promise that resolves when the response arrives.
+       */
+      async requestInference(peerId, request, timeoutMs = 12e4) {
+        const ws = this.connections.get(peerId);
+        if (!ws || ws.readyState !== import_websocket.default.OPEN) {
+          throw new Error(`Peer ${peerId} not connected`);
+        }
+        const msgId = randomBytes7(8).toString("hex");
+        return new Promise((resolve28, reject) => {
+          const timeout = setTimeout(() => {
+            this.pendingRequests.delete(msgId);
+            reject(new Error(`Inference timeout (${timeoutMs}ms)`));
+          }, timeoutMs);
+          this.pendingRequests.set(msgId, { resolve: resolve28, reject, timeout, chunks: [] });
+          this.sendMsg(ws, "infer_request", request, msgId);
+        });
+      }
+      // ── Inbound connection handling ─────────────────────────────────────────
+      handleInboundConnection(ws, url) {
+        const urlObj = new URL(url, "http://localhost");
+        const key = urlObj.searchParams.get("key");
+        if (key !== this._authKey) {
+          ws.close(4001, "Unauthorized");
+          return;
+        }
+        const helloTimeout = setTimeout(() => ws.close(4002, "Hello timeout"), 1e4);
+        ws.once("message", (data) => {
+          clearTimeout(helloTimeout);
+          try {
+            const msg = JSON.parse(data.toString());
+            if (msg.type !== "hello") {
+              ws.close(4003, "Expected hello");
+              return;
+            }
+            const payload = msg.payload;
+            if (payload.peerId === this.peerId) {
+              ws.close(4004, "Self-connection");
+              return;
+            }
+            const peer = {
+              peerId: payload.peerId,
+              displayName: payload.displayName,
+              endpoint: payload.endpoint,
+              trust: "public",
+              // inbound connections start at public trust
+              capabilities: payload.capabilities,
+              lastSeen: (/* @__PURE__ */ new Date()).toISOString(),
+              latencyMs: 0,
+              connected: true
+            };
+            const existing = this.peers.get(peer.peerId);
+            if (existing) {
+              peer.trust = existing.trust;
+            }
+            this.peers.set(peer.peerId, peer);
+            this.connections.set(peer.peerId, ws);
+            this.sendMsg(ws, "hello_ack", {
+              peerId: this.peerId,
+              displayName: this.displayName,
+              capabilities: this.capabilities
+            });
+            this.setupPeerHandlers(ws, peer.peerId);
+            this.emit("peer_connected", peer);
+          } catch {
+            ws.close(4005, "Malformed hello");
+          }
+        });
+      }
+      setupPeerHandlers(ws, peerId) {
+        ws.on("message", (data) => {
+          try {
+            const msg = JSON.parse(data.toString());
+            this.handleMessage(msg, ws);
+          } catch {
+          }
+        });
+        ws.on("close", () => {
+          this.connections.delete(peerId);
+          const peer = this.peers.get(peerId);
+          if (peer) {
+            peer.connected = false;
+            this.emit("peer_disconnected", peer);
+          }
+        });
+        ws.on("error", () => {
+          this.connections.delete(peerId);
+          const peer = this.peers.get(peerId);
+          if (peer) {
+            peer.connected = false;
+            this.emit("peer_error", peer);
+          }
+        });
+      }
+      // ── Message handling ────────────────────────────────────────────────────
+      handleMessage(msg, ws) {
+        const peer = this.peers.get(msg.from);
+        if (peer)
+          peer.lastSeen = (/* @__PURE__ */ new Date()).toISOString();
+        switch (msg.type) {
+          case "ping":
+            this.sendMsg(ws, "pong", { ts: msg.ts }, msg.msgId);
+            break;
+          case "pong":
+            if (peer) {
+              const sent = new Date(msg.ts).getTime();
+              peer.latencyMs = Date.now() - sent;
+            }
+            break;
+          case "capabilities":
+            if (peer) {
+              peer.capabilities = msg.payload;
+              this.emit("peer_capabilities", peer);
+            }
+            break;
+          case "peer_list": {
+            const peerList = msg.payload;
+            for (const p of peerList) {
+              if (p.peerId === this.peerId)
+                continue;
+              if (this.peers.has(p.peerId))
+                continue;
+              if (this.peers.size >= MAX_PEERS)
+                break;
+              this.connectToPeer(p.endpoint).catch(() => {
+              });
+            }
+            break;
+          }
+          case "infer_request":
+            this.emit("infer_request", {
+              from: msg.from,
+              msgId: msg.msgId,
+              request: msg.payload,
+              respond: (response) => {
+                this.sendMsg(ws, "infer_response", response, msg.msgId);
+              },
+              error: (error) => {
+                this.sendMsg(ws, "infer_error", { error }, msg.msgId);
+              }
+            });
+            break;
+          case "infer_response": {
+            const pending = this.pendingRequests.get(msg.msgId);
+            if (pending) {
+              clearTimeout(pending.timeout);
+              this.pendingRequests.delete(msg.msgId);
+              pending.resolve(msg.payload);
+            }
+            break;
+          }
+          case "infer_stream": {
+            const streamPending = this.pendingRequests.get(msg.msgId);
+            if (streamPending) {
+              const chunk = msg.payload;
+              streamPending.chunks.push(chunk.content);
+              this.emit("infer_stream", { msgId: msg.msgId, chunk });
+              if (chunk.done) {
+                clearTimeout(streamPending.timeout);
+                this.pendingRequests.delete(msg.msgId);
+                streamPending.resolve({
+                  content: streamPending.chunks.join(""),
+                  usage: chunk.usage,
+                  done: true
+                });
+              }
+            }
+            break;
+          }
+          case "infer_error": {
+            const errPending = this.pendingRequests.get(msg.msgId);
+            if (errPending) {
+              clearTimeout(errPending.timeout);
+              this.pendingRequests.delete(msg.msgId);
+              const payload = msg.payload;
+              errPending.reject(new Error(payload.error));
+            }
+            break;
+          }
+          case "bye":
+            ws.close(1e3, "Peer disconnected");
+            break;
+          default:
+            break;
+        }
+      }
+      // ── Heartbeat & gossip ─────────────────────────────────────────────────
+      pingAll() {
+        const now = Date.now();
+        for (const [peerId, ws] of this.connections) {
+          if (ws.readyState === import_websocket.default.OPEN) {
+            this.sendMsg(ws, "ping", { ts: (/* @__PURE__ */ new Date()).toISOString() });
+          }
+          const peer = this.peers.get(peerId);
+          if (peer) {
+            const lastSeen = new Date(peer.lastSeen).getTime();
+            if (now - lastSeen > PEER_TIMEOUT_MS) {
+              peer.connected = false;
+              ws.close(4006, "Timeout");
+              this.connections.delete(peerId);
+              this.emit("peer_timeout", peer);
+            }
+          }
+        }
+      }
+      gossip() {
+        const peerList = Array.from(this.peers.values()).filter((p) => p.connected).map((p) => ({ endpoint: p.endpoint, peerId: p.peerId, displayName: p.displayName }));
+        for (const [, ws] of this.connections) {
+          if (ws.readyState === import_websocket.default.OPEN) {
+            this.sendMsg(ws, "peer_list", peerList);
+          }
+        }
+      }
+      /** Update this node's capabilities and broadcast to all peers */
+      updateCapabilities(caps) {
+        Object.assign(this.capabilities, caps);
+        for (const [, ws] of this.connections) {
+          if (ws.readyState === import_websocket.default.OPEN) {
+            this.sendMsg(ws, "capabilities", this.capabilities);
+          }
+        }
+      }
+      // ── Helpers ─────────────────────────────────────────────────────────────
+      sendMsg(ws, type, payload, msgId) {
+        if (ws.readyState !== import_websocket.default.OPEN)
+          return;
+        const msg = {
+          type,
+          from: this.peerId,
+          msgId: msgId ?? randomBytes7(8).toString("hex"),
+          ts: (/* @__PURE__ */ new Date()).toISOString(),
+          payload
+        };
+        ws.send(JSON.stringify(msg));
+      }
+      findFreePort() {
+        return new Promise((resolve28, reject) => {
+          const srv = createServer3();
+          srv.listen(0, "127.0.0.1", () => {
+            const addr = srv.address();
+            if (addr && typeof addr === "object") {
+              const port = addr.port;
+              srv.close(() => resolve28(port));
+            } else {
+              srv.close(() => reject(new Error("Could not find free port")));
+            }
+          });
+          srv.on("error", reject);
+        });
+      }
+    };
+  }
+});
+
+// packages/cli/dist/tui/p2p/inference-router.js
+import { EventEmitter as EventEmitter5 } from "node:events";
+var TRUST_WEIGHTS, InferenceRouter;
+var init_inference_router = __esm({
+  "packages/cli/dist/tui/p2p/inference-router.js"() {
+    "use strict";
+    init_types();
+    TRUST_WEIGHTS = {
+      local: 10,
+      tee: 8,
+      verified: 5,
+      public: 2
+    };
+    InferenceRouter = class extends EventEmitter5 {
+      mesh;
+      vault;
+      defaultTimeoutMs;
+      minTrust;
+      /** Stats */
+      _totalRouted = 0;
+      _totalRedacted = 0;
+      _totalErrors = 0;
+      get totalRouted() {
+        return this._totalRouted;
+      }
+      get totalRedacted() {
+        return this._totalRedacted;
+      }
+      get totalErrors() {
+        return this._totalErrors;
+      }
+      constructor(options) {
+        super();
+        this.mesh = options.mesh;
+        this.vault = options.vault;
+        this.defaultTimeoutMs = options.defaultTimeoutMs ?? 12e4;
+        this.minTrust = options.minTrust ?? "public";
+        if (options.requireAuth) {
+          this.minTrust = "verified";
+        }
+      }
+      // ── Route discovery ─────────────────────────────────────────────────────
+      /**
+       * Find all available routes for a given model, ranked by score.
+       */
+      findRoutes(model) {
+        const peers = this.mesh.findPeersForModel(model);
+        const minLevel = trustLevel(this.minTrust);
+        return peers.filter((p) => trustLevel(p.trust) >= minLevel).map((p) => this.scoreRoute(p, model)).sort((a, b) => b.score - a.score);
+      }
+      /**
+       * Find the best route for a given model.
+       */
+      bestRoute(model) {
+        const routes = this.findRoutes(model);
+        return routes.length > 0 ? routes[0] : null;
+      }
+      // ── Inference ──────────────────────────────────────────────────────────
+      /**
+       * Route an inference request to the best available peer.
+       *
+       * This is the main entry point. It handles:
+       *   1. Peer selection
+       *   2. Secret redaction based on peer trust
+       *   3. Request dispatch
+       *   4. Secret injection on response
+       */
+      async infer(model, messages, options) {
+        let peer;
+        if (options?.peerId) {
+          const found = this.mesh.getPeers().find((p) => p.peerId === options.peerId);
+          if (!found || !found.connected) {
+            throw new Error(`Peer ${options.peerId} not available`);
+          }
+          peer = found;
+        } else {
+          const minTrust = options?.minTrust ?? this.minTrust;
+          const routes = this.findRoutes(model);
+          const filtered = routes.filter((r) => trustLevel(r.trust) >= trustLevel(minTrust));
+          if (filtered.length === 0) {
+            throw new Error(`No available peers for model "${model}" at trust >= ${minTrust}`);
+          }
+          peer = filtered[0].peer;
+        }
+        const requiresRedaction = trustLevel(peer.trust) < trustLevel("local");
+        let redactedCount = 0;
+        const redactedMessages = messages.map((msg) => {
+          const original = msg.content;
+          const redacted = requiresRedaction ? this.vault.redact(original, peer.trust) : original;
+          if (redacted !== original)
+            redactedCount++;
+          return { ...msg, content: redacted };
+        });
+        let redactedTools = options?.tools;
+        if (requiresRedaction && redactedTools) {
+          redactedTools = redactedTools.map((t) => ({
+            ...t,
+            function: {
+              ...t.function,
+              description: this.vault.redact(t.function.description, peer.trust)
+            }
+          }));
+        }
+        const request = {
+          model,
+          messages: redactedMessages,
+          tools: redactedTools,
+          temperature: options?.temperature,
+          maxTokens: options?.maxTokens,
+          stream: options?.stream
+        };
+        this.emit("routing", { peer, redactedCount, model });
+        this._totalRouted++;
+        if (redactedCount > 0)
+          this._totalRedacted++;
+        try {
+          const response = await this.mesh.requestInference(peer.peerId, request, options?.timeoutMs ?? this.defaultTimeoutMs);
+          const injectedContent = this.vault.inject(response.content);
+          const injectedToolCalls = response.toolCalls?.map((tc) => ({
+            ...tc,
+            function: {
+              ...tc.function,
+              arguments: this.vault.inject(tc.function.arguments)
+            }
+          }));
+          const result = {
+            content: injectedContent,
+            toolCalls: injectedToolCalls,
+            usage: response.usage,
+            peer,
+            wasRedacted: redactedCount > 0,
+            redactedCount
+          };
+          this.emit("completed", result);
+          return result;
+        } catch (err) {
+          this._totalErrors++;
+          this.emit("error", { peer, error: err });
+          throw err;
+        }
+      }
+      /**
+       * Handle an inbound inference request from a peer.
