@agenticmail/enterprise 0.5.389 → 0.5.391

package/dist/{agent-heartbeat-VKF257FY.js → agent-heartbeat-YS4UEQES.js}

@@ -466,7 +466,7 @@ var AgentHeartbeatManager = class {
       return;
     }
     try {
-      const { guardrails } = await import("./routes-K2GAVUXI.js");
+      const { guardrails } = await import("./routes-3UJKWSYJ.js");
       const status = await guardrails.getStatus(ctx.agentId);
       if (status.paused || status.offDuty) {
         console.log(`[heartbeat] Skipping action dispatch \u2014 agent is ${status.offDuty ? "off duty" : "paused"}`);

package/dist/{chunk-CCYSUKRG.js → chunk-5TFB3EIE.js}

@@ -356,7 +356,7 @@ function createRuntimeHooks(deps) {
       var injectedMessages = [...messages];
       if (deps.knowledgeBaseEnabled !== false) {
         try {
-          var { knowledgeBase } = await import("./routes-K2GAVUXI.js");
+          var { knowledgeBase } = await import("./routes-3UJKWSYJ.js");
           var kbs = await knowledgeBase.listForAgent(agentId);
           if (kbs.length > 0) {
             var contextParts = [];
@@ -389,7 +389,7 @@ ${contextParts.join("\n\n")}`;
       }
       if (deps.memoryEnabled !== false) {
         try {
-          var { memoryManager } = await import("./routes-K2GAVUXI.js");
+          var { memoryManager } = await import("./routes-3UJKWSYJ.js");
           var memories = await memoryManager.queryMemories({
             agentId,
             limit: 10,
@@ -410,7 +410,7 @@ ${memories.map(function(m) {
       }
       if (deps.policyEnabled !== false) {
         try {
-          var { policyEngine } = await import("./routes-K2GAVUXI.js");
+          var { policyEngine } = await import("./routes-3UJKWSYJ.js");
           var policies = await policyEngine.getAgentPolicies(agentId, deps.orgId);
           if (policies.length > 0) {
             var policyText = policies.map(function(p) {
@@ -435,7 +435,7 @@ ${policyText}`;
     // ─── Budget Check ──────────────────────────────
     async checkBudget(agentId, _orgId, _estimatedTokens) {
       try {
-        var { lifecycle } = await import("./routes-K2GAVUXI.js");
+        var { lifecycle } = await import("./routes-3UJKWSYJ.js");
         var now = Date.now();
         var cacheKey = `budget_sync_${agentId}`;
         var lastSync = globalThis[cacheKey] || 0;
@@ -528,7 +528,7 @@ ${policyText}`;
     // ─── Record LLM Usage ──────────────────────────
     async recordLLMUsage(agentId, orgId, usage) {
       try {
-        var { lifecycle } = await import("./routes-K2GAVUXI.js");
+        var { lifecycle } = await import("./routes-3UJKWSYJ.js");
         console.log(`[hooks] recordLLMUsage: agent=${agentId}, input=${usage.inputTokens}, output=${usage.outputTokens}`);
         await lifecycle.recordLLMUsage(agentId, {
           inputTokens: usage.inputTokens,
@@ -539,7 +539,7 @@ ${policyText}`;
         console.log(`[hooks] recordLLMUsage error: ${recordErr.message}`);
       }
       try {
-        var { activity } = await import("./routes-K2GAVUXI.js");
+        var { activity } = await import("./routes-3UJKWSYJ.js");
         await activity.record({
           agentId,
           orgId,
@@ -587,7 +587,7 @@ ${policyText}`;
         var cacheKey = `${ctx.agentId}:${ctx.toolName}`;
         var cached = getCachedPermission(cacheKey);
         if (cached) return cached;
-        var { permissionEngine } = await import("./routes-K2GAVUXI.js");
+        var { permissionEngine } = await import("./routes-3UJKWSYJ.js");
         var permResult = await permissionEngine.checkPermission(ctx.agentId, ctx.toolName);
         var result = {
           allowed: permResult.allowed,
@@ -596,7 +596,7 @@ ${policyText}`;
         };
         if (result.allowed && deps.guardrailsEnabled !== false) {
           try {
-            var { guardrails } = await import("./routes-K2GAVUXI.js");
+            var { guardrails } = await import("./routes-3UJKWSYJ.js");
