open-agents-ai 0.71.3 → 0.71.5

package/dist/index.js

@@ -11166,167 +11166,206 @@ ${truncated}`, durationMs: performance.now() - start };
 });
 
 // packages/execution/dist/tools/nexus.js
-import { readFile as readFile13, writeFile as writeFile12, mkdir as mkdir8, chmod } from "node:fs/promises";
+import { readFile as readFile13, writeFile as writeFile12, mkdir as mkdir8, chmod, unlink, readdir as readdir3 } from "node:fs/promises";
 import { existsSync as existsSync21 } from "node:fs";
 import { resolve as resolve26, join as join28 } from "node:path";
-import { randomBytes as randomBytes6, createCipheriv, createDecipheriv, scryptSync } from "node:crypto";
-import { execSync as execSync20 } from "node:child_process";
-async function loadNexus() {
-  if (!nexusMod) {
-    try {
-      nexusMod = await import("open-agents-nexus");
-    } catch {
-      try {
-        execSync20("npm install -g open-agents-nexus@latest 2>/dev/null || npm install open-agents-nexus@latest 2>/dev/null", {
-          stdio: "pipe",
-          timeout: 12e4
-        });
-        nexusMod = await import("open-agents-nexus");
-      } catch {
-        throw new Error("Failed to auto-install open-agents-nexus. Install manually: npm install -g open-agents-nexus");
-      }
-    }
+import { randomBytes as randomBytes6, createCipheriv, createDecipheriv, scryptSync, createHash } from "node:crypto";
+import { execSync as execSync20, spawn as spawn10 } from "node:child_process";
+function containsKeyMaterial(input) {
+  for (const pattern of KEY_PATTERNS) {
+    if (pattern.test(input))
+      return true;
   }
-  return nexusMod;
+  return false;
 }
-function deriveEncryptionKey(password, salt) {
-  return scryptSync(password, salt, KEY_LEN, {
-    N: SCRYPT_N,
-    r: SCRYPT_R,
-    p: SCRYPT_P
-  });
+var DAEMON_SCRIPT, KEY_PATTERNS, NexusTool;
+var init_nexus = __esm({
+  "packages/execution/dist/tools/nexus.js"() {
+    "use strict";
+    DAEMON_SCRIPT = `#!/usr/bin/env node
+/**
+ * nexus-daemon.mjs \u2014 Standalone nexus process with real TCP/UDP sockets.
+ * Spawned by the open-agents nexus tool. Communicates via JSON files.
+ *
+ * Usage: node nexus-daemon.mjs <nexus-dir> <agent-name> [agent-type]
+ */
+
+// Polyfill for Node <22 (libp2p's it-queue/mortice depends on this)
+if (typeof Promise.withResolvers === 'undefined') {
+  Promise.withResolvers = function withResolvers() {
+    let resolve, reject;
+    const promise = new Promise((res, rej) => { resolve = res; reject = rej; });
+    return { promise, resolve, reject };
+  };
 }
-function encryptKey(privateKeyHex, password) {
-  const salt = randomBytes6(32);
-  const key = deriveEncryptionKey(password, salt);
-  const iv = randomBytes6(16);
-  const cipher = createCipheriv(WALLET_ALGO, key, iv);
-  let encrypted = cipher.update(privateKeyHex, "utf8", "hex");
-  encrypted += cipher.final("hex");
-  const authTag = cipher.getAuthTag();
-  return {
-    encrypted,
-    iv: iv.toString("hex"),
-    authTag: authTag.toString("hex"),
-    salt: salt.toString("hex")
+
+import { NexusClient } from 'open-agents-nexus';
+import { readFileSync, writeFileSync, existsSync, mkdirSync, unlinkSync, readdirSync } from 'node:fs';
+import { join } from 'node:path';
+
+const nexusDir = process.argv[2];
+const agentName = process.argv[3] || 'open-agents-node';
+const agentType = process.argv[4] || 'general';
+const cmdFile = join(nexusDir, 'cmd.json');
+const respFile = join(nexusDir, 'resp.json');
+const statusFile = join(nexusDir, 'status.json');
+const inboxDir = join(nexusDir, 'inbox');
+const pidFile = join(nexusDir, 'daemon.pid');
+
+mkdirSync(inboxDir, { recursive: true });
+
+// Write PID so the agent can kill us
+writeFileSync(pidFile, String(process.pid));
+
+const keyPath = join(nexusDir, 'identity.key');
+const nexus = new NexusClient({
+  keyStorePath: keyPath,
+  agentName,
+  agentType,
+  role: 'light',
+  enableMdns: true,
+  enablePubsubDiscovery: true,
+});
+
+const rooms = new Map();
+let connected = false;
+
+function writeStatus(extra = {}) {
+  const data = {
+    pid: process.pid,
+    connected,
+    peerId: connected ? nexus.peerId : null,
+    agentName,
+    agentType,
+    rooms: [...rooms.keys()],
+    connectedAt: connected ? new Date().toISOString() : null,
+    ...extra,
   };
+  try { writeFileSync(statusFile, JSON.stringify(data, null, 2)); } catch {}
+}
+
+function writeResp(id, result) {
+  try { writeFileSync(respFile, JSON.stringify({ id, ...result }, null, 2)); } catch {}
 }
-function runInferenceBenchmark(repoRoot) {
+
+async function handleCmd(cmd) {
+  const { id, action, args } = cmd;
   try {
-    const psRaw = execSync20("ollama ps 2>/dev/null", { timeout: 1e4, encoding: "utf8" });
-    const lines = psRaw.trim().split("\n").filter((l) => l.trim());
-    if (lines.length < 2)
-      return null;
-    const modelLine = lines[1];
-    const parts = modelLine.split(/\s+/);
-    const modelName = parts[0] || "unknown";
-    const startTime = Date.now();
-    const benchPrompt = "Count from 1 to 50, one number per line:";
-    let benchResult;
-    try {
-      benchResult = execSync20(`echo "${benchPrompt}" | ollama run ${modelName} --nowordwrap 2>/dev/null`, { timeout: 3e4, encoding: "utf8" });
-    } catch {
-      benchResult = "";
-    }
-    const elapsed = (Date.now() - startTime) / 1e3;
-    const tokenEstimate = benchResult.split(/\s+/).length;
-    const tps = elapsed > 0 ? Math.round(tokenEstimate / elapsed) : 0;
-    let gpuName = "none";
-    let vramMb = 0;
-    try {
-      const nvidiaSmi = execSync20("nvidia-smi --query-gpu=name,memory.total --format=csv,noheader 2>/dev/null", {
-        timeout: 5e3,
-        encoding: "utf8"
-      });
-      const gpuParts = nvidiaSmi.trim().split(",");
-      gpuName = gpuParts[0]?.trim() || "unknown";
-      vramMb = parseInt(gpuParts[1]?.trim() || "0", 10);
-    } catch {
-      try {
-        const rocmSmi = execSync20("rocm-smi --showmeminfo vram 2>/dev/null", {
-          timeout: 5e3,
-          encoding: "utf8"
+    switch (action) {
+      case 'join_room': {
+        const roomId = args.room_id;
+        if (rooms.has(roomId)) { writeResp(id, { ok: true, output: 'Already in room: ' + roomId }); return; }
+        const room = await nexus.joinRoom(roomId);
+        rooms.set(roomId, room);
+        room.on('message', (msg) => {
+          const roomInbox = join(inboxDir, roomId);
+          mkdirSync(roomInbox, { recursive: true });
+          const fname = Date.now() + '-' + (msg.id || '').slice(0, 8) + '.json';
+          const entry = {
+            sender: msg.sender,
+            content: msg.payload?.content || '',
+            format: msg.payload?.format || 'text/plain',
+            timestamp: msg.timestamp || Date.now(),
+            id: msg.id,
+          };
+          try { writeFileSync(join(roomInbox, fname), JSON.stringify(entry, null, 2)); } catch {}
         });
-        if (rocmSmi.includes("Total")) {
-          gpuName = "AMD GPU";
-          const match = rocmSmi.match(/Total Memory.*?(\d+)/);
-          vramMb = match ? Math.round(parseInt(match[1], 10) / (1024 * 1024)) : 0;
-        }
-      } catch {
+        writeStatus();
+        writeResp(id, { ok: true, output: 'Joined room: ' + roomId });
+        break;
       }
+      case 'leave_room': {
+        const roomId = args.room_id;
+        const room = rooms.get(roomId);
+        if (!room) { writeResp(id, { ok: false, output: 'Not in room: ' + roomId }); return; }
+        await room.leave();
+        rooms.delete(roomId);
+        writeStatus();
+        writeResp(id, { ok: true, output: 'Left room: ' + roomId });
+        break;
+      }
+      case 'send_message': {
+        const room = rooms.get(args.room_id);
+        if (!room) { writeResp(id, { ok: false, output: 'Not in room: ' + args.room_id + '. Join it first.' }); return; }
+        const msgId = await room.send(args.message, { format: 'text/plain' });
+        writeResp(id, { ok: true, output: 'Message sent (id: ' + msgId + ')' });
+        break;
+      }
+      case 'discover_peers': {