+       * Called by the mesh node when it receives an infer_request.
+       *
+       * This is the "server side" — we perform inference locally and return results.
+       * The response text may contain placeholders from the requester's vault,
+       * which is fine — we don't have their secrets and don't need them.
+       */
+      async handleInboundRequest(request, inferFn) {
+        for (const msg of request.messages) {
+          const found = this.vault.scan(msg.content);
+          if (found.length > 0) {
+            this.emit("leaked_secrets_detected", {
+              count: found.length,
+              patterns: found.map((f) => f.slice(0, 4) + "***")
+            });
+          }
+        }
+        return inferFn(request);
+      }
+      // ── Scoring ────────────────────────────────────────────────────────────
+      scoreRoute(peer, model) {
+        const trust = peer.trust;
+        const trustWeight = TRUST_WEIGHTS[trust];
+        const latencyFactor = 1 / (1 + peer.latencyMs / 100);
+        const loadFactor = 1 - peer.capabilities.load;
+        const modelExact = peer.capabilities.models.includes(model) ? 1 : 0.8;
+        const score = trustWeight * latencyFactor * loadFactor * modelExact;
+        return {
+          peer,
+          trust,
+          latencyMs: peer.latencyMs,
+          requiresRedaction: trustLevel(trust) < trustLevel("local"),
+          score
+        };
+      }
+      // ── Utility ────────────────────────────────────────────────────────────
+      /** Get a summary of routing statistics */
+      getStats() {
+        const peers = this.mesh.getConnectedPeers();
+        const models = /* @__PURE__ */ new Set();
+        for (const p of peers) {
+          for (const m of p.capabilities.models)
+            models.add(m);
+        }
+        return {
+          totalRouted: this._totalRouted,
+          totalRedacted: this._totalRedacted,
+          totalErrors: this._totalErrors,
+          connectedPeers: peers.length,
+          availableModels: Array.from(models)
+        };
+      }
+    };
+  }
+});
+
+// packages/cli/dist/tui/p2p/index.js
+var init_p2p = __esm({
+  "packages/cli/dist/tui/p2p/index.js"() {
+    "use strict";
+    init_secret_vault();
+    init_peer_mesh();
+    init_inference_router();
+    init_types();
+  }
+});
+
+// packages/cli/dist/tui/call-agent.js
+import { EventEmitter as EventEmitter6 } from "node:events";
 import crypto2 from "node:crypto";
 function adaptTool(tool) {
   return {
@@ -22501,7 +23451,7 @@ var init_call_agent = __esm({
       }
     };
     _globalFeed = null;
-    CallSubAgent = class extends EventEmitter4 {
+    CallSubAgent = class extends EventEmitter6 {
       tier;
       clientId;
       runner = null;
@@ -23102,7 +24052,7 @@ Approach this task thoughtfully:
 });
 
 // packages/prompts/dist/index.js
-import { join as join29, dirname as dirname11 } from "node:path";
+import { join as join30, dirname as dirname12 } from "node:path";
 import { fileURLToPath as fileURLToPath8 } from "node:url";
 var _dir, _packageRoot;
 var init_dist6 = __esm({
@@ -23112,27 +24062,27 @@ var init_dist6 = __esm({
     init_render2();
     init_task_templates();
     init_render2();
-    _dir = dirname11(fileURLToPath8(import.meta.url));
-    _packageRoot = join29(_dir, "..");
+    _dir = dirname12(fileURLToPath8(import.meta.url));
+    _packageRoot = join30(_dir, "..");
   }
 });
 
 // packages/cli/dist/tui/oa-directory.js
-import { existsSync as existsSync21, mkdirSync as mkdirSync7, readFileSync as readFileSync15, writeFileSync as writeFileSync7, readdirSync as readdirSync7, statSync as statSync9, unlinkSync as unlinkSync3 } from "node:fs";
-import { join as join30, relative as relative2, basename as basename9, extname as extname8 } from "node:path";
+import { existsSync as existsSync22, mkdirSync as mkdirSync8, readFileSync as readFileSync16, writeFileSync as writeFileSync8, readdirSync as readdirSync7, statSync as statSync9, unlinkSync as unlinkSync3 } from "node:fs";
+import { join as join31, relative as relative2, basename as basename9, extname as extname8 } from "node:path";
 import { homedir as homedir9 } from "node:os";
 function initOaDirectory(repoRoot) {
-  const oaPath = join30(repoRoot, OA_DIR);
+  const oaPath = join31(repoRoot, OA_DIR);
   for (const sub of SUBDIRS) {
-    mkdirSync7(join30(oaPath, sub), { recursive: true });
+    mkdirSync8(join31(oaPath, sub), { recursive: true });
   }
   try {
-    const gitignorePath = join30(repoRoot, ".gitignore");
+    const gitignorePath = join31(repoRoot, ".gitignore");
     const settingsPattern = ".oa/settings.json";
-    if (existsSync21(gitignorePath)) {
-      const content = readFileSync15(gitignorePath, "utf-8");
+    if (existsSync22(gitignorePath)) {
+      const content = readFileSync16(gitignorePath, "utf-8");
       if (!content.includes(settingsPattern)) {
-        writeFileSync7(gitignorePath, content.trimEnd() + "\n" + settingsPattern + "\n", "utf-8");
+        writeFileSync8(gitignorePath, content.trimEnd() + "\n" + settingsPattern + "\n", "utf-8");
       }
     }
   } catch {
@@ -23140,41 +24090,41 @@ function initOaDirectory(repoRoot) {
   return oaPath;
 }
 function hasOaDirectory(repoRoot) {
-  return existsSync21(join30(repoRoot, OA_DIR, "index"));
+  return existsSync22(join31(repoRoot, OA_DIR, "index"));
 }
 function loadProjectSettings(repoRoot) {
-  const settingsPath = join30(repoRoot, OA_DIR, "settings.json");
+  const settingsPath = join31(repoRoot, OA_DIR, "settings.json");
   try {
-    if (existsSync21(settingsPath)) {
-      return JSON.parse(readFileSync15(settingsPath, "utf-8"));
+    if (existsSync22(settingsPath)) {
+      return JSON.parse(readFileSync16(settingsPath, "utf-8"));
     }
   } catch {
   }
   return {};
 }
 function saveProjectSettings(repoRoot, settings) {
-  const oaPath = join30(repoRoot, OA_DIR);
-  mkdirSync7(oaPath, { recursive: true });
+  const oaPath = join31(repoRoot, OA_DIR);
+  mkdirSync8(oaPath, { recursive: true });
   const existing = loadProjectSettings(repoRoot);
   const merged = { ...existing, ...settings };
-  writeFileSync7(join30(oaPath, "settings.json"), JSON.stringify(merged, null, 2) + "\n", { encoding: "utf-8", mode: 384 });
+  writeFileSync8(join31(oaPath, "settings.json"), JSON.stringify(merged, null, 2) + "\n", { encoding: "utf-8", mode: 384 });
 }
 function loadGlobalSettings() {
-  const settingsPath = join30(homedir9(), ".open-agents", "settings.json");
+  const settingsPath = join31(homedir9(), ".open-agents", "settings.json");
   try {
-    if (existsSync21(settingsPath)) {
-      return JSON.parse(readFileSync15(settingsPath, "utf-8"));
+    if (existsSync22(settingsPath)) {
+      return JSON.parse(readFileSync16(settingsPath, "utf-8"));
     }
   } catch {
   }
   return {};
 }
 function saveGlobalSettings(settings) {
-  const dir = join30(homedir9(), ".open-agents");
-  mkdirSync7(dir, { recursive: true });
+  const dir = join31(homedir9(), ".open-agents");
+  mkdirSync8(dir, { recursive: true });
   const existing = loadGlobalSettings();
   const merged = { ...existing, ...settings };
-  writeFileSync7(join30(dir, "settings.json"), JSON.stringify(merged, null, 2) + "\n", { encoding: "utf-8", mode: 384 });
+  writeFileSync8(join31(dir, "settings.json"), JSON.stringify(merged, null, 2) + "\n", { encoding: "utf-8", mode: 384 });
 }
 function resolveSettings(repoRoot) {
   const global = loadGlobalSettings();
@@ -23189,12 +24139,12 @@ function discoverContextFiles(repoRoot, maxContentLen = 8e3) {
   while (dir && !visited.has(dir)) {
     visited.add(dir);
     for (const name of CONTEXT_FILES) {
-      const filePath = join30(dir, name);
+      const filePath = join31(dir, name);
       const normalizedName = name.toLowerCase();
-      if (existsSync21(filePath) && !seen.has(filePath)) {
+      if (existsSync22(filePath) && !seen.has(filePath)) {
         seen.add(filePath);
         try {
-          let content = readFileSync15(filePath, "utf-8");
+          let content = readFileSync16(filePath, "utf-8");
           if (content.length > maxContentLen) {
             content = content.slice(0, maxContentLen) + "\n\n...(truncated)";
           }
@@ -23208,11 +24158,11 @@ function discoverContextFiles(repoRoot, maxContentLen = 8e3) {
         }
       }
     }
-    const projectMap = join30(dir, OA_DIR, "context", "project-map.md");
-    if (existsSync21(projectMap) && !seen.has(projectMap)) {
+    const projectMap = join31(dir, OA_DIR, "context", "project-map.md");
+    if (existsSync22(projectMap) && !seen.has(projectMap)) {
       seen.add(projectMap);
       try {
-        let content = readFileSync15(projectMap, "utf-8");
+        let content = readFileSync16(projectMap, "utf-8");
         if (content.length > maxContentLen) {
           content = content.slice(0, maxContentLen) + "\n\n...(truncated)";
         }
@@ -23224,7 +24174,7 @@ function discoverContextFiles(repoRoot, maxContentLen = 8e3) {
       } catch {
       }
     }
-    const parent = join30(dir, "..");
+    const parent = join31(dir, "..");
     if (parent === dir)
       break;
     dir = parent;
@@ -23242,9 +24192,9 @@ function discoverContextFiles(repoRoot, maxContentLen = 8e3) {
   return found;
 }
 function readIndexMeta(repoRoot) {
-  const metaPath = join30(repoRoot, OA_DIR, "index", "meta.json");
+  const metaPath = join31(repoRoot, OA_DIR, "index", "meta.json");
   try {
-    return JSON.parse(readFileSync15(metaPath, "utf-8"));
+    return JSON.parse(readFileSync16(metaPath, "utf-8"));
   } catch {
     return null;
   }
@@ -23295,28 +24245,28 @@ ${tree}\`\`\`
     sections.push("");
   }
   const content = sections.join("\n");
-  const contextDir = join30(repoRoot, OA_DIR, "context");
-  mkdirSync7(contextDir, { recursive: true });
-  writeFileSync7(join30(contextDir, "project-map.md"), content, "utf-8");
+  const contextDir = join31(repoRoot, OA_DIR, "context");
+  mkdirSync8(contextDir, { recursive: true });
+  writeFileSync8(join31(contextDir, "project-map.md"), content, "utf-8");
   return content;
 }
 function saveSession(repoRoot, session) {
-  const historyDir = join30(repoRoot, OA_DIR, "history");
-  mkdirSync7(historyDir, { recursive: true });
-  writeFileSync7(join30(historyDir, `${session.id}.json`), JSON.stringify(session, null, 2), "utf-8");
+  const historyDir = join31(repoRoot, OA_DIR, "history");
+  mkdirSync8(historyDir, { recursive: true });
+  writeFileSync8(join31(historyDir, `${session.id}.json`), JSON.stringify(session, null, 2), "utf-8");
 }
 function loadRecentSessions(repoRoot, limit = 5) {
-  const historyDir = join30(repoRoot, OA_DIR, "history");
-  if (!existsSync21(historyDir))
+  const historyDir = join31(repoRoot, OA_DIR, "history");
+  if (!existsSync22(historyDir))
     return [];
   try {
     const files = readdirSync7(historyDir).filter((f) => f.endsWith(".json") && f !== "pending-task.json").map((f) => {
-      const stat5 = statSync9(join30(historyDir, f));
+      const stat5 = statSync9(join31(historyDir, f));
       return { file: f, mtime: stat5.mtimeMs };
     }).sort((a, b) => b.mtime - a.mtime).slice(0, limit);
     return files.map((f) => {
       try {
-        return JSON.parse(readFileSync15(join30(historyDir, f.file), "utf-8"));