             var status = await guardrails.getStatus(ctx.agentId);
             if (status.paused || status.offDuty) {
               result.allowed = false;
@@ -608,7 +608,7 @@ ${policyText}`;
         }
         if (result.allowed && deps.dlpEnabled !== false && ctx.parameters) {
           try {
-            var { dlp } = await import("./routes-K2GAVUXI.js");
+            var { dlp } = await import("./routes-3UJKWSYJ.js");
             var dlpResult = await dlp.scanParameters({
               orgId: ctx.orgId,
               agentId: ctx.agentId,
@@ -628,7 +628,7 @@ ${policyText}`;
         }
         if (result.requiresApproval && result.allowed) {
           try {
-            var { approvals } = await import("./routes-K2GAVUXI.js");
+            var { approvals } = await import("./routes-3UJKWSYJ.js");
             var approval = await approvals.createAndWait({
               agentId: ctx.agentId,
               orgId: ctx.orgId,
@@ -658,7 +658,7 @@ ${policyText}`;
     // ─── After Tool Call ────────────────────────────
     async afterToolCall(ctx, result) {
       try {
-        var { activity } = await import("./routes-K2GAVUXI.js");
+        var { activity } = await import("./routes-3UJKWSYJ.js");
         await activity.record({
           agentId: ctx.agentId,
           orgId: ctx.orgId,
@@ -675,7 +675,7 @@ ${policyText}`;
       } catch {
       }
       try {
-        var { lifecycle } = await import("./routes-K2GAVUXI.js");
+        var { lifecycle } = await import("./routes-3UJKWSYJ.js");
         await lifecycle.recordToolCall(ctx.agentId, {
           toolId: ctx.toolName,
           tokensUsed: 0,
@@ -687,7 +687,7 @@ ${policyText}`;
       }
       if (result.success && EXTERNAL_TOOLS.has(ctx.toolName)) {
         try {
-          var { journal } = await import("./routes-K2GAVUXI.js");
+          var { journal } = await import("./routes-3UJKWSYJ.js");
           await journal.record({
             orgId: ctx.orgId,
             agentId: ctx.agentId,
@@ -702,7 +702,7 @@ ${policyText}`;
       }
       if (result.success && COMMUNICATION_TOOLS.has(ctx.toolName)) {
         try {
-          var { commBus } = await import("./routes-K2GAVUXI.js");
+          var { commBus } = await import("./routes-3UJKWSYJ.js");
           await commBus.observeMessage({
             orgId: ctx.orgId,
             agentId: ctx.agentId,
@@ -716,7 +716,7 @@ ${policyText}`;
     // ─── Session Lifecycle ──────────────────────────
     async onSessionStart(sessionId, agentId, orgId) {
       try {
-        var { activity } = await import("./routes-K2GAVUXI.js");
+        var { activity } = await import("./routes-3UJKWSYJ.js");
         await activity.record({
           agentId,
           orgId,
@@ -729,7 +729,7 @@ ${policyText}`;
     },
     async onSessionEnd(sessionId, agentId, orgId) {
       try {
-        var { activity } = await import("./routes-K2GAVUXI.js");
+        var { activity } = await import("./routes-3UJKWSYJ.js");
         await activity.record({
           agentId,
           orgId,
@@ -743,7 +743,7 @@ ${policyText}`;
     // ─── Context Compaction ─────────────────────────
     async onContextCompaction(sessionId, agentId, summary) {
       try {
-        var { memoryManager } = await import("./routes-K2GAVUXI.js");
+        var { memoryManager } = await import("./routes-3UJKWSYJ.js");
         await memoryManager.createMemory({
           agentId,
           orgId: deps.orgId,
@@ -2518,7 +2518,7 @@ async function runAgentLoop(config, initialMessages, hooks, options) {
           console.log(`[agent-loop] \u2705 Tool ${toolCall.name} succeeded (${content.length} chars): ${content.slice(0, 300)}`);
         }
         try {
-          const { activity } = await import("./routes-K2GAVUXI.js");
+          const { activity } = await import("./routes-3UJKWSYJ.js");
           activity.recordToolCallCompact({
             agentId: config.agentId,
             orgId: config.orgId,