+        const node = nexus.network?.node;
+        const peers = node?.getPeers?.() || [];
+        const list = peers.slice(0, 20).map(p => p.toString?.() || String(p));
+        writeResp(id, { ok: true, output: 'Peers: ' + list.length + '\\n' + list.map(p => '  ' + p.slice(0, 20) + '...').join('\\n') });
+        break;
+      }
+      case 'list_rooms': {
+        const joined = [...rooms.keys()];
+        writeResp(id, { ok: true, output: joined.length ? 'Rooms: ' + joined.join(', ') : 'No rooms joined.' });
+        break;
+      }
+      case 'ping': {
+        writeResp(id, { ok: true, output: 'pong' });
+        break;
+      }
+      default:
+        writeResp(id, { ok: false, output: 'Unknown daemon command: ' + action });
     }
-    const nonce = randomBytes6(16).toString("hex");
-    const hashInput = `${modelName}:${tps}:${elapsed}:${tokenEstimate}:${nonce}`;
-    const { createHash: createHash4 } = __require("node:crypto");
-    const benchmarkHash = createHash4("sha256").update(hashInput).digest("hex");
-    return {
-      modelName,
-      modelSize: parts[1] || "unknown",
-      tokensPerSecond: tps,
-      promptEvalTps: tps,
-      // simplified — same as generation for now
-      contextLength: 32768,
-      // default assumption
-      gpuLayers: vramMb > 0 ? 99 : 0,
-      gpuName,
-      vramMb,
-      benchmarkHash,
-      timestamp: (/* @__PURE__ */ new Date()).toISOString()
-    };
-  } catch {
-    return null;
+  } catch (err) {
+    writeResp(id, { ok: false, output: 'Error: ' + (err.message || String(err)) });
   }
 }
-function containsKeyMaterial(input) {
+
+// Command polling loop \u2014 check for cmd.json every 500ms
+let lastCmdId = '';
+setInterval(() => {
   try {
-    const { X402PaymentRail } = __require("open-agents-nexus");
-    if (X402PaymentRail.containsKeyMaterial(input))
-      return true;
-  } catch {
-  }
-  for (const pattern of KEY_PATTERNS) {
-    if (pattern.test(input)) {
-      if (pattern.source === "[0-9a-fA-F]{64}") {
-        const lower = input.toLowerCase();
-        if (lower.includes("key") || lower.includes("private") || lower.includes("secret") || lower.includes("wallet")) {
-          return true;
-        }
-        continue;
-      }
-      return true;
-    }
+    if (!existsSync(cmdFile)) return;
+    const raw = readFileSync(cmdFile, 'utf8');
+    const cmd = JSON.parse(raw);
+    if (cmd.id === lastCmdId) return; // already processed
+    lastCmdId = cmd.id;
+    handleCmd(cmd);
+  } catch {}
+}, 500);
+
+// Connect
+(async () => {
+  try {
+    await nexus.connect();
+    // Ensure node is started (libp2p compat)
+    const node = nexus.network?.node;
+    if (node && typeof node.start === 'function' && !node.isStarted?.()) {
+      await node.start();
+    }
+    connected = true;
+    writeStatus();
+    console.log('Nexus daemon connected as ' + nexus.peerId);
+  } catch (err) {
+    writeStatus({ error: err.message || String(err) });
+    console.error('Nexus daemon connect failed:', err.message || err);
+    process.exit(1);
   }
-  return false;
-}
-var nexusMod, WALLET_ALGO, SCRYPT_N, SCRYPT_R, SCRYPT_P, KEY_LEN, KEY_PATTERNS, clientInstance, activeRooms, registeredServices, connectionPeerId, NexusTool;
-var init_nexus = __esm({
-  "packages/execution/dist/tools/nexus.js"() {
-    "use strict";
-    nexusMod = null;
-    WALLET_ALGO = "aes-256-gcm";
-    SCRYPT_N = 16384;
-    SCRYPT_R = 8;
-    SCRYPT_P = 1;
-    KEY_LEN = 32;
+})();
+
+// Graceful shutdown
+process.on('SIGTERM', async () => {
+  for (const [, room] of rooms) { try { await room.leave(); } catch {} }
+  await nexus.disconnect();
+  try { unlinkSync(pidFile); } catch {}
+  try { unlinkSync(statusFile); } catch {}
+  process.exit(0);
+});
+process.on('SIGINT', () => process.emit('SIGTERM'));
+`;
     KEY_PATTERNS = [
       /0x[0-9a-fA-F]{64}/,
-      // Ethereum private key
       /[5KL][1-9A-HJ-NP-Za-km-z]{50,51}/,
-      // Bitcoin WIF
       /-----BEGIN.*PRIVATE KEY-----/,
-      // PEM private key
-      /ed25519:[A-Za-z0-9+/=]{40,}/,
-      // Ed25519 key
-      /[0-9a-fA-F]{64}/
-      // Raw 256-bit hex key (loose match — check context)
+      /ed25519:[A-Za-z0-9+/=]{40,}/
     ];
-    clientInstance = null;
-    activeRooms = /* @__PURE__ */ new Map();
-    registeredServices = [];
-    connectionPeerId = "";
     NexusTool = class {
       name = "nexus";
-      description = "Decentralized agent-to-agent communication via open-agents-nexus. Simple flow: connect \u2192 join room \u2192 send messages. Everything else is automatic. Also supports peer discovery, IPFS storage, x402 micropayments, and inference proofs. Wallet keys are NEVER exposed \u2014 only public address and balance visible.";
+      description = "Decentralized agent-to-agent communication via open-agents-nexus. Spawns a background Node.js process with real network sockets for libp2p P2P mesh. Simple flow: connect \u2192 join room \u2192 send messages. Auto-installs nexus if needed. Also supports peer discovery, x402 micropayments, and inference proofs.";
       parameters = {
         type: "object",
         properties: {
@@ -11339,55 +11378,23 @@ var init_nexus = __esm({
               "join_room",
               "leave_room",
               "send_message",
-              "list_rooms",
+              "read_messages",
               "discover_peers",
-              "find_agent",
-              "register_service",
-              "list_services",
+              "list_rooms",
               "wallet_status",
               "wallet_create",
-              "inference_proof",
-              "store_content",
-              "retrieve_content"
+              "inference_proof"
             ],
             description: "The nexus action to perform"
           },
           room_id: {
             type: "string",
-            description: "Room ID for join_room, leave_room, send_message"
-          },
-          room_name: {
-            type: "string",
-            description: "Human-readable room name (for join_room creation)"
+            description: "Room ID for join_room, leave_room, send_message, read_messages"
           },
           message: {
             type: "string",
             description: "Message content for send_message (scanned for key leaks)"
           },
-          peer_id: {
-            type: "string",
-            description: "Peer ID for find_agent"
-          },
-          service_id: {
-            type: "string",
-            description: "Service identifier for register_service"
-          },
-          service_name: {
-            type: "string",
-            description: "Human-readable service name"
-          },
-          service_description: {
-            type: "string",
-            description: "Service description"
-          },
-          price_amount: {
-            type: "string",
-            description: "Price per request in USDC (e.g. '0.001')"
-          },
-          rate_limit: {
-            type: "number",
-            description: "Max requests per hour for this service"
-          },
           agent_name: {
             type: "string",
             description: "Agent display name for connect"
@@ -11399,14 +11406,6 @@ var init_nexus = __esm({
           wallet_address: {
             type: "string",
             description: "Wallet address for wallet_create (user-provided receive address)"
-          },
-          content: {
-            type: "string",
-            description: "Content to store for store_content"
-          },
-          cid: {
-            type: "string",
-            description: "Content identifier for retrieve_content"
           }
         },
         required: ["action"],
@@ -11439,28 +11438,22 @@ var init_nexus = __esm({
               result = await this.doStatus();
               break;
             case "join_room":
-              result = await this.doJoinRoom(args);
+              result = await this.sendDaemonCmd("join_room", args);
               break;
             case "leave_room":
-              result = await this.doLeaveRoom(args);