+        return JSON.parse(readFileSync16(join31(historyDir, f.file), "utf-8"));
       } catch {
         return null;
       }
@@ -23326,16 +24276,16 @@ function loadRecentSessions(repoRoot, limit = 5) {
   }
 }
 function savePendingTask(repoRoot, task) {
-  const historyDir = join30(repoRoot, OA_DIR, "history");
-  mkdirSync7(historyDir, { recursive: true });
-  writeFileSync7(join30(historyDir, PENDING_TASK_FILE), JSON.stringify(task, null, 2) + "\n", "utf-8");
+  const historyDir = join31(repoRoot, OA_DIR, "history");
+  mkdirSync8(historyDir, { recursive: true });
+  writeFileSync8(join31(historyDir, PENDING_TASK_FILE), JSON.stringify(task, null, 2) + "\n", "utf-8");
 }
 function loadPendingTask(repoRoot) {
-  const filePath = join30(repoRoot, OA_DIR, "history", PENDING_TASK_FILE);
+  const filePath = join31(repoRoot, OA_DIR, "history", PENDING_TASK_FILE);
   try {
-    if (!existsSync21(filePath))
+    if (!existsSync22(filePath))
       return null;
-    const data = JSON.parse(readFileSync15(filePath, "utf-8"));
+    const data = JSON.parse(readFileSync16(filePath, "utf-8"));
     try {
       unlinkSync3(filePath);
     } catch {
@@ -23346,13 +24296,13 @@ function loadPendingTask(repoRoot) {
   }
 }
 function saveSessionContext(repoRoot, entry) {
-  const contextDir = join30(repoRoot, OA_DIR, "context");
-  mkdirSync7(contextDir, { recursive: true });
-  const filePath = join30(contextDir, CONTEXT_SAVE_FILE);
+  const contextDir = join31(repoRoot, OA_DIR, "context");
+  mkdirSync8(contextDir, { recursive: true });
+  const filePath = join31(contextDir, CONTEXT_SAVE_FILE);
   let ctx;
   try {
-    if (existsSync21(filePath)) {
-      ctx = JSON.parse(readFileSync15(filePath, "utf-8"));
+    if (existsSync22(filePath)) {
+      ctx = JSON.parse(readFileSync16(filePath, "utf-8"));
     } else {
       ctx = { entries: [], maxEntries: MAX_CONTEXT_ENTRIES, updatedAt: "" };
     }
@@ -23364,14 +24314,14 @@ function saveSessionContext(repoRoot, entry) {
     ctx.entries = ctx.entries.slice(-ctx.maxEntries);
   }
   ctx.updatedAt = (/* @__PURE__ */ new Date()).toISOString();
-  writeFileSync7(filePath, JSON.stringify(ctx, null, 2) + "\n", "utf-8");
+  writeFileSync8(filePath, JSON.stringify(ctx, null, 2) + "\n", "utf-8");
 }
 function loadSessionContext(repoRoot) {
-  const filePath = join30(repoRoot, OA_DIR, "context", CONTEXT_SAVE_FILE);
+  const filePath = join31(repoRoot, OA_DIR, "context", CONTEXT_SAVE_FILE);
   try {
-    if (!existsSync21(filePath))
+    if (!existsSync22(filePath))
       return null;
-    return JSON.parse(readFileSync15(filePath, "utf-8"));
+    return JSON.parse(readFileSync16(filePath, "utf-8"));
   } catch {
     return null;
   }
@@ -23418,12 +24368,12 @@ function detectManifests(repoRoot) {
     { file: "docker-compose.yaml", type: "Docker Compose" }
   ];
   for (const check of checks) {
-    const filePath = join30(repoRoot, check.file);
-    if (existsSync21(filePath)) {
+    const filePath = join31(repoRoot, check.file);
+    if (existsSync22(filePath)) {
       let name;
       if (check.nameField) {
         try {
-          const data = JSON.parse(readFileSync15(filePath, "utf-8"));
+          const data = JSON.parse(readFileSync16(filePath, "utf-8"));
           name = data[check.nameField];
         } catch {
         }
@@ -23452,7 +24402,7 @@ function findKeyFiles(repoRoot) {
     { pattern: "CLAUDE.md", description: "Claude Code context" }
   ];
   for (const check of checks) {
-    if (existsSync21(join30(repoRoot, check.pattern))) {
+    if (existsSync22(join31(repoRoot, check.pattern))) {
       keyFiles.push({ path: check.pattern, description: check.description });
     }
   }
@@ -23478,12 +24428,12 @@ function buildDirTree(root, maxDepth, prefix = "", depth = 0) {
       if (entry.isDirectory()) {
         let fileCount = 0;
         try {
-          fileCount = readdirSync7(join30(root, entry.name)).filter((f) => !f.startsWith(".")).length;
+          fileCount = readdirSync7(join31(root, entry.name)).filter((f) => !f.startsWith(".")).length;
         } catch {
         }
         result += `${prefix}${connector}${entry.name}/ (${fileCount})
 `;
-        result += buildDirTree(join30(root, entry.name), maxDepth, childPrefix, depth + 1);
+        result += buildDirTree(join31(root, entry.name), maxDepth, childPrefix, depth + 1);
       } else if (depth < maxDepth) {
         result += `${prefix}${connector}${entry.name}
 `;
@@ -23537,8 +24487,8 @@ var init_oa_directory = __esm({
 // packages/cli/dist/tui/setup.js
 import * as readline from "node:readline";
 import { execSync as execSync20, spawn as spawn12 } from "node:child_process";
-import { existsSync as existsSync22, writeFileSync as writeFileSync8, mkdirSync as mkdirSync8 } from "node:fs";
-import { join as join31 } from "node:path";
+import { existsSync as existsSync23, writeFileSync as writeFileSync9, mkdirSync as mkdirSync9 } from "node:fs";
+import { join as join32 } from "node:path";
 import { homedir as homedir10, platform } from "node:os";
 function detectSystemSpecs() {
   let totalRamGB = 0;
@@ -23733,7 +24683,7 @@ async function installOllamaMac(rl) {
       execSync20('/bin/bash -c "$(curl -fsSL https://raw.githubusercontent.com/Homebrew/install/HEAD/install.sh)"', { stdio: "inherit", timeout: 6e5 });
       if (!hasCmd("brew")) {
         try {
-          const brewPrefix = existsSync22("/opt/homebrew/bin/brew") ? "/opt/homebrew" : "/usr/local";
+          const brewPrefix = existsSync23("/opt/homebrew/bin/brew") ? "/opt/homebrew" : "/usr/local";
           process.env["PATH"] = `${brewPrefix}/bin:${process.env["PATH"]}`;
         } catch {
         }
@@ -24207,10 +25157,10 @@ async function doSetup(config, rl) {
           `PARAMETER num_predict ${numPredict}`,
           `PARAMETER stop "<|endoftext|>"`
         ].join("\n");
-        const modelDir2 = join31(homedir10(), ".open-agents", "models");
-        mkdirSync8(modelDir2, { recursive: true });
-        const modelfilePath = join31(modelDir2, `Modelfile.${customName}`);
-        writeFileSync8(modelfilePath, modelfileContent + "\n", "utf8");
+        const modelDir2 = join32(homedir10(), ".open-agents", "models");
+        mkdirSync9(modelDir2, { recursive: true });
+        const modelfilePath = join32(modelDir2, `Modelfile.${customName}`);
+        writeFileSync9(modelfilePath, modelfileContent + "\n", "utf8");
         process.stdout.write(`  ${c2.dim("Creating model...")} `);
         execSync20(`ollama create ${customName} -f ${modelfilePath}`, {
           stdio: "pipe",
@@ -24255,7 +25205,7 @@ async function isModelAvailable(config) {
 }
 function isFirstRun() {
   try {
-    return !existsSync22(join31(homedir10(), ".open-agents", "config.json"));
+    return !existsSync23(join32(homedir10(), ".open-agents", "config.json"));
   } catch {
     return true;
   }
@@ -24292,7 +25242,7 @@ function detectPkgManager() {
   return null;
 }
 function getVenvDir() {
-  return join31(homedir10(), ".open-agents", "venv");
+  return join32(homedir10(), ".open-agents", "venv");
 }
 function hasVenvModule() {
   try {
@@ -24304,8 +25254,8 @@ function hasVenvModule() {
 }
 function ensureVenv(log) {
   const venvDir = getVenvDir();
-  const venvPip = join31(venvDir, "bin", "pip");
-  if (existsSync22(venvPip))
+  const venvPip = join32(venvDir, "bin", "pip");
+  if (existsSync23(venvPip))
     return venvDir;
   log("Creating Python venv for vision deps...");
   if (!hasCmd("python3")) {
@@ -24317,9 +25267,9 @@ function ensureVenv(log) {
     return null;
   }
   try {
-    mkdirSync8(join31(homedir10(), ".open-agents"), { recursive: true });
+    mkdirSync9(join32(homedir10(), ".open-agents"), { recursive: true });
     execSync20(`python3 -m venv "${venvDir}"`, { stdio: "pipe", timeout: 3e4 });
-    execSync20(`"${join31(venvDir, "bin", "pip")}" install --upgrade pip`, {
+    execSync20(`"${join32(venvDir, "bin", "pip")}" install --upgrade pip`, {
       stdio: "pipe",
       timeout: 6e4
     });
@@ -24528,15 +25478,15 @@ async function ensureVisionDeps(onInfo, getSudoPassword) {
     }
   }
   const venvDir = getVenvDir();
-  const venvBin = join31(venvDir, "bin");
-  const venvMoondream = join31(venvBin, "moondream-station");
+  const venvBin = join32(venvDir, "bin");
+  const venvMoondream = join32(venvBin, "moondream-station");
   const venv = ensureVenv(log);
-  if (venv && !hasCmd("moondream-station") && !existsSync22(venvMoondream)) {
-    const venvPip = join31(venvBin, "pip");
+  if (venv && !hasCmd("moondream-station") && !existsSync23(venvMoondream)) {
+    const venvPip = join32(venvBin, "pip");
     log("Installing moondream-station in ~/.open-agents/venv...");
     try {
       execSync20(`"${venvPip}" install moondream-station`, { stdio: "pipe", timeout: 3e5 });
-      if (existsSync22(venvMoondream)) {
+      if (existsSync23(venvMoondream)) {
         log("moondream-station installed successfully.");
       } else {
         try {
@@ -24553,8 +25503,8 @@ async function ensureVisionDeps(onInfo, getSudoPassword) {
     }
   }
   if (venv) {
-    const venvPython = join31(venvBin, "python");
-    const venvPip2 = join31(venvBin, "pip");
+    const venvPython = join32(venvBin, "python");
+    const venvPip2 = join32(venvBin, "pip");
     let ocrStackInstalled = false;
     try {
       execSync20(`"${venvPython}" -c "import cv2, pytesseract, numpy, PIL"`, { stdio: "pipe", timeout: 1e4 });
@@ -24663,10 +25613,10 @@ function createExpandedVariant(baseModel, specs, sizeGB) {
       `PARAMETER num_predict ${numPredict}`,
       `PARAMETER stop "<|endoftext|>"`
     ].join("\n");
-    const modelDir2 = join31(homedir10(), ".open-agents", "models");
-    mkdirSync8(modelDir2, { recursive: true });
-    const modelfilePath = join31(modelDir2, `Modelfile.${customName}`);
-    writeFileSync8(modelfilePath, modelfileContent + "\n", "utf8");
+    const modelDir2 = join32(homedir10(), ".open-agents", "models");
+    mkdirSync9(modelDir2, { recursive: true });
+    const modelfilePath = join32(modelDir2, `Modelfile.${customName}`);
+    writeFileSync9(modelfilePath, modelfileContent + "\n", "utf8");
     execSync20(`ollama create ${customName} -f ${modelfilePath}`, {
       stdio: "pipe",
       timeout: 12e4
@@ -25229,6 +26179,130 @@ async function handleSlashCommand(input, ctx) {
       }
       return "handled";
     }
+    case "p2p": {
+      if (!ctx.p2pStart) {
+        renderWarning("P2P mesh not available in this context.");
+        return "handled";
+      }
+      const p2pSub = arg?.split(/\s+/)[0] ?? "";
+      const p2pRest = arg?.slice(p2pSub.length).trim() ?? "";
+      if (p2pSub === "stop" || p2pSub === "off") {
+        if (ctx.isP2PActive?.()) {
+          await ctx.p2pStop?.();
+          renderInfo("P2P mesh stopped.");
+        } else {
+          renderWarning("P2P mesh not running.");
+        }
+        return "handled";
+      }
+      if (p2pSub === "status" || !p2pSub && ctx.isP2PActive?.()) {
+        if (ctx.isP2PActive?.()) {
+          process.stdout.write("\n" + (ctx.p2pStatus?.() ?? "") + "\n\n");
+        } else {
+          renderWarning("P2P mesh not running. Start with: /p2p start");
+        }
+        return "handled";