package/dist/{chunk-ACP7QSXU.js → chunk-I5MQXMPP.js}

@@ -12,7 +12,7 @@ import {
   DeploymentEngine,
   init_agent_config,
   init_deployer
-} from "./chunk-FT5MAYTU.js";
+} from "./chunk-E6B4W3WG.js";
 import {
   init_messaging_history,
   storeMessage
@@ -6847,7 +6847,7 @@ function createAgentRoutes(opts) {
   });
   router.post("/system/install-pm2", async (c) => {
     try {
-      const { ensurePm2 } = await import("./deployer-HN7HPTZU.js");
+      const { ensurePm2 } = await import("./deployer-MCISTNBP.js");
       const result = await ensurePm2();
       if (result.installed) {
         return c.json({ success: true, message: `PM2 ${result.version} installed successfully` });
@@ -7103,7 +7103,7 @@ function createAgentRoutes(opts) {
       }
       const managedAgent = await lifecycle2.createAgent(orgId, config, actor);
       try {
-        const { knowledgeBase: kbEngine } = await import("./routes-K2GAVUXI.js");
+        const { knowledgeBase: kbEngine } = await import("./routes-3UJKWSYJ.js");
         const allKbs = kbEngine.getAllKnowledgeBases();
         const clientOrgId = managedAgent?.clientOrgId || config?.clientOrgId || null;
         let kbAssigned = 0;

package/dist/{chunk-FP4QC3T5.js → chunk-MPDSMMSJ.js}

@@ -449,7 +449,7 @@ async function runCloudSetup(inquirer, chalk, existingSubdomain) {
             try {
               const archStr = arch() === "arm64" ? "arm64" : "amd64";
               const dlUrl = `https://github.com/cloudflare/cloudflared/releases/latest/download/cloudflared-windows-${archStr}.exe`;
-              execSync(`powershell -Command "New-Item -ItemType Directory -Force -Path '${cfDir}' | Out-Null; Invoke-WebRequest -Uri '${dlUrl}' -OutFile '${cfExe}'"`, { stdio: "inherit", timeout: 12e4 });
+              execSync(`powershell -Command "New-Item -ItemType Directory -Force -Path '${cfDir.replace(/'/g, "''")}' | Out-Null; Invoke-WebRequest -Uri '${dlUrl}' -OutFile '${cfExe.replace(/'/g, "''")}'"`, { stdio: "inherit", timeout: 12e4 });
               found = true;
             } catch (dlErr) {
               console.log(chalk.dim(`  Download failed: ${dlErr.message?.substring(0, 100)}`));
@@ -1234,7 +1234,7 @@ async function deploy(config, db, jwtSecret, vaultKey, spinner, chalk) {
   const { deployTarget, company, database, domain, tunnel, cloud } = config;
   if (deployTarget === "cloudflare-tunnel" && tunnel) {
     spinner.start(`Starting local server on port ${tunnel.port}...`);
-    const { createServer: createServer2 } = await import("./server-WX52FFA4.js");
+    const { createServer: createServer2 } = await import("./server-VGZXHRIM.js");
     const server2 = createServer2({ port: tunnel.port, db, jwtSecret });
     const handle2 = await server2.start();
     spinner.succeed("Server running");
@@ -1264,11 +1264,11 @@ async function deploy(config, db, jwtSecret, vaultKey, spinner, chalk) {
             execSync2("winget install --id Cloudflare.cloudflared --accept-source-agreements --accept-package-agreements", { stdio: "pipe", timeout: 12e4 });
           } catch {
             const archStr = process.arch === "arm64" ? "arm64" : "amd64";
-            const localAppData = process.env.LOCALAPPDATA || `${process.env.USERPROFILE}\\AppData\\Local`;
-            const cfDir = `${localAppData}\\cloudflared`;
-            const cfExe = `${cfDir}\\cloudflared.exe`;
+            const localAppData = process.env.LOCALAPPDATA || join2(process.env.USERPROFILE || homedir2(), "AppData", "Local");
+            const cfDir = join2(localAppData, "cloudflared");
+            const cfExe = join2(cfDir, "cloudflared.exe");
             const dlUrl = `https://github.com/cloudflare/cloudflared/releases/latest/download/cloudflared-windows-${archStr}.exe`;
-            execSync2(`powershell -Command "New-Item -ItemType Directory -Force -Path '${cfDir}' | Out-Null; Invoke-WebRequest -Uri '${dlUrl}' -OutFile '${cfExe}'"`, { stdio: "pipe", timeout: 12e4 });
+            execSync2(`powershell -Command "New-Item -ItemType Directory -Force -Path '${cfDir.replace(/'/g, "''")}' | Out-Null; Invoke-WebRequest -Uri '${dlUrl}' -OutFile '${cfExe.replace(/'/g, "''")}'"`, { stdio: "pipe", timeout: 12e4 });
             process.env.PATH = `${cfDir};${process.env.PATH}`;
           }
         } else if (process.platform === "darwin") {
@@ -1350,7 +1350,8 @@ async function deploy(config, db, jwtSecret, vaultKey, spinner, chalk) {
         `});`,
         `process.exit(r.status || 0);`
       ].join("\n"));
-      execSync2(`pm2 start "${cfScript}" --name cloudflared -- tunnel --no-autoupdate run --token ${cloud.tunnelToken}`, { stdio: "pipe", timeout: 15e3 });
+      const safeToken = String(cloud.tunnelToken || "").replace(/[^a-zA-Z0-9_.-]/g, "");
+      execSync2(`pm2 start "${cfScript}" --name cloudflared -- tunnel --no-autoupdate run --token ${safeToken}`, { stdio: "pipe", timeout: 15e3 });
       const envLines = [
         `PORT=${cloud.port || 8080}`,
         `DATABASE_URL=${database.connectionString || ""}`,
@@ -1535,7 +1536,7 @@ async function deploy(config, db, jwtSecret, vaultKey, spinner, chalk) {
     return {};
   }
   spinner.start("Starting local server...");
-  const { createServer } = await import("./server-WX52FFA4.js");
+  const { createServer } = await import("./server-VGZXHRIM.js");
   const server = createServer({ port: 3e3, db, jwtSecret });
   const handle = await server.start();
   spinner.succeed("Server running");