+              result = await this.sendDaemonCmd("leave_room", args);
               break;
             case "send_message":
               result = await this.doSendMessage(args);
               break;
-            case "list_rooms":
-              result = await this.doListRooms();
+            case "read_messages":
+              result = await this.doReadMessages(args);
               break;
             case "discover_peers":
-              result = await this.doDiscoverPeers();
-              break;
-            case "find_agent":
-              result = await this.doFindAgent(args);
-              break;
-            case "register_service":
-              result = await this.doRegisterService(args);
+              result = await this.sendDaemonCmd("discover_peers", args);
               break;
-            case "list_services":
-              result = await this.doListServices();
+            case "list_rooms":
+              result = await this.sendDaemonCmd("list_rooms", args);
               break;
             case "wallet_status":
               result = await this.doWalletStatus();
@@ -11471,484 +11464,367 @@ var init_nexus = __esm({
             case "inference_proof":
               result = await this.doInferenceProof();
               break;
-            case "store_content":
-              result = await this.doStoreContent(args);
-              break;
-            case "retrieve_content":
-              result = await this.doRetrieveContent(args);
-              break;
             default:
-              return {
-                success: false,
-                output: "",
-                error: `Unknown nexus action: ${action}`,
-                durationMs: Date.now() - start
-              };
+              return { success: false, output: "", error: `Unknown nexus action: ${action}`, durationMs: Date.now() - start };
           }
           return { success: true, output: result, durationMs: Date.now() - start };
         } catch (err) {
-          return {
-            success: false,
-            output: "",
-            error: err.message || String(err),
-            durationMs: Date.now() - start
-          };
+          return { success: false, output: "", error: err.message || String(err), durationMs: Date.now() - start };
         }
       }
       // =========================================================================
-      // Action implementations
+      // Daemon management
       // =========================================================================
-      async doConnect(args) {
-        if (clientInstance) {
-          return `Already connected as ${connectionPeerId}. Use 'disconnect' first to reconnect.`;
+      getDaemonPid() {
+        const pidFile = join28(this.nexusDir, "daemon.pid");
+        if (!existsSync21(pidFile))
+          return null;
+        try {
+          const pid = parseInt(__require("node:fs").readFileSync(pidFile, "utf8").trim(), 10);
+          process.kill(pid, 0);
+          return pid;
+        } catch {
+          return null;
         }
-        await this.ensureDir();
-        const nexus = await loadNexus();
-        const agentName = args.agent_name || "open-agents-node";
-        const agentType = args.agent_type || "general";
-        const keyPath = join28(this.nexusDir, "identity.key");
-        let walletAddress;
-        const walletPath = join28(this.nexusDir, "wallet.enc");
-        if (existsSync21(walletPath)) {
+      }
+      async sendDaemonCmd(action, args) {
+        const pid = this.getDaemonPid();
+        if (!pid)
+          throw new Error("Nexus daemon not running. Use action 'connect' first.");
+        const cmdId = randomBytes6(8).toString("hex");
+        const cmdFile = join28(this.nexusDir, "cmd.json");
+        const respFile = join28(this.nexusDir, "resp.json");
+        if (existsSync21(respFile))
+          await unlink(respFile).catch(() => {
+          });
+        await writeFile12(cmdFile, JSON.stringify({ id: cmdId, action, args }, null, 2));
+        for (let i = 0; i < 30; i++) {
+          await new Promise((r) => setTimeout(r, 500));
+          if (!existsSync21(respFile))
+            continue;
           try {
-            const walletData = JSON.parse(await readFile13(walletPath, "utf8"));
-            walletAddress = walletData.address;
+            const resp = JSON.parse(await readFile13(respFile, "utf8"));
+            if (resp.id === cmdId) {
+              return resp.output || (resp.ok ? "OK" : "Failed");
+            }
           } catch {
           }
         }
-        const client = new nexus.NexusClient({
-          keyStorePath: keyPath,
-          agentName,
-          agentType,
-          role: "light",
-          enableMdns: true,
-          enablePubsubDiscovery: true,
-          x402: walletAddress ? { enabled: true, walletAddress, allowedCurrencies: ["USDC"], allowedNetworks: ["base"] } : { enabled: false }
-        });
-        await client.connect();
-        clientInstance = client;
-        connectionPeerId = client.peerId;
-        await writeFile12(join28(this.nexusDir, "connection.json"), JSON.stringify({
-          peerId: connectionPeerId,
-          agentName,
-          agentType,
-          connectedAt: (/* @__PURE__ */ new Date()).toISOString(),
-          walletAddress: walletAddress || null
-        }, null, 2));
-        return [
-          `Connected to nexus P2P network.`,
-          `  Peer ID: ${connectionPeerId}`,
-          `  Agent: ${agentName} (${agentType})`,
-          `  Role: light`,
-          walletAddress ? `  Wallet: ${walletAddress}` : `  Wallet: not configured (use wallet_create)`,
-          `  x402 payments: ${walletAddress ? "enabled" : "disabled"}`,
-          ``,
-          `You can now join rooms, discover peers, and participate in the agent mesh.`
-        ].join("\n");
+        return "Daemon did not respond within 15s. It may still be processing.";
       }
-      async doDisconnect() {
-        if (!clientInstance) {
-          return "Not connected to nexus network.";
+      // =========================================================================
+      // Actions
+      // =========================================================================
+      async doConnect(args) {
+        await this.ensureDir();
+        const existingPid = this.getDaemonPid();
+        if (existingPid) {
+          const statusFile2 = join28(this.nexusDir, "status.json");
+          if (existsSync21(statusFile2)) {
+            try {
+              const status = JSON.parse(await readFile13(statusFile2, "utf8"));
+              return `Already connected (pid: ${existingPid}, peerId: ${status.peerId || "starting..."})`;
+            } catch {
+            }
+          }
+          return `Daemon already running (pid: ${existingPid}).`;
         }
-        for (const [roomId, room] of activeRooms) {
+        try {
+          execSync20(`node -e "require.resolve('open-agents-nexus')"`, { stdio: "pipe", timeout: 5e3 });
+        } catch {
           try {
-            await room.leave();
+            execSync20("npm install -g open-agents-nexus@latest 2>&1 || npm install open-agents-nexus@latest 2>&1", {
+              stdio: "pipe",
+              timeout: 12e4
+            });
           } catch {
+            throw new Error("Failed to install open-agents-nexus. Run: npm install -g open-agents-nexus");
           }
         }
-        activeRooms.clear();
-        await clientInstance.disconnect();
-        clientInstance = null;
-        const pid = connectionPeerId;
-        connectionPeerId = "";
-        const connPath = join28(this.nexusDir, "connection.json");
-        if (existsSync21(connPath)) {
-          const { unlink } = await import("node:fs/promises");
-          await unlink(connPath).catch(() => {
-          });
+        const daemonPath = join28(this.nexusDir, "nexus-daemon.mjs");
+        await writeFile12(daemonPath, DAEMON_SCRIPT);
+        const agentName = args.agent_name || "open-agents-node";