+      }
+      if (p2pSub === "connect") {
+        if (!ctx.isP2PActive?.()) {
+          renderWarning("Start mesh first: /p2p start");
+          return "handled";
+        }
+        if (!p2pRest) {
+          renderInfo("Usage: /p2p connect <endpoint> [--trust verified|tee|public]");
+          return "handled";
+        }
+        const parts = p2pRest.split(/\s+/);
+        const endpoint = parts[0];
+        const trustIdx = parts.indexOf("--trust");
+        const trust = trustIdx !== -1 ? parts[trustIdx + 1] : void 0;
+        try {
+          const peerId = await ctx.p2pConnect(endpoint, trust);
+          if (peerId) {
+            renderInfo(`Connected to peer: ${c2.bold(peerId)}`);
+          } else {
+            renderError("Failed to connect to peer.");
+          }
+        } catch (err) {
+          renderError(`Connection failed: ${err instanceof Error ? err.message : String(err)}`);
+        }
+        return "handled";
+      }
+      if (p2pSub === "start" || !p2pSub) {
+        if (ctx.isP2PActive?.()) {
+          process.stdout.write("\n" + (ctx.p2pStatus?.() ?? "") + "\n\n");
+          return "handled";
+        }
+        try {
+          const bootstrapPeers = p2pRest ? p2pRest.split(/[,\s]+/).filter(Boolean) : void 0;
+          const result = await ctx.p2pStart(bootstrapPeers);
+          renderInfo(`P2P mesh started. Peer ID: ${c2.bold(result.peerId)} (port ${result.port})`);
+          renderInfo("Connect peers with: /p2p connect <endpoint>");
+        } catch (err) {
+          renderError(`P2P start failed: ${err instanceof Error ? err.message : String(err)}`);
+        }
+        return "handled";
+      }
+      renderInfo("Usage: /p2p start [bootstrap-peers...]  |  /p2p connect <endpoint>  |  /p2p status  |  /p2p stop");
+      return "handled";
+    }
+    case "secrets":
+    case "secret":
+    case "vault": {
+      if (!ctx.secretSet) {
+        renderWarning("Secret vault not available in this context.");
+        return "handled";
+      }
+      const secSub = arg?.split(/\s+/)[0] ?? "";
+      const secRest = arg?.slice(secSub.length).trim() ?? "";
+      if (secSub === "set") {
+        const parts = secRest.split(/\s+/);
+        const name = parts[0];
+        const value = parts.slice(1).join(" ");
+        if (!name || !value) {
+          renderInfo("Usage: /secrets set <NAME> <value>");
+          return "handled";
+        }
+        ctx.secretSet(name, value);
+        renderInfo(`Secret "${name}" registered.`);
+        return "handled";
+      }
+      if (secSub === "delete" || secSub === "rm") {
+        if (!secRest) {
+          renderInfo("Usage: /secrets delete <NAME>");
+          return "handled";
+        }
+        const deleted = ctx.secretDelete(secRest);
+        if (deleted)
+          renderInfo(`Secret "${secRest}" removed.`);
+        else
+          renderWarning(`Secret "${secRest}" not found.`);
+        return "handled";
+      }
+      if (secSub === "import-env") {
+        const count = ctx.secretImportEnv();
+        renderInfo(`Imported ${count} secrets from environment variables.`);
+        return "handled";
+      }
+      const secrets = ctx.secretList();
+      if (secrets.length === 0) {
+        renderInfo("No secrets registered. Use: /secrets set <NAME> <value>");
+      } else {
+        process.stdout.write(`
+  ${c2.bold("Registered Secrets")} (${secrets.length})
+
+`);
+        for (const s of secrets) {
+          process.stdout.write(`  ${c2.cyan(s.name.padEnd(24))} min trust: ${c2.bold(s.minTrust)}
+`);
+        }
+        process.stdout.write(`
+  ${c2.dim("Secrets are redacted from prompts sent to peers below their trust tier.")}
+
+`);
+      }
+      return "handled";
+    }
     case "bruteforce":
     case "brute": {
       const isOn = ctx.bruteForceToggle();
@@ -25679,17 +26753,17 @@ async function handleUpdate(subcommand, ctx) {
   try {
     const { createRequire: createRequire4 } = await import("node:module");
     const { fileURLToPath: fileURLToPath11 } = await import("node:url");
-    const { dirname: dirname14, join: join45 } = await import("node:path");
-    const { existsSync: existsSync32 } = await import("node:fs");
+    const { dirname: dirname15, join: join46 } = await import("node:path");
+    const { existsSync: existsSync33 } = await import("node:fs");
     const req = createRequire4(import.meta.url);
-    const thisDir = dirname14(fileURLToPath11(import.meta.url));
+    const thisDir = dirname15(fileURLToPath11(import.meta.url));
     const candidates = [
-      join45(thisDir, "..", "package.json"),
-      join45(thisDir, "..", "..", "package.json"),
-      join45(thisDir, "..", "..", "..", "package.json")
+      join46(thisDir, "..", "package.json"),
+      join46(thisDir, "..", "..", "package.json"),
+      join46(thisDir, "..", "..", "..", "package.json")
     ];
     for (const pkgPath of candidates) {
-      if (existsSync32(pkgPath)) {
+      if (existsSync33(pkgPath)) {
         const pkg = req(pkgPath);
         if (pkg.name === "open-agents-ai" || pkg.name === "@open-agents/cli") {
           currentVersion = pkg.version ?? "0.0.0";
@@ -25892,8 +26966,8 @@ var init_commands = __esm({
 });
 
 // packages/cli/dist/tui/project-context.js
-import { existsSync as existsSync23, readFileSync as readFileSync16, readdirSync as readdirSync8 } from "node:fs";
-import { join as join32, basename as basename10 } from "node:path";
+import { existsSync as existsSync24, readFileSync as readFileSync17, readdirSync as readdirSync8 } from "node:fs";
+import { join as join33, basename as basename10 } from "node:path";
 import { execSync as execSync21 } from "node:child_process";
 import { homedir as homedir11, platform as platform2, release } from "node:os";
 function getModelTier(modelName) {
@@ -25928,10 +27002,10 @@ function loadProjectMap(repoRoot) {
   if (!hasOaDirectory(repoRoot)) {
     initOaDirectory(repoRoot);
   }
-  const mapPath = join32(repoRoot, OA_DIR, "context", "project-map.md");
-  if (existsSync23(mapPath)) {
+  const mapPath = join33(repoRoot, OA_DIR, "context", "project-map.md");
+  if (existsSync24(mapPath)) {
     try {
-      const content = readFileSync16(mapPath, "utf-8");
+      const content = readFileSync17(mapPath, "utf-8");
       return content;
     } catch {
     }
@@ -25972,31 +27046,31 @@ ${log}`);
 }
 function loadMemoryContext(repoRoot) {
   const sections = [];
-  const oaMemDir = join32(repoRoot, OA_DIR, "memory");
+  const oaMemDir = join33(repoRoot, OA_DIR, "memory");
   const oaEntries = loadMemoryDir(oaMemDir, "project");
   if (oaEntries)
     sections.push(oaEntries);
-  const legacyMemDir = join32(repoRoot, ".open-agents", "memory");
-  if (legacyMemDir !== oaMemDir && existsSync23(legacyMemDir)) {
+  const legacyMemDir = join33(repoRoot, ".open-agents", "memory");
+  if (legacyMemDir !== oaMemDir && existsSync24(legacyMemDir)) {
     const legacyEntries = loadMemoryDir(legacyMemDir, "project/legacy");
     if (legacyEntries)
       sections.push(legacyEntries);
   }
-  const globalMemDir = join32(homedir11(), ".open-agents", "memory");
+  const globalMemDir = join33(homedir11(), ".open-agents", "memory");
   const globalEntries = loadMemoryDir(globalMemDir, "global");
   if (globalEntries)
     sections.push(globalEntries);
   return sections.join("\n\n");
 }
 function loadMemoryDir(memDir, scope) {
-  if (!existsSync23(memDir))
+  if (!existsSync24(memDir))
     return "";
   const lines = [];
   try {
     const files = readdirSync8(memDir).filter((f) => f.endsWith(".json"));
     for (const file of files.slice(0, 10)) {
       try {
-        const raw = readFileSync16(join32(memDir, file), "utf-8");
+        const raw = readFileSync17(join33(memDir, file), "utf-8");
         const entries = JSON.parse(raw);
         const topic = basename10(file, ".json");
         const keys = Object.keys(entries);
@@ -27023,22 +28097,22 @@ var init_carousel = __esm({
 });
 
 // packages/cli/dist/tui/carousel-descriptors.js
-import { existsSync as existsSync24, readFileSync as readFileSync17, writeFileSync as writeFileSync9, mkdirSync as mkdirSync9, readdirSync as readdirSync9 } from "node:fs";
-import { join as join33, basename as basename11 } from "node:path";
+import { existsSync as existsSync25, readFileSync as readFileSync18, writeFileSync as writeFileSync10, mkdirSync as mkdirSync10, readdirSync as readdirSync9 } from "node:fs";
+import { join as join34, basename as basename11 } from "node:path";
 function loadToolProfile(repoRoot) {
-  const filePath = join33(repoRoot, OA_DIR, "context", TOOL_PROFILE_FILE);
+  const filePath = join34(repoRoot, OA_DIR, "context", TOOL_PROFILE_FILE);
   try {
-    if (!existsSync24(filePath))
+    if (!existsSync25(filePath))
       return null;
-    return JSON.parse(readFileSync17(filePath, "utf-8"));
+    return JSON.parse(readFileSync18(filePath, "utf-8"));
   } catch {
     return null;
   }
 }
 function saveToolProfile(repoRoot, profile) {
-  const contextDir = join33(repoRoot, OA_DIR, "context");
-  mkdirSync9(contextDir, { recursive: true });
-  writeFileSync9(join33(contextDir, TOOL_PROFILE_FILE), JSON.stringify(profile, null, 2), "utf-8");
+  const contextDir = join34(repoRoot, OA_DIR, "context");
+  mkdirSync10(contextDir, { recursive: true });
+  writeFileSync10(join34(contextDir, TOOL_PROFILE_FILE), JSON.stringify(profile, null, 2), "utf-8");
 }
 function categorizeToolCall(toolName) {
   for (const cat of TOOL_CATEGORIES) {
@@ -27096,25 +28170,25 @@ function weightedColor(profile) {
   return selectedCat.colors[Math.floor(Math.random() * selectedCat.colors.length)];
 }
 function loadCachedDescriptors(repoRoot) {
-  const filePath = join33(repoRoot, OA_DIR, "context", DESCRIPTOR_FILE);
+  const filePath = join34(repoRoot, OA_DIR, "context", DESCRIPTOR_FILE);
   try {
-    if (!existsSync24(filePath))
+    if (!existsSync25(filePath))
       return null;
-    const cached = JSON.parse(readFileSync17(filePath, "utf-8"));
+    const cached = JSON.parse(readFileSync18(filePath, "utf-8"));
     return cached.phrases.length > 0 ? cached.phrases : null;
   } catch {
     return null;
   }
 }
 function saveCachedDescriptors(repoRoot, phrases, sourceHash) {
-  const contextDir = join33(repoRoot, OA_DIR, "context");
-  mkdirSync9(contextDir, { recursive: true });
+  const contextDir = join34(repoRoot, OA_DIR, "context");
+  mkdirSync10(contextDir, { recursive: true });
   const cached = {
     phrases,
     generatedAt: (/* @__PURE__ */ new Date()).toISOString(),
     sourceHash
   };
-  writeFileSync9(join33(contextDir, DESCRIPTOR_FILE), JSON.stringify(cached, null, 2), "utf-8");
+  writeFileSync10(join34(contextDir, DESCRIPTOR_FILE), JSON.stringify(cached, null, 2), "utf-8");
 }
 function generateDescriptors(repoRoot) {
   const profile = loadToolProfile(repoRoot);
@@ -27162,11 +28236,11 @@ function generateDescriptors(repoRoot) {
   return phrases;
 }
 function extractFromPackageJson(repoRoot, tags) {
-  const pkgPath = join33(repoRoot, "package.json");
+  const pkgPath = join34(repoRoot, "package.json");
   try {
-    if (!existsSync24(pkgPath))
+    if (!existsSync25(pkgPath))
       return;
-    const pkg = JSON.parse(readFileSync17(pkgPath, "utf-8"));