package/dist/{chunk-QIDDLWRL.js → chunk-N3CFP4AQ.js}

@@ -11,7 +11,7 @@ import {
   init_config_bus,
   init_routes,
   routes_exports
-} from "./chunk-ACP7QSXU.js";
+} from "./chunk-I5MQXMPP.js";
 import {
   SecureVault,
   init_vault
@@ -3269,7 +3269,7 @@ function createAdminRoutes(db) {
   });
   api.get("/system/update-check", async (c) => {
     try {
-      const { checkForUpdate, getCachedUpdateCheck } = await import("./cli-update-UM7XCICB.js");
+      const { checkForUpdate, getCachedUpdateCheck } = await import("./cli-update-P3TAXEW7.js");
       const cached = getCachedUpdateCheck();
       if (cached && Date.now() - new Date(cached.checkedAt).getTime() < 5 * 6e4) {
         return c.json(cached);
@@ -3282,7 +3282,7 @@ function createAdminRoutes(db) {
   });
   api.post("/system/update", async (c) => {
     try {
-      const { performUpdate } = await import("./cli-update-UM7XCICB.js");
+      const { performUpdate } = await import("./cli-update-P3TAXEW7.js");
       const result = await performUpdate({ restart: true });
       return c.json(result);
     } catch (e) {
@@ -4683,7 +4683,7 @@ function createServer(config) {
   let engineInitialized = false;
   api.all("/engine/*", async (c, _next) => {
     try {
-      const { engineRoutes, setEngineDb } = await import("./routes-K2GAVUXI.js");
+      const { engineRoutes, setEngineDb } = await import("./routes-3UJKWSYJ.js");
       const { EngineDatabase } = await import("./db-adapter-2T56ORSD.js");
       if (!engineInitialized) {
         engineInitialized = true;
@@ -4713,13 +4713,13 @@ function createServer(config) {
         engineInitialized = true;
         if (config.runtime?.enabled) {
           try {
-            const { createAgentRuntime } = await import("./runtime-5OKJ5DT6.js");
-            const { mountRuntimeApp, setRuntime } = await import("./routes-K2GAVUXI.js");
+            const { createAgentRuntime } = await import("./runtime-G6SEDQA6.js");
+            const { mountRuntimeApp, setRuntime } = await import("./routes-3UJKWSYJ.js");
             let getEmailConfig;
             let onTokenRefresh;
             let agentMemoryMgr;
             try {
-              const { lifecycle: lc, memoryManager: mm } = await import("./routes-K2GAVUXI.js");
+              const { lifecycle: lc, memoryManager: mm } = await import("./routes-3UJKWSYJ.js");
               agentMemoryMgr = mm;
               if (lc) {
                 getEmailConfig = (agentId) => {
@@ -4758,7 +4758,7 @@ function createServer(config) {
               }
             } catch {
             }
-            const { vault: vaultRef, permissionEngine: permRef, databaseManager: dbMgr } = await import("./routes-K2GAVUXI.js");
+            const { vault: vaultRef, permissionEngine: permRef, databaseManager: dbMgr } = await import("./routes-3UJKWSYJ.js");
             const runtime = createAgentRuntime({
               engineDb,
               adminDb: config.db,
@@ -4965,7 +4965,7 @@ function createServer(config) {
             });
             (async () => {
               try {
-                const { engineRoutes, setEngineDb } = await import("./routes-K2GAVUXI.js");
+                const { engineRoutes, setEngineDb } = await import("./routes-3UJKWSYJ.js");
                 const { EngineDatabase } = await import("./db-adapter-2T56ORSD.js");
                 if (!engineInitialized) {
                   engineInitialized = true;