+        const agentType = args.agent_type || "general";
+        const child = spawn10("node", [daemonPath, this.nexusDir, agentName, agentType], {
+          detached: true,
+          stdio: ["ignore", "pipe", "pipe"],
+          cwd: this.repoRoot
+        });
+        child.unref();
+        let earlyOutput = "";
+        let earlyError = "";
+        child.stdout?.on("data", (d) => {
+          earlyOutput += d.toString();
+        });
+        child.stderr?.on("data", (d) => {
+          earlyError += d.toString();
+        });
+        const statusFile = join28(this.nexusDir, "status.json");
+        for (let i = 0; i < 40; i++) {
+          await new Promise((r) => setTimeout(r, 500));
+          if (existsSync21(statusFile)) {
+            try {
+              const status = JSON.parse(await readFile13(statusFile, "utf8"));
+              if (status.error) {
+                return `Nexus daemon failed to connect: ${status.error}`;
+              }
+              if (status.connected && status.peerId) {
+                return [
+                  `Connected to nexus P2P network.`,
+                  `  Peer ID: ${status.peerId}`,
+                  `  Agent: ${agentName} (${agentType})`,
+                  `  Daemon PID: ${status.pid}`,
+                  ``,
+                  `Use join_room to enter a room, then send_message to communicate.`
+                ].join("\n");
+              }
+            } catch {
+            }
+          }
         }
-        return `Disconnected from nexus network. (was: ${pid})`;
-      }
-      async doStatus() {
-        if (!clientInstance) {
-          return "Not connected. Use action 'connect' to join the nexus network.";
+        const pid = this.getDaemonPid();
+        if (pid) {
+          return `Daemon spawned (pid: ${pid}) but still connecting. Check status in a moment.${earlyError ? "\nStderr: " + earlyError.slice(0, 200) : ""}`;
         }
-        const stats = clientInstance.getStats();
-        const rooms = Array.from(activeRooms.keys());
-        let walletInfo = "not configured";
-        const walletPath = join28(this.nexusDir, "wallet.enc");
-        if (existsSync21(walletPath)) {
+        return `Daemon failed to start.${earlyError ? "\n" + earlyError.slice(0, 500) : ""}${earlyOutput ? "\n" + earlyOutput.slice(0, 500) : ""}`;
+      }
+      async doDisconnect() {
+        const pid = this.getDaemonPid();
+        if (!pid)
+          return "Nexus daemon not running.";
+        try {
+          process.kill(pid, "SIGTERM");
+          await new Promise((r) => setTimeout(r, 1e3));
           try {
-            const walletData = JSON.parse(await readFile13(walletPath, "utf8"));
-            walletInfo = walletData.address;
+            process.kill(pid, 0);
+            process.kill(pid, "SIGKILL");
           } catch {
-            walletInfo = "corrupt";
           }
+        } catch {
         }
-        return [
-          `Nexus Network Status`,
-          `  Connected: true`,
-          `  Peer ID: ${connectionPeerId}`,
-          `  Rooms joined: ${rooms.length} [${rooms.join(", ")}]`,
-          `  Content pinned: ${stats.totalPinned} (${stats.pinnedFromOthers} from others)`,
-          `  Tracked CIDs: ${stats.trackedCids}`,
-          `  Registered services: ${registeredServices.length}`,
-          `  Wallet: ${walletInfo}`,
-          `  x402: ${clientInstance.x402?.isEnabled ? "enabled" : "disabled"}`
-        ].join("\n");
-      }
-      async doJoinRoom(args) {
-        if (!clientInstance)
-          throw new Error("Not connected. Use 'connect' first.");
-        const roomId = args.room_id;
-        if (!roomId)
-          throw new Error("room_id is required");
-        if (activeRooms.has(roomId)) {
-          return `Already in room: ${roomId}`;
-        }
-        const room = await clientInstance.joinRoom(roomId);
-        activeRooms.set(roomId, room);
-        room.on("message", (msg) => {
-          const msgDir = join28(this.nexusDir, "messages", roomId);
-          mkdir8(msgDir, { recursive: true }).then(() => {
-            const filename = `${msg.id || Date.now()}.json`;
-            writeFile12(join28(msgDir, filename), JSON.stringify(msg, null, 2)).catch(() => {
+        for (const f of ["daemon.pid", "status.json", "cmd.json", "resp.json"]) {
+          const p = join28(this.nexusDir, f);
+          if (existsSync21(p))
+            await unlink(p).catch(() => {
             });
-          }).catch(() => {
-          });
-        });
-        return `Joined room: ${roomId}
-Listening for messages. Use send_message to communicate.`;
+        }
+        return `Disconnected from nexus network (killed pid ${pid}).`;
       }
-      async doLeaveRoom(args) {
-        const roomId = args.room_id;
-        if (!roomId)
-          throw new Error("room_id is required");
-        const room = activeRooms.get(roomId);
-        if (!room)
-          return `Not in room: ${roomId}`;
-        await room.leave();
-        activeRooms.delete(roomId);
-        return `Left room: ${roomId}`;
+      async doStatus() {
+        const pid = this.getDaemonPid();
+        if (!pid)
+          return "Nexus daemon not running. Use action 'connect' to start.";
+        const statusFile = join28(this.nexusDir, "status.json");
+        if (!existsSync21(statusFile))
+          return `Daemon running (pid: ${pid}) but no status yet.`;
+        try {
+          const status = JSON.parse(await readFile13(statusFile, "utf8"));
+          const lines = [
+            `Nexus Status`,
+            `  Connected: ${status.connected}`,
+            `  Peer ID: ${status.peerId || "n/a"}`,
+            `  Agent: ${status.agentName} (${status.agentType})`,
+            `  Daemon PID: ${status.pid}`,
+            `  Rooms: ${status.rooms?.length || 0} [${(status.rooms || []).join(", ")}]`
+          ];
+          const walletPath = join28(this.nexusDir, "wallet.enc");
+          if (existsSync21(walletPath)) {
+            try {
+              const w = JSON.parse(await readFile13(walletPath, "utf8"));
+              lines.push(`  Wallet: ${w.address}`);
+            } catch {
+              lines.push(`  Wallet: corrupt`);
+            }
+          } else {
+            lines.push(`  Wallet: not configured`);
+          }
+          const inboxDir = join28(this.nexusDir, "inbox");
+          if (existsSync21(inboxDir)) {
+            try {
+              const roomDirs = await readdir3(inboxDir);
+              let totalMsgs = 0;
+              for (const rd of roomDirs) {
+                try {
+                  totalMsgs += (await readdir3(join28(inboxDir, rd))).length;
+                } catch {
+                }
+              }
+              lines.push(`  Inbox: ${totalMsgs} message(s) across ${roomDirs.length} room(s)`);
+            } catch {
+            }
+          }
+          if (status.error)
+            lines.push(`  Error: ${status.error}`);
+          return lines.join("\n");
+        } catch {
+          return `Daemon running (pid: ${pid}) but status file unreadable.`;
+        }
       }
       async doSendMessage(args) {
-        if (!clientInstance)
-          throw new Error("Not connected. Use 'connect' first.");
-        const roomId = args.room_id;
         const message = args.message;
-        if (!roomId)
-          throw new Error("room_id is required");
         if (!message)
           throw new Error("message is required");
+        if (!args.room_id)
+          throw new Error("room_id is required");
         if (containsKeyMaterial(message)) {
           return [
             "BLOCKED: Message contains potential key material or secrets.",
-            "For security, messages containing private keys, wallet secrets,",
-            "or sensitive cryptographic material cannot be sent over the network.",
-            "Please remove the sensitive content and try again."
+            "Messages containing private keys or sensitive cryptographic material",
+            "cannot be sent over the network. Remove the sensitive content and retry."