+    const pkg = JSON.parse(readFileSync18(pkgPath, "utf-8"));
     if (pkg.name && typeof pkg.name === "string") {
       const parts = pkg.name.replace(/^@/, "").split("/");
       for (const p of parts)
@@ -27210,7 +28284,7 @@ function extractFromManifests(repoRoot, tags) {
     { file: ".github/workflows", tag: "ci/cd" }
   ];
   for (const check of manifestChecks) {
-    if (existsSync24(join33(repoRoot, check.file))) {
+    if (existsSync25(join34(repoRoot, check.file))) {
       tags.push(check.tag);
     }
   }
@@ -27232,16 +28306,16 @@ function extractFromSessions(repoRoot, tags) {
   }
 }
 function extractFromMemory(repoRoot, tags) {
-  const memoryDir = join33(repoRoot, OA_DIR, "memory");
+  const memoryDir = join34(repoRoot, OA_DIR, "memory");
   try {
-    if (!existsSync24(memoryDir))
+    if (!existsSync25(memoryDir))
       return;
     const files = readdirSync9(memoryDir).filter((f) => f.endsWith(".json"));
     for (const file of files) {
       const topic = file.replace(/\.json$/, "").replace(/[-_]/g, " ");
       tags.push(topic);
       try {
-        const data = JSON.parse(readFileSync17(join33(memoryDir, file), "utf-8"));
+        const data = JSON.parse(readFileSync18(join34(memoryDir, file), "utf-8"));
         if (data && typeof data === "object") {
           const keys = Object.keys(data).slice(0, 3);
           for (const key of keys) {
@@ -27376,25 +28450,25 @@ var init_carousel_descriptors = __esm({
 });
 
 // packages/cli/dist/tui/voice.js
-import { existsSync as existsSync25, mkdirSync as mkdirSync10, writeFileSync as writeFileSync10, readFileSync as readFileSync18, unlinkSync as unlinkSync4 } from "node:fs";
-import { join as join34 } from "node:path";
+import { existsSync as existsSync26, mkdirSync as mkdirSync11, writeFileSync as writeFileSync11, readFileSync as readFileSync19, unlinkSync as unlinkSync4 } from "node:fs";
+import { join as join35 } from "node:path";
 import { homedir as homedir12, tmpdir as tmpdir6, platform as platform3 } from "node:os";
 import { execSync as execSync22, spawn as nodeSpawn } from "node:child_process";
 import { createRequire } from "node:module";
 function voiceDir() {
-  return join34(homedir12(), ".open-agents", "voice");
+  return join35(homedir12(), ".open-agents", "voice");
 }
 function modelsDir() {
-  return join34(voiceDir(), "models");
+  return join35(voiceDir(), "models");
 }
 function modelDir(id) {
-  return join34(modelsDir(), id);
+  return join35(modelsDir(), id);
 }
 function modelOnnxPath(id) {
-  return join34(modelDir(id), "model.onnx");
+  return join35(modelDir(id), "model.onnx");
 }
 function modelConfigPath(id) {
-  return join34(modelDir(id), "config.json");
+  return join35(modelDir(id), "config.json");
 }
 function resetNarrationContext() {
   narration.toolCount = 0;
@@ -28072,7 +29146,7 @@ var init_voice = __esm({
           }
           this.onPCMOutput(Buffer.from(int16.buffer), this.config.audio.sample_rate);
         }
-        const wavPath = join34(tmpdir6(), `oa-voice-${Date.now()}.wav`);
+        const wavPath = join35(tmpdir6(), `oa-voice-${Date.now()}.wav`);
         this.writeWav(audioData, this.config.audio.sample_rate, wavPath);
         await this.playWav(wavPath);
         try {
@@ -28156,7 +29230,7 @@ var init_voice = __esm({
         return buffer;
       }
       writeWav(samples, sampleRate, path) {
-        writeFileSync10(path, this.buildWavBuffer(samples, sampleRate));
+        writeFileSync11(path, this.buildWavBuffer(samples, sampleRate));
       }
       // -------------------------------------------------------------------------
       // Audio playback (system default speakers)
@@ -28230,30 +29304,30 @@ var init_voice = __esm({
           return;
         const arch = process.arch;
         const isArmLinux = (arch === "arm64" || arch === "arm") && process.platform === "linux";
-        mkdirSync10(voiceDir(), { recursive: true });
-        const pkgPath = join34(voiceDir(), "package.json");
+        mkdirSync11(voiceDir(), { recursive: true });
+        const pkgPath = join35(voiceDir(), "package.json");
         const expectedDeps = {
           "onnxruntime-node": "^1.21.0",
           "phonemizer": "^1.2.1"
         };
-        if (existsSync25(pkgPath)) {
+        if (existsSync26(pkgPath)) {
           try {
-            const existing = JSON.parse(readFileSync18(pkgPath, "utf8"));
+            const existing = JSON.parse(readFileSync19(pkgPath, "utf8"));
             if (!existing.dependencies?.["phonemizer"]) {
               existing.dependencies = { ...existing.dependencies, ...expectedDeps };
-              writeFileSync10(pkgPath, JSON.stringify(existing, null, 2));
+              writeFileSync11(pkgPath, JSON.stringify(existing, null, 2));
             }
           } catch {
           }
         }
-        if (!existsSync25(pkgPath)) {
-          writeFileSync10(pkgPath, JSON.stringify({
+        if (!existsSync26(pkgPath)) {
+          writeFileSync11(pkgPath, JSON.stringify({
             name: "open-agents-voice",
             private: true,
             dependencies: expectedDeps
           }, null, 2));
         }
-        const voiceRequire = createRequire(join34(voiceDir(), "index.js"));
+        const voiceRequire = createRequire(join35(voiceDir(), "index.js"));
         try {
           this.ort = voiceRequire("onnxruntime-node");
         } catch {
@@ -28307,18 +29381,18 @@ Error: ${err instanceof Error ? err.message : String(err)}`);
         const dir = modelDir(id);
         const onnxPath = modelOnnxPath(id);
         const configPath = modelConfigPath(id);
-        if (existsSync25(onnxPath) && existsSync25(configPath))
+        if (existsSync26(onnxPath) && existsSync26(configPath))
           return;
-        mkdirSync10(dir, { recursive: true });
-        if (!existsSync25(configPath)) {
+        mkdirSync11(dir, { recursive: true });
+        if (!existsSync26(configPath)) {
           renderInfo(`Downloading ${model.label} voice config...`);
           const configResp = await fetch(model.configUrl);
           if (!configResp.ok)
             throw new Error(`Failed to download config: HTTP ${configResp.status}`);
           const configText = await configResp.text();
-          writeFileSync10(configPath, configText);
+          writeFileSync11(configPath, configText);
         }
-        if (!existsSync25(onnxPath)) {
+        if (!existsSync26(onnxPath)) {
           renderInfo(`Downloading ${model.label} voice model (this may take a minute)...`);
           const onnxResp = await fetch(model.onnxUrl);
           if (!onnxResp.ok)
@@ -28342,7 +29416,7 @@ Error: ${err instanceof Error ? err.message : String(err)}`);
           }
           process.stdout.write("\r" + " ".repeat(60) + "\r");
           const fullBuffer = Buffer.concat(chunks);
-          writeFileSync10(onnxPath, fullBuffer);
+          writeFileSync11(onnxPath, fullBuffer);
           renderInfo(`${model.label} model downloaded (${formatBytes2(fullBuffer.length)}).`);
         }
       }
@@ -28354,10 +29428,10 @@ Error: ${err instanceof Error ? err.message : String(err)}`);
           throw new Error("ONNX runtime not loaded");
         const onnxPath = modelOnnxPath(this.modelId);
         const configPath = modelConfigPath(this.modelId);
-        if (!existsSync25(onnxPath) || !existsSync25(configPath)) {
+        if (!existsSync26(onnxPath) || !existsSync26(configPath)) {
           throw new Error(`Model files not found for ${this.modelId}`);
         }
-        this.config = JSON.parse(readFileSync18(configPath, "utf8"));
+        this.config = JSON.parse(readFileSync19(configPath, "utf8"));
         renderInfo("Loading voice model...");
         this.session = await this.ort.InferenceSession.create(onnxPath, {
           executionProviders: ["cpu"],
@@ -29220,13 +30294,13 @@ var init_stream_renderer = __esm({
 });
 
 // packages/cli/dist/tui/edit-history.js
-import { appendFileSync as appendFileSync2, mkdirSync as mkdirSync11 } from "node:fs";
-import { join as join35 } from "node:path";
+import { appendFileSync as appendFileSync2, mkdirSync as mkdirSync12 } from "node:fs";
+import { join as join36 } from "node:path";
 function createEditHistoryLogger(repoRoot, sessionId) {
-  const historyDir = join35(repoRoot, ".oa", "history");
-  const logPath = join35(historyDir, "edits.jsonl");
+  const historyDir = join36(repoRoot, ".oa", "history");
+  const logPath = join36(historyDir, "edits.jsonl");
   try {
-    mkdirSync11(historyDir, { recursive: true });
+    mkdirSync12(historyDir, { recursive: true });
   } catch {
   }
   function logToolCall(toolName, toolArgs, success) {
@@ -29335,15 +30409,15 @@ var init_edit_history = __esm({
 });
 
 // packages/cli/dist/tui/dream-engine.js
-import { mkdirSync as mkdirSync12, writeFileSync as writeFileSync11, readFileSync as readFileSync19, existsSync as existsSync26, cpSync, rmSync, readdirSync as readdirSync10 } from "node:fs";
-import { join as join36, basename as basename12 } from "node:path";
+import { mkdirSync as mkdirSync13, writeFileSync as writeFileSync12, readFileSync as readFileSync20, existsSync as existsSync27, cpSync, rmSync, readdirSync as readdirSync10 } from "node:fs";
+import { join as join37, basename as basename12 } from "node:path";
 import { execSync as execSync23 } from "node:child_process";
 function loadAutoresearchMemory(repoRoot) {
-  const memoryPath = join36(repoRoot, ".oa", "memory", "autoresearch.json");
-  if (!existsSync26(memoryPath))
+  const memoryPath = join37(repoRoot, ".oa", "memory", "autoresearch.json");
+  if (!existsSync27(memoryPath))
     return "";
   try {
-    const raw = readFileSync19(memoryPath, "utf-8");
+    const raw = readFileSync20(memoryPath, "utf-8");
     const data = JSON.parse(raw);
     const sections = [];
     for (const key of AUTORESEARCH_MEMORY_KEYS) {
@@ -29563,14 +30637,14 @@ var init_dream_engine = __esm({
         const content = String(args["content"] ?? "");
         if (!rawPath)
           return { success: false, output: "", error: "path is required", durationMs: Date.now() - start };
-        const targetPath = rawPath.startsWith("/") || rawPath.startsWith(".oa/autoresearch") ? join36(this.autoresearchDir, basename12(rawPath)) : join36(this.autoresearchDir, rawPath);
+        const targetPath = rawPath.startsWith("/") || rawPath.startsWith(".oa/autoresearch") ? join37(this.autoresearchDir, basename12(rawPath)) : join37(this.autoresearchDir, rawPath);
         if (!targetPath.startsWith(this.autoresearchDir)) {
           return { success: false, output: "", error: "Autoresearch mode: writes are confined to .oa/autoresearch/", durationMs: Date.now() - start };
         }
         try {
-          const dir = join36(targetPath, "..");
-          mkdirSync12(dir, { recursive: true });
-          writeFileSync11(targetPath, content, "utf-8");
+          const dir = join37(targetPath, "..");
+          mkdirSync13(dir, { recursive: true });
+          writeFileSync12(targetPath, content, "utf-8");
           return { success: true, output: `Wrote ${content.length} bytes to ${rawPath}`, durationMs: Date.now() - start };
         } catch (err) {
           return { success: false, output: "", error: String(err), durationMs: Date.now() - start };