@@ -4989,13 +4989,13 @@ function createServer(config) {
                     await setEngineDb(engineDb, config.db);
                     if (config.runtime?.enabled) {
                       try {
-                        const { createAgentRuntime } = await import("./runtime-5OKJ5DT6.js");
-                        const { mountRuntimeApp, setRuntime } = await import("./routes-K2GAVUXI.js");
+                        const { createAgentRuntime } = await import("./runtime-G6SEDQA6.js");
+                        const { mountRuntimeApp, setRuntime } = await import("./routes-3UJKWSYJ.js");
                         let getEmailConfig;
                         let onTokenRefresh;
                         let agentMemoryMgr;
                         try {
-                          const { lifecycle: lc, memoryManager: mm } = await import("./routes-K2GAVUXI.js");
+                          const { lifecycle: lc, memoryManager: mm } = await import("./routes-3UJKWSYJ.js");
                           agentMemoryMgr = mm;
                           if (lc) {
                             getEmailConfig = (agentId) => {
@@ -5034,7 +5034,7 @@ function createServer(config) {
                           }
                         } catch {
                         }
-                        const { vault: vaultRef2, permissionEngine: permRef2, databaseManager: dbMgr2 } = await import("./routes-K2GAVUXI.js");
+                        const { vault: vaultRef2, permissionEngine: permRef2, databaseManager: dbMgr2 } = await import("./routes-3UJKWSYJ.js");
                         const runtime = createAgentRuntime({
                           engineDb,
                           adminDb: config.db,
@@ -5046,7 +5046,7 @@ function createServer(config) {
                           agentMemoryManager: agentMemoryMgr,
                           vault: vaultRef2,
                           permissionEngine: permRef2,
-                          hierarchyManager: (await import("./routes-K2GAVUXI.js")).hierarchyManager ?? void 0,
+                          hierarchyManager: (await import("./routes-3UJKWSYJ.js")).hierarchyManager ?? void 0,
                           databaseManager: dbMgr2
                         });
                         await runtime.start();
@@ -5060,7 +5060,7 @@ function createServer(config) {
                     }
                     console.log("[engine] Eagerly initialized");
                     try {
-                      const { lifecycle: lcRef } = await import("./routes-K2GAVUXI.js");
+                      const { lifecycle: lcRef } = await import("./routes-3UJKWSYJ.js");
                       if (lcRef) {
                         const agents = Array.from(lcRef.agents?.values?.() || []);
                         const hasLocalPm2 = agents.some((a) => {
@@ -5069,7 +5069,7 @@ function createServer(config) {
                           return target === "local" && (!pm || pm === "pm2");
                         });
                         if (hasLocalPm2) {
-                          const { ensurePm2 } = await import("./deployer-HN7HPTZU.js");
+                          const { ensurePm2 } = await import("./deployer-MCISTNBP.js");
                           const pm2 = await ensurePm2();
                           if (pm2.installed) {
                             console.log(`[startup] PM2 v${pm2.version} available for local deployments`);