           ].join("\n");
         }
-        const room = activeRooms.get(roomId);
-        if (!room)
-          throw new Error(`Not in room: ${roomId}. Join it first.`);
-        const msgId = await room.send(message, { format: "text/plain" });
-        return `Message sent to ${roomId} (id: ${msgId})`;
-      }
-      async doListRooms() {
-        if (!clientInstance)
-          throw new Error("Not connected. Use 'connect' first.");
-        try {
-          const rooms = await clientInstance.listRooms();
-          if (!rooms || rooms.length === 0) {
-            return "No rooms found on the network. Create one by joining a new room ID.";
-          }
-          const lines = rooms.map((r) => `  ${r.roomId} \u2014 ${r.name || "(unnamed)"} [${r.memberCount || 0} members, ${r.type}]`);
-          return `Available rooms:
-${lines.join("\n")}`;
-        } catch {
-          return "Could not list rooms (DHT may still be bootstrapping). Try again in a moment.";
-        }
+        return this.sendDaemonCmd("send_message", args);
       }
-      async doDiscoverPeers() {
-        if (!clientInstance)
-          throw new Error("Not connected. Use 'connect' first.");
-        try {
-          const node = clientInstance.network?.node;
-          if (!node)
-            return "Network node not available yet.";
-          const peers = node.getPeers ? node.getPeers() : [];
-          if (peers.length === 0) {
-            return "No peers discovered yet. The network may still be bootstrapping. Try again in a few seconds.";
-          }
-          const lines = [`Discovered ${peers.length} peer(s):`];
-          for (const peerId of peers.slice(0, 20)) {
-            const pid = peerId.toString ? peerId.toString() : String(peerId);
+      async doReadMessages(args) {
+        const roomId = args.room_id;
+        const inboxDir = join28(this.nexusDir, "inbox");
+        if (roomId) {
+          const roomInbox = join28(inboxDir, roomId);
+          if (!existsSync21(roomInbox))
+            return `No messages in room: ${roomId}`;
+          const files = (await readdir3(roomInbox)).sort().slice(-20);
+          if (files.length === 0)
+            return `No messages in room: ${roomId}`;
+          const messages = [`Messages in ${roomId} (last ${files.length}):`];
+          for (const f of files) {
             try {
-              const profile = await clientInstance.findAgent(pid);
-              if (profile) {
-                lines.push(`  ${pid.slice(0, 16)}... \u2014 ${profile.name} (${profile.type}) [${profile.capabilities?.length || 0} capabilities]`);
-              } else {
-                lines.push(`  ${pid.slice(0, 16)}... \u2014 (no profile)`);
-              }
+              const msg = JSON.parse(await readFile13(join28(roomInbox, f), "utf8"));
+              const sender = (msg.sender || "unknown").slice(0, 12);
+              messages.push(`  [${new Date(msg.timestamp).toLocaleTimeString()}] ${sender}...: ${msg.content}`);
             } catch {
-              lines.push(`  ${pid.slice(0, 16)}... \u2014 (lookup failed)`);
             }
           }
-          if (peers.length > 20) {
-            lines.push(`  ... and ${peers.length - 20} more`);
-          }
-          return lines.join("\n");
-        } catch (err) {
-          return `Peer discovery error: ${err.message}`;
+          return messages.join("\n");
         }
-      }
-      async doFindAgent(args) {
-        if (!clientInstance)
-          throw new Error("Not connected. Use 'connect' first.");
-        const peerId = args.peer_id;
-        if (!peerId)
-          throw new Error("peer_id is required");
-        const profile = await clientInstance.findAgent(peerId);
-        if (!profile) {
-          return `Agent not found: ${peerId}`;
-        }
-        const caps = profile.capabilities?.map((c3) => `    - ${c3.name}: ${c3.description} [${c3.pricing}]`) || [];
-        return [
-          `Agent Profile:`,
-          `  Peer ID: ${profile.peerId}`,
-          `  Name: ${profile.name}`,
-          `  Type: ${profile.type}`,
-          `  Role: ${profile.role}`,
-          `  Capabilities (${caps.length}):`,
-          ...caps,
-          `  Created: ${new Date(profile.createdAt).toISOString()}`,
-          `  Updated: ${new Date(profile.updatedAt).toISOString()}`
-        ].join("\n");
-      }
-      async doRegisterService(args) {
-        if (!clientInstance)
-          throw new Error("Not connected. Use 'connect' first.");
-        const serviceId = args.service_id || `svc-${randomBytes6(4).toString("hex")}`;
-        const name = args.service_name || "inference";
-        const description = args.service_description || "AI inference service";
-        const priceAmount = args.price_amount || "0.001";
-        const rateLimit = args.rate_limit || 60;
-        const walletPath = join28(this.nexusDir, "wallet.enc");
-        let walletAddress = "";
-        if (existsSync21(walletPath)) {
+        if (!existsSync21(inboxDir))
+          return "No messages received yet.";
+        const roomDirs = await readdir3(inboxDir);
+        if (roomDirs.length === 0)
+          return "No messages received yet.";
+        const lines = ["Inbox:"];
+        for (const rd of roomDirs) {
           try {
-            const walletData = JSON.parse(await readFile13(walletPath, "utf8"));
-            walletAddress = walletData.address;
+            const count = (await readdir3(join28(inboxDir, rd))).length;
+            lines.push(`  ${rd}: ${count} message(s)`);
           } catch {
           }
         }
-        if (!walletAddress) {
-          return "Cannot register paid service without a wallet. Use wallet_create first.";
-        }
-        const offering = {
-          serviceId,
-          name,
-          description,
-          price: {
-            amount: priceAmount,
-            currency: "USDC",
-            network: "base",
-            recipient: walletAddress,
-            description: `Payment for ${name}`,
-            expiresAt: Date.now() + 36e5,
-            // 1 hour
-            requestId: `req-${randomBytes6(8).toString("hex")}`
-          },
-          rateLimit,
-          sensitive: false
-        };
-        clientInstance.x402.registerService(offering);
-        registeredServices.push(offering);
-        await this.ensureDir();
-        await writeFile12(join28(this.nexusDir, "services.json"), JSON.stringify(registeredServices, null, 2));
-        return [
-          `Service registered:`,
-          `  ID: ${serviceId}`,
-          `  Name: ${name}`,
-          `  Description: ${description}`,
-          `  Price: ${priceAmount} USDC per request`,
-          `  Rate limit: ${rateLimit} req/hour`,
-          `  Recipient wallet: ${walletAddress}`
-        ].join("\n");
-      }
-      async doListServices() {
-        const services = clientInstance?.x402?.getServices() || registeredServices;
-        if (services.length === 0) {
-          return "No services registered. Use register_service to offer inference.";
-        }
-        const lines = services.map((s) => `  ${s.serviceId} \u2014 ${s.name}: ${s.description} [${s.price?.amount || "?"} ${s.price?.currency || "USDC"}, ${s.rateLimit} req/hr]`);
-        return `Registered services (${services.length}):
-${lines.join("\n")}`;
+        return lines.join("\n");
       }
       async doWalletStatus() {
         await this.ensureDir();
         const walletPath = join28(this.nexusDir, "wallet.enc");
         if (!existsSync21(walletPath)) {
-          return [
-            "No wallet configured.",
-            "Use wallet_create to generate a new wallet for x402 micropayments.",
-            "Or provide your own wallet address with wallet_create + wallet_address parameter."