@@ -29598,20 +30672,20 @@ var init_dream_engine = __esm({
         const rawPath = String(args["path"] ?? "");
         const oldStr = String(args["old_string"] ?? "");
         const newStr = String(args["new_string"] ?? "");
-        const targetPath = rawPath.startsWith("/") || rawPath.startsWith(".oa/autoresearch") ? join36(this.autoresearchDir, basename12(rawPath)) : join36(this.autoresearchDir, rawPath);
+        const targetPath = rawPath.startsWith("/") || rawPath.startsWith(".oa/autoresearch") ? join37(this.autoresearchDir, basename12(rawPath)) : join37(this.autoresearchDir, rawPath);
         if (!targetPath.startsWith(this.autoresearchDir)) {
           return { success: false, output: "", error: "Autoresearch mode: edits are confined to .oa/autoresearch/", durationMs: Date.now() - start };
         }
         try {
-          if (!existsSync26(targetPath)) {
+          if (!existsSync27(targetPath)) {
             return { success: false, output: "", error: `File not found: ${rawPath}`, durationMs: Date.now() - start };
           }
-          let content = readFileSync19(targetPath, "utf-8");
+          let content = readFileSync20(targetPath, "utf-8");
           if (!content.includes(oldStr)) {
             return { success: false, output: "", error: "old_string not found in file", durationMs: Date.now() - start };
           }
           content = content.replace(oldStr, newStr);
-          writeFileSync11(targetPath, content, "utf-8");
+          writeFileSync12(targetPath, content, "utf-8");
           return { success: true, output: `Edited ${rawPath}`, durationMs: Date.now() - start };
         } catch (err) {
           return { success: false, output: "", error: String(err), durationMs: Date.now() - start };
@@ -29652,14 +30726,14 @@ var init_dream_engine = __esm({
         const content = String(args["content"] ?? "");
         if (!rawPath)
           return { success: false, output: "", error: "path is required", durationMs: Date.now() - start };
-        const targetPath = rawPath.startsWith("/") || rawPath.startsWith(".oa/dreams") ? join36(this.dreamsDir, basename12(rawPath)) : join36(this.dreamsDir, rawPath);
+        const targetPath = rawPath.startsWith("/") || rawPath.startsWith(".oa/dreams") ? join37(this.dreamsDir, basename12(rawPath)) : join37(this.dreamsDir, rawPath);
         if (!targetPath.startsWith(this.dreamsDir)) {
           return { success: false, output: "", error: "Dream mode: writes are confined to .oa/dreams/", durationMs: Date.now() - start };
         }
         try {
-          const dir = join36(targetPath, "..");
-          mkdirSync12(dir, { recursive: true });
-          writeFileSync11(targetPath, content, "utf-8");
+          const dir = join37(targetPath, "..");
+          mkdirSync13(dir, { recursive: true });
+          writeFileSync12(targetPath, content, "utf-8");
           return { success: true, output: `Wrote ${content.length} bytes to ${rawPath}`, durationMs: Date.now() - start };
         } catch (err) {
           return { success: false, output: "", error: String(err), durationMs: Date.now() - start };
@@ -29687,20 +30761,20 @@ var init_dream_engine = __esm({
         const rawPath = String(args["path"] ?? "");
         const oldStr = String(args["old_string"] ?? "");
         const newStr = String(args["new_string"] ?? "");
-        const targetPath = rawPath.startsWith("/") || rawPath.startsWith(".oa/dreams") ? join36(this.dreamsDir, basename12(rawPath)) : join36(this.dreamsDir, rawPath);
+        const targetPath = rawPath.startsWith("/") || rawPath.startsWith(".oa/dreams") ? join37(this.dreamsDir, basename12(rawPath)) : join37(this.dreamsDir, rawPath);
         if (!targetPath.startsWith(this.dreamsDir)) {
           return { success: false, output: "", error: "Dream mode: edits are confined to .oa/dreams/", durationMs: Date.now() - start };
         }
         try {
-          if (!existsSync26(targetPath)) {
+          if (!existsSync27(targetPath)) {
             return { success: false, output: "", error: `File not found: ${rawPath}`, durationMs: Date.now() - start };
           }
-          let content = readFileSync19(targetPath, "utf-8");
+          let content = readFileSync20(targetPath, "utf-8");
           if (!content.includes(oldStr)) {
             return { success: false, output: "", error: "old_string not found in file", durationMs: Date.now() - start };
           }
           content = content.replace(oldStr, newStr);
-          writeFileSync11(targetPath, content, "utf-8");
+          writeFileSync12(targetPath, content, "utf-8");
           return { success: true, output: `Edited ${rawPath}`, durationMs: Date.now() - start };
         } catch (err) {
           return { success: false, output: "", error: String(err), durationMs: Date.now() - start };
@@ -29754,7 +30828,7 @@ var init_dream_engine = __esm({
       constructor(config, repoRoot) {
         this.config = config;
         this.repoRoot = repoRoot;
-        this.dreamsDir = join36(repoRoot, ".oa", "dreams");
+        this.dreamsDir = join37(repoRoot, ".oa", "dreams");
         this.state = {
           mode: "default",
           active: false,
@@ -29785,7 +30859,7 @@ var init_dream_engine = __esm({
           startedAt: (/* @__PURE__ */ new Date()).toISOString(),
           results: []
         };
-        mkdirSync12(this.dreamsDir, { recursive: true });
+        mkdirSync13(this.dreamsDir, { recursive: true });
         this.saveDreamState();
         try {
           for (let cycle = 1; cycle <= totalCycles; cycle++) {
@@ -29838,8 +30912,8 @@ ${result.summary}`;
             if (mode !== "default" || cycle === totalCycles) {
               renderDreamContraction(cycle);
               const cycleSummary = this.buildCycleSummary(cycle, previousFindings);
-              const summaryPath = join36(this.dreamsDir, `cycle-${cycle}-summary.md`);
-              writeFileSync11(summaryPath, cycleSummary, "utf-8");
+              const summaryPath = join37(this.dreamsDir, `cycle-${cycle}-summary.md`);
+              writeFileSync12(summaryPath, cycleSummary, "utf-8");
             }
             if (mode === "lucid" && !this.abortController.signal.aborted) {
               this.saveVersionCheckpoint(cycle);
@@ -30051,7 +31125,7 @@ After synthesis, call task_complete with the final prioritized summary.`, toolMo
       }
       /** Build role-specific tool sets for swarm agents */
       buildSwarmTools(role, _workspace) {
-        const autoresearchDir = join36(this.repoRoot, ".oa", "autoresearch");
+        const autoresearchDir = join37(this.repoRoot, ".oa", "autoresearch");
         const taskComplete = this.createSwarmTaskCompleteTool(role);
         switch (role) {
           case "researcher": {
@@ -30415,7 +31489,7 @@ INSTRUCTIONS:
 2. Summarize the key learnings and next steps
 
 Call task_complete with a human-readable summary of the autoresearch session.`, workspace, onEvent);
-        const reportPath = join36(this.dreamsDir, `cycle-${cycleNum}-autoresearch-report.md`);
+        const reportPath = join37(this.dreamsDir, `cycle-${cycleNum}-autoresearch-report.md`);
         const report = `# Autoresearch Swarm Report \u2014 Cycle ${cycleNum}
 
 **Date**: ${(/* @__PURE__ */ new Date()).toISOString().split("T")[0]}
@@ -30437,8 +31511,8 @@ ${summaryResult}
 *Generated by open-agents autoresearch swarm*
 `;
         try {
-          mkdirSync12(this.dreamsDir, { recursive: true });
-          writeFileSync11(reportPath, report, "utf-8");
+          mkdirSync13(this.dreamsDir, { recursive: true });
+          writeFileSync12(reportPath, report, "utf-8");
         } catch {
         }
         renderSwarmComplete(workspace);
@@ -30504,9 +31578,9 @@ ${summaryResult}
       }
       /** Save workspace backup for lucid mode */
       saveVersionCheckpoint(cycle) {
-        const checkpointDir = join36(this.dreamsDir, "checkpoints", `cycle-${cycle}`);
+        const checkpointDir = join37(this.dreamsDir, "checkpoints", `cycle-${cycle}`);
         try {
-          mkdirSync12(checkpointDir, { recursive: true });
+          mkdirSync13(checkpointDir, { recursive: true });
           try {
             const gitStatus = execSync23("git status --porcelain", {
               cwd: this.repoRoot,
@@ -30523,10 +31597,10 @@ ${summaryResult}
               encoding: "utf-8",
               timeout: 5e3
             }).trim();
-            writeFileSync11(join36(checkpointDir, "git-status.txt"), gitStatus, "utf-8");
-            writeFileSync11(join36(checkpointDir, "git-diff.patch"), gitDiff, "utf-8");
-            writeFileSync11(join36(checkpointDir, "git-hash.txt"), gitHash, "utf-8");
-            writeFileSync11(join36(checkpointDir, "checkpoint.json"), JSON.stringify({
+            writeFileSync12(join37(checkpointDir, "git-status.txt"), gitStatus, "utf-8");
+            writeFileSync12(join37(checkpointDir, "git-diff.patch"), gitDiff, "utf-8");
+            writeFileSync12(join37(checkpointDir, "git-hash.txt"), gitHash, "utf-8");
+            writeFileSync12(join37(checkpointDir, "checkpoint.json"), JSON.stringify({
               cycle,
               timestamp: (/* @__PURE__ */ new Date()).toISOString(),
               gitHash,
@@ -30534,7 +31608,7 @@ ${summaryResult}
             }, null, 2), "utf-8");
             renderInfo(`Checkpoint saved: cycle ${cycle} (${gitHash.slice(0, 8)})`);
           } catch {
-            writeFileSync11(join36(checkpointDir, "checkpoint.json"), JSON.stringify({ cycle, timestamp: (/* @__PURE__ */ new Date()).toISOString(), mode: this.state.mode }, null, 2), "utf-8");
+            writeFileSync12(join37(checkpointDir, "checkpoint.json"), JSON.stringify({ cycle, timestamp: (/* @__PURE__ */ new Date()).toISOString(), mode: this.state.mode }, null, 2), "utf-8");
             renderInfo(`Checkpoint saved: cycle ${cycle} (no git)`);
           }
         } catch (err) {
@@ -30592,14 +31666,14 @@ ${files.map((f) => `- [\`${f}\`](./${f})`).join("\n")}
 ---
 *Auto-generated by open-agents dream engine*
 `;
-          writeFileSync11(join36(this.dreamsDir, "PROPOSAL-INDEX.md"), index, "utf-8");
+          writeFileSync12(join37(this.dreamsDir, "PROPOSAL-INDEX.md"), index, "utf-8");
         } catch {
         }
       }
       /** Save dream state for resume/inspection */
       saveDreamState() {
         try {
-          writeFileSync11(join36(this.dreamsDir, "dream-state.json"), JSON.stringify(this.state, null, 2) + "\n", "utf-8");
+          writeFileSync12(join37(this.dreamsDir, "dream-state.json"), JSON.stringify(this.state, null, 2) + "\n", "utf-8");
         } catch {
         }
       }
@@ -30752,8 +31826,8 @@ var init_bless_engine = __esm({
 });
 
 // packages/cli/dist/tui/dmn-engine.js
-import { existsSync as existsSync27, readFileSync as readFileSync20, writeFileSync as writeFileSync12, mkdirSync as mkdirSync13, readdirSync as readdirSync11, unlinkSync as unlinkSync5 } from "node:fs";
-import { join as join37, basename as basename13 } from "node:path";
+import { existsSync as existsSync28, readFileSync as readFileSync21, writeFileSync as writeFileSync13, mkdirSync as mkdirSync14, readdirSync as readdirSync11, unlinkSync as unlinkSync5 } from "node:fs";