package/dist/{cli-agent-3MGMIL4H.js → cli-agent-FKBRZT3B.js}

@@ -776,7 +776,7 @@ async function runAgent(_args) {
   const agent = agentRow[0];
   console.log(`   Agent: ${agent.display_name || agent.name}`);
   console.log(`   State: ${agent.state}`);
-  const routes = await import("./routes-K2GAVUXI.js");
+  const routes = await import("./routes-3UJKWSYJ.js");
   await routes.lifecycle.setDb(engineDb);
   await routes.lifecycle.loadFromDb();
   routes.lifecycle.standaloneMode = true;
@@ -834,10 +834,10 @@ async function runAgent(_args) {
     }
   } catch {
   }
-  const { createAgentRuntime } = await import("./runtime-5OKJ5DT6.js");
+  const { createAgentRuntime } = await import("./runtime-G6SEDQA6.js");
   let orgIntMgr = null;
   try {
-    const { orgIntegrations: oi } = await import("./routes-K2GAVUXI.js");
+    const { orgIntegrations: oi } = await import("./routes-3UJKWSYJ.js");
     orgIntMgr = oi;
   } catch {
   }
@@ -1236,7 +1236,7 @@ Please complete this task now.`,
       }
       if (scope === "all" || scope === "permissions") {
         try {
-          const { permissionEngine } = await import("./routes-K2GAVUXI.js");
+          const { permissionEngine } = await import("./routes-3UJKWSYJ.js");
           await permissionEngine.setDb(engineDb);
           reloaded.push("permissions");
         } catch {
@@ -1276,7 +1276,7 @@ Please complete this task now.`,
       }
       if (scope === "all" || scope === "guardrails") {
         try {
-          const { guardrails } = await import("./routes-K2GAVUXI.js");
+          const { guardrails } = await import("./routes-3UJKWSYJ.js");
           await guardrails.loadFromDb?.();
           reloaded.push("guardrails");
         } catch {
@@ -2216,7 +2216,7 @@ Available tools: ${providerType === "imap" ? "email_send (to, subject, body)" :
       console.log("[guardrails] Disabled via autonomy settings");
     }
     try {
-      const { AgentHeartbeatManager } = await import("./agent-heartbeat-VKF257FY.js");
+      const { AgentHeartbeatManager } = await import("./agent-heartbeat-YS4UEQES.js");
       const hbOrgRows = await engineDb.query(`SELECT org_id FROM managed_agents WHERE id = $1`, [AGENT_ID]);
       const hbOrgId = hbOrgRows?.[0]?.org_id || "";
       const hbManagerEmail = config.managerEmail || (config.manager?.type === "external" ? config.manager.email : null);

package/dist/{cli-recover-4ENZIKE2.js → cli-recover-HGWHKH6N.js}

@@ -448,7 +448,8 @@ async function runCloudRecover(args, inquirer, chalk, ora) {
           ex("pm2 delete cloudflared 2>/dev/null", { timeout: 5e3 });
         } catch {
         }
-        const safeToken = String(data.tunnelToken).replace(/[^a-zA-Z0-9_-]/g, "");
+        const safeToken = String(data.tunnelToken).replace(/[^a-zA-Z0-9_.\-]/g, "");
+        if (!safeToken || safeToken.length < 10) throw new Error("Invalid tunnel token");
         ex(`pm2 start cloudflared --name cloudflared -- tunnel --no-autoupdate run --token ${safeToken}`, { timeout: 15e3 });
         try {
           ex("pm2 save 2>/dev/null", { timeout: 5e3 });

package/dist/{cli-serve-GA5EXFOE.js → cli-serve-WA6BNLZ3.js}

@@ -94,7 +94,7 @@ async function runServe(_args) {
     process.exit(1);
   }
   const { createAdapter, smartDbConfig } = await import("./factory-XRYYBBCW.js");
-  const { createServer } = await import("./server-WX52FFA4.js");
+  const { createServer } = await import("./server-VGZXHRIM.js");
   const db = await createAdapter(smartDbConfig(DATABASE_URL));
   await db.migrate();
   const server = createServer({
@@ -106,7 +106,7 @@ async function runServe(_args) {
   await server.start();
   console.log(`AgenticMail Enterprise server running on :${PORT}`);
   try {
-    const { startBackgroundUpdateCheck } = await import("./cli-update-UM7XCICB.js");
+    const { startBackgroundUpdateCheck } = await import("./cli-update-P3TAXEW7.js");
     startBackgroundUpdateCheck();
   } catch {
   }