-          ].join("\n");
+          return "No wallet configured. Use wallet_create to set one up.";
         }
         try {
-          const walletData = JSON.parse(await readFile13(walletPath, "utf8"));
+          const w = JSON.parse(await readFile13(walletPath, "utf8"));
           return [
             `Wallet Status:`,
-            `  Address: ${walletData.address}`,
-            `  Created: ${walletData.createdAt}`,
+            `  Address: ${w.address}`,
+            `  Created: ${w.createdAt}`,
             `  Encryption: AES-256-GCM + scrypt`,
-            `  Key file: ${walletPath} (0600)`,
-            ``,
-            `  NOTE: Private key is encrypted and NEVER accessible to the agent.`,
-            `  Only the public address is visible. Payment operations use the`,
-            `  encrypted key internally without exposing it.`
+            `  NOTE: Private key is encrypted and NEVER accessible to the agent.`
           ].join("\n");
         } catch {
-          return "Wallet file exists but could not be read. It may be corrupted.";
+          return "Wallet file exists but could not be read.";
         }
       }
       async doWalletCreate(args) {
         await this.ensureDir();
         const walletPath = join28(this.nexusDir, "wallet.enc");
-        if (existsSync21(walletPath)) {
-          return "Wallet already exists. To create a new one, delete .oa/nexus/wallet.enc first.";
-        }
+        if (existsSync21(walletPath))
+          return "Wallet already exists.";
         const userAddress = args.wallet_address;
         if (userAddress) {
           if (!/^0x[0-9a-fA-F]{40}$/.test(userAddress)) {
-            return "Invalid wallet address format. Expected Ethereum address (0x + 40 hex chars).";
+            return "Invalid address format. Expected 0x + 40 hex chars.";
           }
-          const walletData2 = {
+          const w2 = {
             version: 1,
             address: userAddress,
             encryptedKey: "",
-            // user-managed key
             iv: "",
             authTag: "",
             salt: "",
             createdAt: (/* @__PURE__ */ new Date()).toISOString()
           };
-          await writeFile12(walletPath, JSON.stringify(walletData2, null, 2));
+          await writeFile12(walletPath, JSON.stringify(w2, null, 2));
           await chmod(walletPath, 384);
-          return [
-            `Wallet configured with user-provided address.`,
-            `  Address: ${userAddress}`,
-            `  Key management: user-managed (external wallet)`,
-            `  File: ${walletPath}`,
-            ``,
-            `This address will be used for receiving x402 payments.`,
-            `Outbound payments require the agent to have signing capability,`,
-            `which is not available with an external address.`
-          ].join("\n");
-        }
-        const privateKeyBytes = randomBytes6(32);
-        const privateKeyHex = privateKeyBytes.toString("hex");
-        let address;
-        try {
-          const { createHash: createHash4 } = await import("node:crypto");
-          const pubHash = createHash4("sha256").update(privateKeyBytes).digest("hex");
-          address = "0x" + pubHash.slice(0, 40);
-        } catch {
-          address = "0x" + randomBytes6(20).toString("hex");
-        }
-        const machineId = `${__require("node:os").hostname()}:${__require("node:os").userInfo().username}:nexus-wallet`;
-        const { encrypted, iv, authTag, salt } = encryptKey(privateKeyHex, machineId);
-        privateKeyBytes.fill(0);
-        const walletData = {
+          return `Wallet configured: ${userAddress} (user-managed)`;
+        }
+        const privKey = randomBytes6(32);
+        const address = "0x" + createHash("sha256").update(privKey).digest("hex").slice(0, 40);
+        const salt = randomBytes6(32);
+        const key = scryptSync(`${__require("node:os").hostname()}:${__require("node:os").userInfo().username}:nexus-wallet`, salt, 32, { N: 16384, r: 8, p: 1 });
+        const iv = randomBytes6(16);
+        const cipher = createCipheriv("aes-256-gcm", key, iv);
+        let enc = cipher.update(privKey.toString("hex"), "utf8", "hex");
+        enc += cipher.final("hex");
+        privKey.fill(0);
+        const w = {
           version: 1,
           address,
-          encryptedKey: encrypted,
-          iv,
-          authTag,
-          salt,
+          encryptedKey: enc,
+          iv: iv.toString("hex"),
+          authTag: cipher.getAuthTag().toString("hex"),
+          salt: salt.toString("hex"),
           createdAt: (/* @__PURE__ */ new Date()).toISOString()
         };
-        await writeFile12(walletPath, JSON.stringify(walletData, null, 2));
+        await writeFile12(walletPath, JSON.stringify(w, null, 2));
         await chmod(walletPath, 384);
         return [
-          `Wallet created successfully.`,
-          `  Address: ${address}`,
-          `  Encryption: AES-256-GCM with scrypt key derivation`,
-          `  Key file: ${walletPath} (permissions: 0600)`,
-          ``,
-          `  SECURITY NOTES:`,
-          `  - Private key is encrypted at rest and NEVER visible to the agent`,
-          `  - Key material is cleared from memory after encryption`,
-          `  - The encryption password is derived from machine identity`,
-          `  - Only payment operations can use the key (internally)`,
-          `  - The key CANNOT be extracted via tool calls or messages`
+          `Wallet created: ${address}`,
+          `  Encrypted with AES-256-GCM (key NEVER visible to agent)`,
+          `  File: ${walletPath} (0600)`
         ].join("\n");
       }
       async doInferenceProof() {
-        const proof = runInferenceBenchmark(this.repoRoot);
-        if (!proof) {
+        try {
+          const psRaw = execSync20("ollama ps 2>/dev/null", { timeout: 1e4, encoding: "utf8" });
+          const lines = psRaw.trim().split("\n").filter((l) => l.trim());
+          if (lines.length < 2)
+            return "No model loaded. Run 'ollama ps' to check.";
+          const parts = lines[1].split(/\s+/);
+          const modelName = parts[0] || "unknown";
+          let gpuName = "none", vramMb = 0;
+          try {
+            const smi = execSync20("nvidia-smi --query-gpu=name,memory.total --format=csv,noheader 2>/dev/null", {
+              timeout: 5e3,
+              encoding: "utf8"
+            });
+            const gp = smi.trim().split(",");
+            gpuName = gp[0]?.trim() || "unknown";
+            vramMb = parseInt(gp[1]?.trim() || "0", 10);
+          } catch {
+            try {
+              execSync20("rocm-smi 2>/dev/null", { timeout: 5e3 });
+              gpuName = "AMD GPU";
+            } catch {
+            }
+          }
+          const nonce = randomBytes6(16).toString("hex");
+          const hash = createHash("sha256").update(`${modelName}:${nonce}:${Date.now()}`).digest("hex");
+          const bar = (s) => "\u2588".repeat(Math.round(s / 5)) + "\u2591".repeat(20 - Math.round(s / 5));
+          const mem = vramMb > 24e3 ? 95 : vramMb > 16e3 ? 80 : vramMb > 8e3 ? 60 : vramMb > 0 ? 40 : 20;
+          await this.ensureDir();
+          await writeFile12(join28(this.nexusDir, "inference-proof.json"), JSON.stringify({
+            modelName,
+            gpuName,
+            vramMb,
+            hash,
+            timestamp: (/* @__PURE__ */ new Date()).toISOString()
+          }, null, 2));
           return [
-            "Could not generate inference proof.",
-            "Ensure Ollama is running with a loaded model (ollama ps)."
+            `Inference Capability Proof`,
+            `  Model: ${modelName} (${parts[1] || "?"})`,
+            `  GPU: ${gpuName} (${vramMb} MB)`,
+            `  Memory [${bar(mem)}] ${mem}%`,
+            `  Hash: ${hash.slice(0, 16)}...`
           ].join("\n");
+        } catch {
+          return "Could not generate proof. Ensure Ollama is running.";
         }
-        await this.ensureDir();
-        const proofPath = join28(this.nexusDir, "inference-proof.json");
-        await writeFile12(proofPath, JSON.stringify(proof, null, 2));
-        const memScore = proof.vramMb > 24e3 ? 95 : proof.vramMb > 16e3 ? 80 : proof.vramMb > 8e3 ? 60 : proof.vramMb > 0 ? 40 : 20;
-        const speedScore = proof.tokensPerSecond > 50 ? 95 : proof.tokensPerSecond > 30 ? 80 : proof.tokensPerSecond > 15 ? 60 : proof.tokensPerSecond > 5 ? 40 : 20;
-        const overall = Math.round((memScore + speedScore) / 2);
-        const bar = (score) => {
-          const filled = Math.round(score / 5);
-          const empty = 20 - filled;
-          return "\u2588".repeat(filled) + "\u2591".repeat(empty);
-        };
-        return [
-          `Inference Capability Proof`,
-          `\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550`,
-          `  Model: ${proof.modelName} (${proof.modelSize})`,
-          `  GPU: ${proof.gpuName} (${proof.vramMb} MB VRAM)`,
-          `  Speed: ${proof.tokensPerSecond} tok/s`,
-          `  Context: ${proof.contextLength} tokens`,
-          ``,
-          `  Memory  [${bar(memScore)}] ${memScore}%`,
-          `  Speed   [${bar(speedScore)}] ${speedScore}%`,
-          `  Overall [${bar(overall)}] ${overall}%`,
-          ``,
-          `  Benchmark hash: ${proof.benchmarkHash.slice(0, 16)}...`,
-          `  Timestamp: ${proof.timestamp}`,
-          `  Proof saved: ${proofPath}`,
-          ``,
-          `  Anti-spoofing: SHA-256 hash of model+timing+nonce`,
-          `  Verification: peers can request live re-benchmark`
-        ].join("\n");
-      }
-      async doStoreContent(args) {
-        if (!clientInstance)
-          throw new Error("Not connected. Use 'connect' first.");
-        const content = args.content;
-        if (!content)
-          throw new Error("content is required");
-        if (containsKeyMaterial(content)) {
-          return "BLOCKED: Content contains potential key material. Cannot store secrets on IPFS.";
-        }
-        const cid = await clientInstance.store(content);
-        return `Content stored on IPFS.