+import { join as join38, basename as basename13 } from "node:path";
 function buildDMNGatherPrompt(recentTaskSummaries, dueReminders, attentionItems, memoryTopics, capabilities, competence, reflectionBuffer) {
   const competenceReport = competence.length > 0 ? competence.map((c3) => {
     const rate = c3.attempts > 0 ? Math.round(c3.successes / c3.attempts * 100) : 0;
@@ -30985,9 +32059,9 @@ var init_dmn_engine = __esm({
       constructor(config, repoRoot) {
         this.config = config;
         this.repoRoot = repoRoot;
-        this.stateDir = join37(repoRoot, ".oa", "dmn");
-        this.historyDir = join37(repoRoot, ".oa", "dmn", "cycles");
-        mkdirSync13(this.historyDir, { recursive: true });
+        this.stateDir = join38(repoRoot, ".oa", "dmn");
+        this.historyDir = join38(repoRoot, ".oa", "dmn", "cycles");
+        mkdirSync14(this.historyDir, { recursive: true });
         this.loadState();
       }
       get stats() {
@@ -31576,11 +32650,11 @@ OUTPUT: Call task_complete with JSON:
       async gatherMemoryTopics() {
         const topics = [];
         const dirs = [
-          join37(this.repoRoot, ".oa", "memory"),
-          join37(this.repoRoot, ".open-agents", "memory")
+          join38(this.repoRoot, ".oa", "memory"),
+          join38(this.repoRoot, ".open-agents", "memory")
         ];
         for (const dir of dirs) {
-          if (!existsSync27(dir))
+          if (!existsSync28(dir))
             continue;
           try {
             const files = readdirSync11(dir).filter((f) => f.endsWith(".json"));
@@ -31596,29 +32670,29 @@ OUTPUT: Call task_complete with JSON:
       }
       // ── State persistence ─────────────────────────────────────────────────
       loadState() {
-        const path = join37(this.stateDir, "state.json");
-        if (existsSync27(path)) {
+        const path = join38(this.stateDir, "state.json");
+        if (existsSync28(path)) {
           try {
-            this.state = JSON.parse(readFileSync20(path, "utf-8"));
+            this.state = JSON.parse(readFileSync21(path, "utf-8"));
           } catch {
           }
         }
       }
       saveState() {
         try {
-          writeFileSync12(join37(this.stateDir, "state.json"), JSON.stringify(this.state, null, 2) + "\n", "utf-8");
+          writeFileSync13(join38(this.stateDir, "state.json"), JSON.stringify(this.state, null, 2) + "\n", "utf-8");
         } catch {
         }
       }
       saveCycleResult(result) {
         try {
           const filename = `cycle-${result.cycleNumber}-${Date.now()}.json`;
-          writeFileSync12(join37(this.historyDir, filename), JSON.stringify(result, null, 2) + "\n", "utf-8");
+          writeFileSync13(join38(this.historyDir, filename), JSON.stringify(result, null, 2) + "\n", "utf-8");
           const files = readdirSync11(this.historyDir).filter((f) => f.startsWith("cycle-") && f.endsWith(".json")).sort();
           if (files.length > 50) {
             for (const old of files.slice(0, files.length - 50)) {
               try {
-                unlinkSync5(join37(this.historyDir, old));
+                unlinkSync5(join38(this.historyDir, old));
               } catch {
               }
             }
@@ -31631,8 +32705,8 @@ OUTPUT: Call task_complete with JSON:
 });
 
 // packages/cli/dist/tui/snr-engine.js
-import { existsSync as existsSync28, readdirSync as readdirSync12, readFileSync as readFileSync21 } from "node:fs";
-import { join as join38, basename as basename14 } from "node:path";
+import { existsSync as existsSync29, readdirSync as readdirSync12, readFileSync as readFileSync22 } from "node:fs";
+import { join as join39, basename as basename14 } from "node:path";
 function computeDPrime(signalScores, noiseScores) {
   if (signalScores.length === 0 || noiseScores.length === 0)
     return 0;
@@ -31879,11 +32953,11 @@ Call task_complete with the JSON array when done.`, onEvent)
       loadMemoryEntries(topics) {
         const entries = [];
         const dirs = [
-          join38(this.repoRoot, ".oa", "memory"),
-          join38(this.repoRoot, ".open-agents", "memory")
+          join39(this.repoRoot, ".oa", "memory"),
+          join39(this.repoRoot, ".open-agents", "memory")
         ];
         for (const dir of dirs) {
-          if (!existsSync28(dir))
+          if (!existsSync29(dir))
             continue;
           try {
             const files = readdirSync12(dir).filter((f) => f.endsWith(".json"));
@@ -31892,7 +32966,7 @@ Call task_complete with the JSON array when done.`, onEvent)
               if (topics.length > 0 && !topics.includes(topic))
                 continue;
               try {
-                const data = JSON.parse(readFileSync21(join38(dir, f), "utf-8"));
+                const data = JSON.parse(readFileSync22(join39(dir, f), "utf-8"));
                 for (const [key, val] of Object.entries(data)) {
                   const value = typeof val === "object" && val !== null && "value" in val ? String(val.value) : String(val);
                   entries.push({ topic, key, value });
@@ -32345,8 +33419,8 @@ var init_tool_policy = __esm({
 });
 
 // packages/cli/dist/tui/telegram-bridge.js
-import { mkdirSync as mkdirSync14, existsSync as existsSync29, unlinkSync as unlinkSync6, readdirSync as readdirSync13, statSync as statSync10 } from "node:fs";
-import { join as join39, resolve as resolve24 } from "node:path";
+import { mkdirSync as mkdirSync15, existsSync as existsSync30, unlinkSync as unlinkSync6, readdirSync as readdirSync13, statSync as statSync10 } from "node:fs";
+import { join as join40, resolve as resolve24 } from "node:path";
 import { writeFile as writeFileAsync } from "node:fs/promises";
 function convertMarkdownToTelegramHTML(md) {
   let html = md;
@@ -32674,7 +33748,7 @@ with summary "no_reply" to silently skip without responding.
         this.polling = true;
         this.abortController = new AbortController();
         try {
-          mkdirSync14(this.mediaCacheDir, { recursive: true });
+          mkdirSync15(this.mediaCacheDir, { recursive: true });
         } catch {
         }
         this.mediaCacheCleanupTimer = setInterval(() => this.cleanupMediaCache(), 5 * 60 * 1e3);
@@ -33098,7 +34172,7 @@ Telegram admin: @${msg.username}` : `Telegram ${isGroup ? "group" : "public"} ch
             return null;
           const buffer = Buffer.from(await res.arrayBuffer());
           const fileName = `${Date.now()}-${fileId.slice(0, 8)}${extension}`;
-          const localPath = join39(this.mediaCacheDir, fileName);
+          const localPath = join40(this.mediaCacheDir, fileName);
           await writeFileAsync(localPath, buffer);
           return localPath;
         } catch {
@@ -34820,11 +35894,11 @@ var init_status_bar = __esm({
 import * as readline2 from "node:readline";
 import { Writable } from "node:stream";
 import { cwd } from "node:process";
-import { resolve as resolve25, join as join40, dirname as dirname12, extname as extname9 } from "node:path";
+import { resolve as resolve25, join as join41, dirname as dirname13, extname as extname9 } from "node:path";
 import { createRequire as createRequire2 } from "node:module";
 import { fileURLToPath as fileURLToPath9 } from "node:url";
-import { readFileSync as readFileSync22, rmSync as rmSync2, readdirSync as readdirSync14 } from "node:fs";
-import { existsSync as existsSync30 } from "node:fs";
+import { readFileSync as readFileSync23, rmSync as rmSync2, readdirSync as readdirSync14 } from "node:fs";
+import { existsSync as existsSync31 } from "node:fs";
 function formatTimeAgo(date) {
   const seconds = Math.floor((Date.now() - date.getTime()) / 1e3);
   if (seconds < 60)
@@ -34841,14 +35915,14 @@ function formatTimeAgo(date) {
 function getVersion() {
   try {
     const require2 = createRequire2(import.meta.url);
-    const thisDir = dirname12(fileURLToPath9(import.meta.url));
+    const thisDir = dirname13(fileURLToPath9(import.meta.url));
     const candidates = [
-      join40(thisDir, "..", "package.json"),
-      join40(thisDir, "..", "..", "package.json"),
-      join40(thisDir, "..", "..", "..", "package.json")
+      join41(thisDir, "..", "package.json"),
+      join41(thisDir, "..", "..", "package.json"),
+      join41(thisDir, "..", "..", "..", "package.json")
     ];
     for (const pkgPath of candidates) {
-      if (existsSync30(pkgPath)) {
+      if (existsSync31(pkgPath)) {
         const pkg = require2(pkgPath);
         if (pkg.name === "open-agents-ai" || pkg.name === "@open-agents/cli") {
           return pkg.version ?? "0.0.0";
@@ -35042,15 +36116,15 @@ Use task_status("${taskId}") or task_output("${taskId}") to check progress.`
 function gatherMemorySnippets(root) {
   const snippets = [];
   const dirs = [
-    join40(root, ".oa", "memory"),
-    join40(root, ".open-agents", "memory")
+    join41(root, ".oa", "memory"),
+    join41(root, ".open-agents", "memory")
   ];
   for (const dir of dirs) {
-    if (!existsSync30(dir))
+    if (!existsSync31(dir))
       continue;
     try {
       for (const f of readdirSync14(dir).filter((f2) => f2.endsWith(".json"))) {
-        const data = JSON.parse(readFileSync22(join40(dir, f), "utf-8"));
+        const data = JSON.parse(readFileSync23(join41(dir, f), "utf-8"));
         for (const val of Object.values(data)) {
           const v = typeof val === "object" && val !== null && "value" in val ? String(val.value) : String(val);
           if (v.length > 10)
@@ -35663,6 +36737,9 @@ async function startInteractive(config, repoPath) {
   const voiceEngine = new VoiceEngine();
   let voiceSession = null;
   let exposeGateway = null;
+  let peerMesh = null;
+  let inferenceRouter = null;
+  const secretVault = new SecretVault(join41(repoRoot, ".oa", "vault.enc"));
   let adminSessionKey = null;
   const callSubAgents = /* @__PURE__ */ new Map();
   const streamRenderer = new StreamRenderer();
@@ -35824,6 +36901,9 @@ Rationale: ${proposal.rationale}${provenanceNote}`;
     "/stop",
     "/resume",
     "/expose",
+    "/p2p",
+    "/secrets",
+    "/vault",
     "/full-send-bless",
     "/bless",
     "/telegram",
@@ -36559,6 +37639,80 @@ Respond concisely and safely. Remember: you are talking to the general public.`;
         stats: exposeGateway.formatStats()
       };
     },
+    // ── P2P mesh controls ────────────────────────────────────────────────
+    async p2pStart(bootstrapPeers) {
+      if (peerMesh)
+        throw new Error("P2P mesh is already running");
+      let models = [];
+      try {
+        const resp = await fetch(`${commandCtx.config.backendUrl ?? "http://127.0.0.1:11434"}/api/tags`);
+        const data = await resp.json();
+        models = data.models?.map((m) => m.name) ?? [];
+      } catch {
+      }
+      peerMesh = new PeerMesh({
+        displayName: commandCtx.config.model ?? "open-agents-node",
+        capabilities: { models, gpuVramGB: 0, teeAttested: false, maxContextTokens: 32768, load: 0 },
+        bootstrapPeers
+      });
+      const port = await peerMesh.start();
+      inferenceRouter = new InferenceRouter({
+        mesh: peerMesh,
+        vault: secretVault
+      });
+      return { peerId: peerMesh.peerId, port };
+    },
+    async p2pStop() {