package/dist/{cli-update-UM7XCICB.js → cli-update-P3TAXEW7.js}

@@ -70,7 +70,8 @@ async function checkForUpdate() {
   try {
     const cacheDir = join(homedir(), ".agenticmail");
     const cachePath = join(cacheDir, "update-check.json");
-    writeFileSync(cachePath, JSON.stringify(info, null, 2));
+    const safeInfo = { current: String(info.current), latest: String(info.latest), updateAvailable: Boolean(info.updateAvailable), checkedAt: String(info.checkedAt), releaseNotes: info.releaseNotes ? String(info.releaseNotes).slice(0, 1e4) : void 0, releaseUrl: info.releaseUrl ? String(info.releaseUrl).slice(0, 500) : void 0 };
+    writeFileSync(cachePath, JSON.stringify(safeInfo, null, 2));
   } catch {
   }
   return info;
@@ -105,6 +106,9 @@ async function performUpdate(options) {
 `);
     return { success: false, from: current, to: "unknown", message: "Could not determine latest version" };
   }
+  if (!/^\d+\.\d+\.\d+(-[\w.]+)?$/.test(latest)) {
+    return { success: false, from: current, to: latest, message: `Invalid version format: ${latest}` };
+  }
   console.log(`
   \u{1F4E6} Installing ${PKG_NAME}@${latest}...`);
   try {
@@ -137,9 +141,11 @@ async function performUpdate(options) {
           return aIsServer ? 1 : bIsServer ? -1 : 0;
         });
         for (const proc of sorted) {
-          console.log(`  Restarting: ${proc.name}`);
+          const safeName = String(proc.name).replace(/[^a-zA-Z0-9_-]/g, "");
+          if (!safeName) continue;
+          console.log(`  Restarting: ${safeName}`);
           try {
-            execSync(`pm2 restart ${proc.name}`, { stdio: "inherit", timeout: 15e3 });
+            execSync(`pm2 restart ${safeName}`, { stdio: "inherit", timeout: 15e3 });
           } catch {
           }
         }

package/dist/cli.js

@@ -14,7 +14,7 @@ switch (command) {
     import("./cli-submit-skill-SNGAHVB7.js").then((m) => m.runSubmitSkill(args.slice(1))).catch(fatal);
     break;
   case "recover":
-    import("./cli-recover-4ENZIKE2.js").then((m) => m.runRecover(args.slice(1))).catch(fatal);
+    import("./cli-recover-HGWHKH6N.js").then((m) => m.runRecover(args.slice(1))).catch(fatal);
     break;
   case "verify-domain":
     import("./cli-verify-Q3NO5XBI.js").then((m) => m.runVerifyDomain(args.slice(1))).catch(fatal);
@@ -61,18 +61,18 @@ Skill Development:
     break;
   case "update":
   case "upgrade":
-    import("./cli-update-UM7XCICB.js").then((m) => m.runUpdate(args.slice(1))).catch(fatal);
+    import("./cli-update-P3TAXEW7.js").then((m) => m.runUpdate(args.slice(1))).catch(fatal);
     break;
   case "serve":
   case "start":
-    import("./cli-serve-GA5EXFOE.js").then((m) => m.runServe(args.slice(1))).catch(fatal);
+    import("./cli-serve-WA6BNLZ3.js").then((m) => m.runServe(args.slice(1))).catch(fatal);
     break;
   case "agent":
-    import("./cli-agent-3MGMIL4H.js").then((m) => m.runAgent(args.slice(1))).catch(fatal);
+    import("./cli-agent-FKBRZT3B.js").then((m) => m.runAgent(args.slice(1))).catch(fatal);
     break;
   case "setup":
   default:
-    import("./setup-KK3N57HP.js").then((m) => m.runSetupWizard()).catch(fatal);
+    import("./setup-YVTDNY7K.js").then((m) => m.runSetupWizard()).catch(fatal);
     break;
 }
 function fatal(err) {