-  CID: ${cid}
-  Retrieve with: retrieve_content + cid="${cid}"`;
-      }
-      async doRetrieveContent(args) {
-        if (!clientInstance)
-          throw new Error("Not connected. Use 'connect' first.");
-        const cid = args.cid;
-        if (!cid)
-          throw new Error("cid is required");
-        const data = await clientInstance.retrieve(cid);
-        if (typeof data === "string")
-          return data;
-        if (typeof data === "object")
-          return JSON.stringify(data, null, 2);
-        return String(data);
       }
     };
   }
@@ -13208,7 +13084,7 @@ var init_code_retriever = __esm({
 // packages/retrieval/dist/lexicalSearch.js
 import { execFile as execFile5 } from "node:child_process";
 import { promisify as promisify4 } from "node:util";
-import { readFile as readFile14, readdir as readdir3, stat as stat3 } from "node:fs/promises";
+import { readFile as readFile14, readdir as readdir4, stat as stat3 } from "node:fs/promises";
 import { join as join29, extname as extname7 } from "node:path";
 async function searchByPath(pathPattern, options) {
   const allFiles = await collectFiles(options.rootDir, options.includeGlobs ?? DEFAULT_INCLUDE_GLOBS, options.excludeGlobs ?? DEFAULT_EXCLUDE_GLOBS);
@@ -13342,7 +13218,7 @@ async function collectFiles(rootDir, includeGlobs, excludeGlobs) {
 async function walkForFiles(rootDir, dir, excludeGlobs, results) {
   let entries;
   try {
-    entries = await readdir3(dir, { withFileTypes: true, encoding: "utf-8" });
+    entries = await readdir4(dir, { withFileTypes: true, encoding: "utf-8" });
   } catch {
     return;
   }
@@ -17763,7 +17639,7 @@ __export(listen_exports, {
   isVideoPath: () => isVideoPath,
   waitForTranscribeCli: () => waitForTranscribeCli
 });
-import { spawn as spawn10, execSync as execSync21 } from "node:child_process";
+import { spawn as spawn11, execSync as execSync21 } from "node:child_process";
 import { existsSync as existsSync22, mkdirSync as mkdirSync6, writeFileSync as writeFileSync6, readdirSync as readdirSync6 } from "node:fs";
 import { join as join31, dirname as dirname10 } from "node:path";
 import { homedir as homedir8 } from "node:os";
@@ -17973,7 +17849,7 @@ var init_listen = __esm({
           const timeout = setTimeout(() => {
             reject(new Error("Whisper fallback: model load timeout (5 min). First run downloads the model."));
           }, 3e5);
-          this.process = spawn10("python3", [
+          this.process = spawn11("python3", [
             this.scriptPath,
             "--model",
             this.model,
@@ -18255,7 +18131,7 @@ transcribe-cli error: ${transcribeCliError}` : "";
             return `Failed to start live transcription: ${msg}${tcHint}`;
           }
         }
-        this.micProcess = spawn10(micCmd.cmd, micCmd.args, {
+        this.micProcess = spawn11(micCmd.cmd, micCmd.args, {
           stdio: ["pipe", "pipe", "pipe"],
           env: { ...process.env }
         });
@@ -20674,7 +20550,7 @@ var require_websocket = __commonJS({
     var http = __require("http");
     var net = __require("net");
     var tls = __require("tls");
-    var { randomBytes: randomBytes10, createHash: createHash4 } = __require("crypto");
+    var { randomBytes: randomBytes10, createHash: createHash5 } = __require("crypto");
     var { Duplex, Readable } = __require("stream");
     var { URL: URL3 } = __require("url");
     var PerMessageDeflate = require_permessage_deflate();
@@ -21334,7 +21210,7 @@ var require_websocket = __commonJS({
           abortHandshake(websocket, socket, "Invalid Upgrade header");
           return;
         }
-        const digest = createHash4("sha1").update(key + GUID).digest("base64");
+        const digest = createHash5("sha1").update(key + GUID).digest("base64");
         if (res.headers["sec-websocket-accept"] !== digest) {
           abortHandshake(websocket, socket, "Invalid Sec-WebSocket-Accept header");
           return;
@@ -21701,7 +21577,7 @@ var require_websocket_server = __commonJS({
     var EventEmitter7 = __require("events");
     var http = __require("http");
     var { Duplex } = __require("stream");
-    var { createHash: createHash4 } = __require("crypto");
+    var { createHash: createHash5 } = __require("crypto");
     var extension = require_extension();
     var PerMessageDeflate = require_permessage_deflate();
     var subprotocol = require_subprotocol();
@@ -22002,7 +21878,7 @@ var require_websocket_server = __commonJS({
           );
         }
         if (this._state > RUNNING) return abortHandshake(socket, 503);
-        const digest = createHash4("sha1").update(key + GUID).digest("base64");
+        const digest = createHash5("sha1").update(key + GUID).digest("base64");
         const headers = [
           "HTTP/1.1 101 Switching Protocols",
           "Upgrade: websocket",
@@ -22991,7 +22867,7 @@ var init_render = __esm({
 
 // packages/cli/dist/tui/voice-session.js
 import { createServer } from "node:http";
-import { spawn as spawn11, execSync as execSync22 } from "node:child_process";
+import { spawn as spawn12, execSync as execSync22 } from "node:child_process";
 import { EventEmitter as EventEmitter2 } from "node:events";
 function generateFrontendHTML() {
   return `<!DOCTYPE html>
@@ -23645,7 +23521,7 @@ var init_voice_session = __esm({
           const timeout = setTimeout(() => {
             reject(new Error("Cloudflared tunnel start timeout (30s)"));
           }, 3e4);
-          this.cloudflaredProcess = spawn11("cloudflared", [
+          this.cloudflaredProcess = spawn12("cloudflared", [
             "tunnel",
             "--url",
             `http://127.0.0.1:${port}`
@@ -23719,7 +23595,7 @@ var init_voice_session = __esm({
 
 // packages/cli/dist/tui/expose.js
 import { createServer as createServer2, request as httpRequest } from "node:http";
-import { spawn as spawn12 } from "node:child_process";
+import { spawn as spawn13 } from "node:child_process";
 import { EventEmitter as EventEmitter3 } from "node:events";
 import { randomBytes as randomBytes7 } from "node:crypto";
 import { URL as URL2 } from "node:url";
@@ -23895,7 +23771,7 @@ var init_expose = __esm({
           const timeout = setTimeout(() => {
             reject(new Error("Cloudflared tunnel start timeout (30s)"));
           }, 3e4);
-          this.cloudflaredProcess = spawn12("cloudflared", [
+          this.cloudflaredProcess = spawn13("cloudflared", [
             "tunnel",
             "--url",
             `http://127.0.0.1:${port}`
@@ -23997,10 +23873,10 @@ var init_types = __esm({
 });
 
 // packages/cli/dist/tui/p2p/secret-vault.js
-import { createCipheriv as createCipheriv2, createDecipheriv as createDecipheriv2, randomBytes as randomBytes8, scryptSync as scryptSync2, createHash } from "node:crypto";
+import { createCipheriv as createCipheriv2, createDecipheriv as createDecipheriv2, randomBytes as randomBytes8, scryptSync as scryptSync2, createHash as createHash2 } from "node:crypto";
 import { readFileSync as readFileSync15, writeFileSync as writeFileSync7, existsSync as existsSync23, mkdirSync as mkdirSync7 } from "node:fs";
 import { join as join32, dirname as dirname11 } from "node:path";
-var PLACEHOLDER_PREFIX, PLACEHOLDER_SUFFIX, CIPHER_ALGO, SALT_LEN, IV_LEN, KEY_LEN2, SecretVault;
+var PLACEHOLDER_PREFIX, PLACEHOLDER_SUFFIX, CIPHER_ALGO, SALT_LEN, IV_LEN, KEY_LEN, SecretVault;