+      if (peerMesh) {
+        await peerMesh.stop();
+        peerMesh = null;
+        inferenceRouter = null;
+      }
+    },
+    async p2pConnect(endpoint, trust) {
+      if (!peerMesh)
+        throw new Error("P2P mesh is not running \u2014 use /p2p start first");
+      const trustTier = trust ?? "public";
+      const peer = await peerMesh.connectToPeer(endpoint, trustTier);
+      return peer?.peerId ?? null;
+    },
+    p2pStatus() {
+      if (!peerMesh)
+        return "P2P mesh is not running.";
+      const peers = peerMesh.getPeers();
+      const connected = peers.filter((p) => p.connected);
+      const lines = [
+        `Node: ${peerMesh.peerId} (port ${peerMesh.port})`,
+        `Peers: ${connected.length} connected / ${peers.length} known`
+      ];
+      if (inferenceRouter) {
+        const stats = inferenceRouter.getStats();
+        lines.push(`Routed: ${stats.totalRouted} | Redacted: ${stats.totalRedacted} | Errors: ${stats.totalErrors}`);
+        if (stats.availableModels.length > 0) {
+          lines.push(`Models: ${stats.availableModels.join(", ")}`);
+        }
+      }
+      for (const p of connected) {
+        lines.push(`  ${p.peerId.slice(0, 8)}\u2026 [${p.trust}] ${p.latencyMs}ms \u2014 ${p.capabilities.models.join(", ") || "no models"}`);
+      }
+      return lines.join("\n");
+    },
+    isP2PActive() {
+      return peerMesh !== null;
+    },
+    // ── Secret vault controls ────────────────────────────────────────────
+    secretSet(name, value, minTrust) {
+      secretVault.set(name, value, minTrust ?? "verified");
+    },
+    secretDelete(name) {
+      return secretVault.delete(name);
+    },
+    secretList() {
+      return secretVault.list();
+    },
+    secretImportEnv() {
+      return secretVault.importFromEnv();
+    },
     async sendCallButton(chatId, url) {
       if (telegramBridge?.isActive) {
         await telegramBridge.sendCallButton(chatId, url);
@@ -36628,8 +37782,8 @@ Respond concisely and safely. Remember: you are talking to the general public.`;
       return true;
     },
     destroyProject() {
-      const oaPath = join40(repoRoot, OA_DIR);
-      if (existsSync30(oaPath)) {
+      const oaPath = join41(repoRoot, OA_DIR);
+      if (existsSync31(oaPath)) {
         try {
           rmSync2(oaPath, { recursive: true, force: true });
           writeContent(() => renderInfo(`Removed ${OA_DIR}/ directory.`));
@@ -36913,13 +38067,13 @@ Execute this skill now. Follow the behavioral guidance above.`;
       }
     }
     const cleanPath = input.replace(/^['"]|['"]$/g, "").trim();
-    const isImage = isImagePath(cleanPath) && existsSync30(resolve25(repoRoot, cleanPath));
-    const isMedia = !isImage && isTranscribablePath(cleanPath) && existsSync30(resolve25(repoRoot, cleanPath));
+    const isImage = isImagePath(cleanPath) && existsSync31(resolve25(repoRoot, cleanPath));
+    const isMedia = !isImage && isTranscribablePath(cleanPath) && existsSync31(resolve25(repoRoot, cleanPath));
     if (activeTask) {
       if (isImage) {
         try {
           const imgPath = resolve25(repoRoot, cleanPath);
-          const imgBuffer = readFileSync22(imgPath);
+          const imgBuffer = readFileSync23(imgPath);
           const base64 = imgBuffer.toString("base64");
           const ext = extname9(cleanPath).toLowerCase();
           const mime = ext === ".png" ? "image/png" : ext === ".gif" ? "image/gif" : ext === ".webp" ? "image/webp" : "image/jpeg";
@@ -37102,13 +38256,13 @@ NEW TASK: ${fullInput}`;
       writeContent(() => renderError(errMsg));
       if (failureStore) {
         try {
-          const { createHash: createHash2 } = await import("node:crypto");
+          const { createHash: createHash4 } = await import("node:crypto");
           failureStore.insert({
             taskId: "",
             sessionId: `${Date.now()}`,
             repoRoot,
             failureType: "runtime-error",
-            fingerprint: createHash2("sha256").update(errMsg.slice(0, 200)).digest("hex").slice(0, 16),
+            fingerprint: createHash4("sha256").update(errMsg.slice(0, 200)).digest("hex").slice(0, 16),
             filePath: null,
             errorMessage: errMsg.slice(0, 500),
             context: null,
@@ -37229,6 +38383,12 @@ Rationale: ${proposal.rationale}${provenanceNote}`;
       exposeGateway.stop().catch(() => {
       });
     }
+    if (peerMesh) {
+      peerMesh.stop().catch(() => {
+      });
+      peerMesh = null;
+      inferenceRouter = null;
+    }
     statusBar.deactivate();
     const closeRows = process.stdout.rows ?? 24;
     process.stdout.write(`\x1B[${closeRows - 4};1H\x1B[J
@@ -37318,6 +38478,7 @@ var init_interactive = __esm({
     init_listen();
     init_voice_session();
     init_expose();
+    init_p2p();
     init_call_agent();
     init_config();
     init_updater();
@@ -37375,8 +38536,8 @@ var init_run = __esm({
 import { glob } from "glob";
 import ignore from "ignore";
 import { readFile as readFile14, stat as stat4 } from "node:fs/promises";
-import { createHash } from "node:crypto";
-import { join as join41, relative as relative3, extname as extname10, basename as basename15 } from "node:path";
+import { createHash as createHash3 } from "node:crypto";
+import { join as join42, relative as relative3, extname as extname10, basename as basename15 } from "node:path";
 var DEFAULT_EXCLUDE, LANGUAGE_MAP, CodebaseIndexer;
 var init_codebase_indexer = __esm({
   "packages/indexer/dist/codebase-indexer.js"() {
@@ -37420,7 +38581,7 @@ var init_codebase_indexer = __esm({
         const ig = ignore.default();
         if (this.config.respectGitignore) {
           try {
-            const gitignoreContent = await readFile14(join41(this.config.rootDir, ".gitignore"), "utf-8");
+            const gitignoreContent = await readFile14(join42(this.config.rootDir, ".gitignore"), "utf-8");
             ig.add(gitignoreContent);
           } catch {
           }
@@ -37435,13 +38596,13 @@ var init_codebase_indexer = __esm({
         for (const relativePath of files) {
           if (ig.ignores(relativePath))
             continue;
-          const fullPath = join41(this.config.rootDir, relativePath);
+          const fullPath = join42(this.config.rootDir, relativePath);
           try {
             const fileStat = await stat4(fullPath);
             if (fileStat.size > this.config.maxFileSize)
               continue;
             const content = await readFile14(fullPath);
-            const hash = createHash("sha256").update(content).digest("hex");
+            const hash = createHash3("sha256").update(content).digest("hex");
             const ext = extname10(relativePath);
             indexed.push({
               path: fullPath,
@@ -37481,7 +38642,7 @@ var init_codebase_indexer = __esm({
               if (!child) {
                 child = {
                   name: part,
-                  path: join41(current.path, part),
+                  path: join42(current.path, part),
                   type: "directory",
                   children: []
                 };
@@ -37564,13 +38725,13 @@ __export(index_repo_exports, {
   indexRepoCommand: () => indexRepoCommand
 });
 import { resolve as resolve26 } from "node:path";
-import { existsSync as existsSync31, statSync as statSync11 } from "node:fs";
+import { existsSync as existsSync32, statSync as statSync11 } from "node:fs";
 import { cwd as cwd2 } from "node:process";
 async function indexRepoCommand(opts, _config) {
   const repoRoot = resolve26(opts.repoPath ?? cwd2());
   printHeader("Index Repository");
   printInfo(`Indexing: ${repoRoot}`);
-  if (!existsSync31(repoRoot)) {
+  if (!existsSync32(repoRoot)) {
     printError(`Path does not exist: ${repoRoot}`);
     process.exit(1);
   }
@@ -37822,7 +38983,7 @@ var config_exports = {};
 __export(config_exports, {
   configCommand: () => configCommand
 });
-import { join as join42, resolve as resolve27 } from "node:path";
+import { join as join43, resolve as resolve27 } from "node:path";
 import { homedir as homedir13 } from "node:os";
 import { cwd as cwd3 } from "node:process";
 function redactIfSensitive(key, value) {
@@ -37881,7 +39042,7 @@ function handleShow(opts, config) {
     }
   }
   printSection("Config File");
-  printInfo(`~/.open-agents/config.json (${join42(homedir13(), ".open-agents", "config.json")})`);
+  printInfo(`~/.open-agents/config.json (${join43(homedir13(), ".open-agents", "config.json")})`);
   printSection("Priority Chain");
   printInfo("  1. CLI flags (--model, --backend-url, etc.)");
   printInfo("  2. Project .oa/settings.json (--local)");
@@ -37920,7 +39081,7 @@ function handleSet(opts, _config) {
       const coerced = coerceForSettings(key, value);
       saveProjectSettings(repoRoot, { [key]: coerced });
       printSuccess(`Project override set: ${key} = ${redactIfSensitive(key, value)}`);
-      printInfo(`Saved to ${join42(repoRoot, ".oa", "settings.json")}`);
+      printInfo(`Saved to ${join43(repoRoot, ".oa", "settings.json")}`);
       printInfo("This override applies only when running in this workspace.");
     } catch (err) {
       printError(`Failed to save: ${err instanceof Error ? err.message : String(err)}`);
@@ -38139,8 +39300,8 @@ __export(eval_exports, {
   evalCommand: () => evalCommand
 });
 import { tmpdir as tmpdir7 } from "node:os";
-import { mkdirSync as mkdirSync15, writeFileSync as writeFileSync13 } from "node:fs";
-import { join as join43 } from "node:path";
+import { mkdirSync as mkdirSync16, writeFileSync as writeFileSync14 } from "node:fs";
+import { join as join44 } from "node:path";
 async function evalCommand(opts, config) {
   const suiteName = opts.suite ?? "basic";
   const suite = SUITES[suiteName];
@@ -38261,9 +39422,9 @@ async function evalCommand(opts, config) {
   process.exit(failed > 0 ? 1 : 0);
 }
 function createTempEvalRepo() {
-  const dir = join43(tmpdir7(), `open-agents-eval-${Date.now()}`);
-  mkdirSync15(dir, { recursive: true });
-  writeFileSync13(join43(dir, "package.json"), JSON.stringify({ name: "eval-repo", version: "0.0.0" }, null, 2) + "\n", "utf8");
+  const dir = join44(tmpdir7(), `open-agents-eval-${Date.now()}`);
+  mkdirSync16(dir, { recursive: true });
+  writeFileSync14(join44(dir, "package.json"), JSON.stringify({ name: "eval-repo", version: "0.0.0" }, null, 2) + "\n", "utf8");
   return dir;
 }
 var BASIC_SUITE, FULL_SUITE, SUITES;
@@ -38323,7 +39484,7 @@ init_updater();
 import { parseArgs as nodeParseArgs2 } from "node:util";
 import { createRequire as createRequire3 } from "node:module";
 import { fileURLToPath as fileURLToPath10 } from "node:url";
-import { dirname as dirname13, join as join44 } from "node:path";
+import { dirname as dirname14, join as join45 } from "node:path";
 
 // packages/cli/dist/cli.js
 import { createInterface } from "node:readline";
@@ -38430,7 +39591,7 @@ init_output();
 function getVersion2() {
   try {
     const require2 = createRequire3(import.meta.url);
-    const pkgPath = join44(dirname13(fileURLToPath10(import.meta.url)), "..", "package.json");
+    const pkgPath = join45(dirname14(fileURLToPath10(import.meta.url)), "..", "package.json");
     const pkg = require2(pkgPath);
     return pkg.version;
   } catch {