package/dist/{deployer-HN7HPTZU.js → deployer-MCISTNBP.js}

@@ -2,7 +2,7 @@ import {
   DeploymentEngine,
   ensurePm2,
   init_deployer
-} from "./chunk-FT5MAYTU.js";
+} from "./chunk-E6B4W3WG.js";
 import "./chunk-KFQGP6VL.js";
 init_deployer();
 export {

package/dist/index.js

@@ -1,7 +1,7 @@
 import {
   provision,
   runSetupWizard
-} from "./chunk-FP4QC3T5.js";
+} from "./chunk-MPDSMMSJ.js";
 import {
   AgenticMailManager,
   GoogleEmailProvider,
@@ -28,7 +28,7 @@ import {
   executeTool,
   runAgentLoop,
   toolsToDefinitions
-} from "./chunk-CCYSUKRG.js";
+} from "./chunk-5TFB3EIE.js";
 import {
   ValidationError,
   auditLogger,
@@ -42,7 +42,7 @@ import {
   requireRole,
   securityHeaders,
   validate
-} from "./chunk-QIDDLWRL.js";
+} from "./chunk-N3CFP4AQ.js";
 import "./chunk-DJBCRQTD.js";
 import {
   PROVIDER_REGISTRY,
@@ -82,7 +82,7 @@ import {
   init_storage_manager,
   init_tenant,
   init_workforce
-} from "./chunk-ACP7QSXU.js";
+} from "./chunk-I5MQXMPP.js";
 import "./chunk-WYDVMFGJ.js";
 import "./chunk-3UAFHUEC.js";
 import {
@@ -100,7 +100,7 @@ import {
   DeploymentEngine,
   init_agent_config,
   init_deployer
-} from "./chunk-FT5MAYTU.js";
+} from "./chunk-E6B4W3WG.js";
 import "./chunk-Z7NVD3OQ.js";
 import {
   AgentMemoryManager,

package/dist/{routes-K2GAVUXI.js → routes-3UJKWSYJ.js}

@@ -35,10 +35,10 @@ import {
   tenants,
   vault,
   workforce
-} from "./chunk-ACP7QSXU.js";
+} from "./chunk-I5MQXMPP.js";
 import "./chunk-WYDVMFGJ.js";
 import "./chunk-3UAFHUEC.js";
-import "./chunk-FT5MAYTU.js";
+import "./chunk-E6B4W3WG.js";
 import "./chunk-Z7NVD3OQ.js";
 import "./chunk-VSBC4SWO.js";
 import "./chunk-AF3WSNVX.js";

package/dist/{runtime-5OKJ5DT6.js → runtime-G6SEDQA6.js}

@@ -14,7 +14,7 @@ import {
   executeTool,
   runAgentLoop,
   toolsToDefinitions
-} from "./chunk-CCYSUKRG.js";
+} from "./chunk-5TFB3EIE.js";
 import {
   PROVIDER_REGISTRY,
   listAllProviders,

package/dist/{server-WX52FFA4.js → server-VGZXHRIM.js}

@@ -1,12 +1,12 @@
 import {
   createServer
-} from "./chunk-QIDDLWRL.js";
+} from "./chunk-N3CFP4AQ.js";
 import "./chunk-DJBCRQTD.js";
 import "./chunk-UF3ZJMJO.js";
-import "./chunk-ACP7QSXU.js";
+import "./chunk-I5MQXMPP.js";
 import "./chunk-WYDVMFGJ.js";
 import "./chunk-3UAFHUEC.js";
-import "./chunk-FT5MAYTU.js";
+import "./chunk-E6B4W3WG.js";
 import "./chunk-Z7NVD3OQ.js";
 import "./chunk-VSBC4SWO.js";
 import "./chunk-AF3WSNVX.js";

package/dist/{setup-KK3N57HP.js → setup-YVTDNY7K.js}

@@ -6,7 +6,7 @@ import {
   promptRegistration,
   provision,
   runSetupWizard
-} from "./chunk-FP4QC3T5.js";
+} from "./chunk-MPDSMMSJ.js";
 import "./chunk-P6W565WH.js";
 import "./chunk-KFQGP6VL.js";
 export {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@agenticmail/enterprise",
-  "version": "0.5.389",
+  "version": "0.5.391",
   "description": "AgenticMail Enterprise — cloud-hosted AI agent identity, email, auth & compliance for organizations",
   "type": "module",
   "bin": {