 var init_secret_vault = __esm({
   "packages/cli/dist/tui/p2p/secret-vault.js"() {
     "use strict";
@@ -24010,7 +23886,7 @@ var init_secret_vault = __esm({
     CIPHER_ALGO = "aes-256-gcm";
     SALT_LEN = 16;
     IV_LEN = 12;
-    KEY_LEN2 = 32;
+    KEY_LEN = 32;
     SecretVault = class {
       storePath;
       secrets = /* @__PURE__ */ new Map();
@@ -24204,7 +24080,7 @@ var init_secret_vault = __esm({
           createdAt: s.createdAt
         })));
         const salt = randomBytes8(SALT_LEN);
-        const key = scryptSync2(passphrase, salt, KEY_LEN2);
+        const key = scryptSync2(passphrase, salt, KEY_LEN);
         const iv = randomBytes8(IV_LEN);
         const cipher = createCipheriv2(CIPHER_ALGO, key, iv);
         const encrypted = Buffer.concat([cipher.update(data, "utf8"), cipher.final()]);
@@ -24230,7 +24106,7 @@ var init_secret_vault = __esm({
         const iv = blob.subarray(SALT_LEN, SALT_LEN + IV_LEN);
         const tag = blob.subarray(SALT_LEN + IV_LEN, SALT_LEN + IV_LEN + 16);
         const encrypted = blob.subarray(SALT_LEN + IV_LEN + 16);
-        const key = scryptSync2(passphrase, salt, KEY_LEN2);
+        const key = scryptSync2(passphrase, salt, KEY_LEN);
         const decipher = createDecipheriv2(CIPHER_ALGO, key, iv);
         decipher.setAuthTag(tag);
         let data;
@@ -24248,7 +24124,7 @@ var init_secret_vault = __esm({
       /** Generate a deterministic fingerprint of vault contents (for sync verification) */
       fingerprint() {
         const names = Array.from(this.secrets.keys()).sort();
-        const hash = createHash("sha256");
+        const hash = createHash2("sha256");
         for (const name of names) {
           hash.update(name + ":");
           hash.update(this.secrets.get(name).value);
@@ -24263,7 +24139,7 @@ var init_secret_vault = __esm({
 // packages/cli/dist/tui/p2p/peer-mesh.js
 import { EventEmitter as EventEmitter4 } from "node:events";
 import { createServer as createServer3 } from "node:http";
-import { randomBytes as randomBytes9, createHash as createHash2, generateKeyPairSync } from "node:crypto";
+import { randomBytes as randomBytes9, createHash as createHash3, generateKeyPairSync } from "node:crypto";
 var PING_INTERVAL_MS, PEER_TIMEOUT_MS, GOSSIP_INTERVAL_MS, MAX_PEERS, PeerMesh;
 var init_peer_mesh = __esm({
   "packages/cli/dist/tui/p2p/peer-mesh.js"() {
@@ -24312,7 +24188,7 @@ var init_peer_mesh = __esm({
         const { publicKey, privateKey } = generateKeyPairSync("ed25519");
         this.publicKey = publicKey.export({ type: "spki", format: "der" });
         this.privateKey = privateKey.export({ type: "pkcs8", format: "der" });
-        this.peerId = createHash2("sha256").update(this.publicKey).digest("base64url").slice(0, 22);
+        this.peerId = createHash3("sha256").update(this.publicKey).digest("base64url").slice(0, 22);
         this.capabilities = options.capabilities;
         this.displayName = options.displayName;
         this._authKey = options.authKey ?? randomBytes9(24).toString("base64url");
@@ -26030,7 +25906,7 @@ var init_oa_directory = __esm({
 
 // packages/cli/dist/tui/setup.js
 import * as readline from "node:readline";
-import { execSync as execSync23, spawn as spawn13 } from "node:child_process";
+import { execSync as execSync23, spawn as spawn14 } from "node:child_process";
 import { existsSync as existsSync25, writeFileSync as writeFileSync9, mkdirSync as mkdirSync9 } from "node:fs";
 import { join as join35 } from "node:path";
 import { homedir as homedir10, platform } from "node:os";
@@ -26373,7 +26249,7 @@ async function ensureOllamaRunning(backendUrl, rl) {
   process.stdout.write(`  ${c2.cyan("\u25CF")} Starting ollama serve...
 `);
   try {
-    const child = spawn13("ollama", ["serve"], { stdio: "ignore", detached: true });
+    const child = spawn14("ollama", ["serve"], { stdio: "ignore", detached: true });
     child.unref();
   } catch {
     process.stdout.write(`  ${c2.yellow("\u26A0")} Could not start ollama serve.
@@ -26841,7 +26717,7 @@ async function doSetup(config, rl) {
   ${c2.cyan("\u25CF")} Ollama is installed but not running. Starting automatically...
 `);
         try {
-          const child = spawn13("ollama", ["serve"], { stdio: "ignore", detached: true });
+          const child = spawn14("ollama", ["serve"], { stdio: "ignore", detached: true });
           child.unref();
           await new Promise((resolve31) => setTimeout(resolve31, 3e3));
           try {
@@ -26869,7 +26745,7 @@ async function doSetup(config, rl) {
   ${c2.cyan("\u25CF")} Starting ollama serve...
 `);
             try {
-              const child = spawn13("ollama", ["serve"], { stdio: "ignore", detached: true });
+              const child = spawn14("ollama", ["serve"], { stdio: "ignore", detached: true });
               child.unref();
               await new Promise((resolve31) => setTimeout(resolve31, 3e3));
               try {
@@ -40303,13 +40179,13 @@ NEW TASK: ${fullInput}`;
       writeContent(() => renderError(errMsg));
       if (failureStore) {
         try {
-          const { createHash: createHash4 } = await import("node:crypto");
+          const { createHash: createHash5 } = await import("node:crypto");
           failureStore.insert({
             taskId: "",
             sessionId: `${Date.now()}`,
             repoRoot,
             failureType: "runtime-error",
-            fingerprint: createHash4("sha256").update(errMsg.slice(0, 200)).digest("hex").slice(0, 16),
+            fingerprint: createHash5("sha256").update(errMsg.slice(0, 200)).digest("hex").slice(0, 16),
             filePath: null,
             errorMessage: errMsg.slice(0, 500),
             context: null,
@@ -40587,7 +40463,7 @@ var init_run = __esm({
 import { glob } from "glob";
 import ignore from "ignore";
 import { readFile as readFile16, stat as stat4 } from "node:fs/promises";
-import { createHash as createHash3 } from "node:crypto";
+import { createHash as createHash4 } from "node:crypto";
 import { join as join45, relative as relative3, extname as extname10, basename as basename15 } from "node:path";
 var DEFAULT_EXCLUDE, LANGUAGE_MAP, CodebaseIndexer;
 var init_codebase_indexer = __esm({
@@ -40653,7 +40529,7 @@ var init_codebase_indexer = __esm({
             if (fileStat.size > this.config.maxFileSize)
               continue;
             const content = await readFile16(fullPath);
-            const hash = createHash3("sha256").update(content).digest("hex");
+            const hash = createHash4("sha256").update(content).digest("hex");
             const ext = extname10(relativePath);
             indexed.push({
               path: fullPath,
@@ -41193,7 +41069,7 @@ var serve_exports = {};
 __export(serve_exports, {
   serveCommand: () => serveCommand
 });
-import { spawn as spawn14 } from "node:child_process";
+import { spawn as spawn15 } from "node:child_process";
 async function serveCommand(opts, config) {
   const backendType = config.backendType;
   if (backendType === "ollama") {
@@ -41286,7 +41162,7 @@ async function serveVllm(opts, config) {
 }
 async function runVllmServer(args, verbose) {
   return new Promise((resolve31, reject) => {
-    const child = spawn14("python", args, {
+    const child = spawn15("python", args, {
       stdio: verbose ? "inherit" : ["ignore", "pipe", "pipe"],
       env: { ...process.env }
     });