@askexenow/exe-os 0.9.138 → 0.9.140

package/dist/{chunk-NFMNO3XE.js → chunk-5K3CCPNX.js}

@@ -1,26 +1,19 @@
-import {
-  getToolCapabilityIndex
-} from "./chunk-ISPV5JR2.js";
-import {
-  getCachedLicenseGate
-} from "./chunk-JXYZVTBX.js";
 import {
   getToolUsageStats
-} from "./chunk-GMARURIG.js";
+} from "./chunk-GLGWGMPD.js";
 import {
   AUTO_WAKE_MAX_RETRIES
-} from "./chunk-7TW5HR4E.js";
+} from "./chunk-UE3BYGWY.js";
 import {
-  isToolAllowed,
-  isToolAllowedForPlan
-} from "./chunk-E6ORBQHP.js";
+  getToolCapabilityIndex
+} from "./chunk-3RNNTTBH.js";
 import {
-  listRecentSessionEvents
-} from "./chunk-MSFSQSJO.js";
+  getCachedLicenseGate
+} from "./chunk-7HZFWAIR.js";
 import {
   isRerankerAvailable,
   rerankWithScores
-} from "./chunk-P6CLMRWJ.js";
+} from "./chunk-H24OVCAN.js";
 import {
   getEntityByName,
   getEntityNeighbors,
@@ -29,6 +22,13 @@ import {
   getRelationships,
   searchEntities
 } from "./chunk-6LKDJ5WX.js";
+import {
+  isToolAllowed,
+  isToolAllowedForPlan
+} from "./chunk-E6ORBQHP.js";
+import {
+  listRecentSessionEvents
+} from "./chunk-ABCDEJUD.js";
 import {
   analyzeBlastRadius,
   buildCodeContextIndex,
@@ -37,68 +37,68 @@ import {
   searchCodeContext,
   searchCodeContextSemantic,
   traceCodeSymbol
-} from "./chunk-37LVIZ3P.js";
+} from "./chunk-BZHXUKVC.js";
+import {
+  runDriftProbes
+} from "./chunk-4YNGDNDI.js";
 import {
   exportOrchestration,
   importOrchestration,
   validatePackage
-} from "./chunk-Z36IJ3XX.js";
-import {
-  runDriftProbes
-} from "./chunk-TIJYLKNW.js";
+} from "./chunk-NX4WEVG6.js";
 import {
   loadOrchestrationPhase,
   setOrchestrationPhase
-} from "./chunk-SJWW6GRT.js";
+} from "./chunk-KNEH2MGD.js";
 import {
   createOrRefreshResumeTask,
   init_capacity_monitor
-} from "./chunk-BUHXM7ZL.js";
+} from "./chunk-34O6PRWE.js";
 import {
   registerCompleteReminder
-} from "./chunk-2ISCJ5PQ.js";
+} from "./chunk-RGKPVKUO.js";
 import {
   registerDeactivateBehavior
-} from "./chunk-7V3BJHG6.js";
+} from "./chunk-PS4UUDIG.js";
 import {
   registerSendMessage
-} from "./chunk-F63ZHBZY.js";
+} from "./chunk-6EBG7VWN.js";
 import {
   registerCreateTask
-} from "./chunk-7GOVGBBM.js";
+} from "./chunk-2JAEWE7P.js";
 import {
   registerListTasks
-} from "./chunk-TT3ND3MM.js";
+} from "./chunk-5LJQSXUG.js";
 import {
   registerUpdateTask
-} from "./chunk-JN2RIMLI.js";
+} from "./chunk-CLIW2CES.js";
 import {
   registerCreateReminder
-} from "./chunk-VOA7GHIO.js";
+} from "./chunk-35FFFDS2.js";
 import {
   registerListReminders
-} from "./chunk-LPIY2AUD.js";
+} from "./chunk-O2RVWP3S.js";
 import {
   completeReminder,
   createReminder,
   listReminders
-} from "./chunk-PFGFOALA.js";
+} from "./chunk-3TTJPQAE.js";
 import {
   status
-} from "./chunk-EZTYTAVU.js";
+} from "./chunk-4ITOWLHX.js";
 import {
   TOKENS_PER_IDLE_MINUTE,
   countKillsSince,
   init_session_kill_telemetry,
   sumTokensSavedSince
-} from "./chunk-K7W7UJ6Z.js";
+} from "./chunk-QUG6EMZQ.js";
 import {
   getAgentSpend
-} from "./chunk-BYNEC472.js";
+} from "./chunk-2ZWYALO4.js";
 import {
   createSchedule,
   parseHumanCron
-} from "./chunk-VGOFRIAI.js";
+} from "./chunk-OX6D5AF3.js";
 import {
   exportGraphHTML,
   generateGraphReport
@@ -110,87 +110,91 @@ import {
 import {
   formatReport,
   runAudit
-} from "./chunk-AHQDWRSM.js";
+} from "./chunk-5WIEDLGY.js";
 import {
   runHealthCheck
-} from "./chunk-XEZ64YCS.js";
+} from "./chunk-SPMZRVXK.js";
 import {
   hasFailures,
   runHealth,
   runTest
-} from "./chunk-GERMZD6I.js";
+} from "./chunk-Q3MIJPXM.js";
 import {
   findSimilarTrajectories,
   hashSignature,
   init_skill_learning
-} from "./chunk-5QCIPC7Z.js";
+} from "./chunk-UCNCSKGH.js";
 import {
   deactivateBehavior,
   init_behaviors,
   listBehaviorsByDomain,
   storeBehavior
-} from "./chunk-N2ZX27ID.js";
+} from "./chunk-QCJ3Y52V.js";
 import {
   countUnconsolidated,
   groupMemories,
   runConsolidation,
   selectUnconsolidated
-} from "./chunk-MQNM4FW4.js";
+} from "./chunk-Z6BTUUPK.js";
 import {
   renderClientCOOTemplate
-} from "./chunk-7FYOTSJP.js";
+} from "./chunk-SQLEKC4E.js";
 import {
   deactivateGlobalProcedure,
   loadGlobalProcedures,
   storeGlobalProcedure
-} from "./chunk-BQ5YXRBI.js";
+} from "./chunk-D7BPHQGX.js";
 import {
   PLATFORM_PROCEDURES
-} from "./chunk-N7GFMJSF.js";
+} from "./chunk-DMFM77DV.js";
 import {
   clearCloudReuploadRequired,
   cloudSync,
   getCloudReuploadRequired,
   markCloudReuploadRequired
-} from "./chunk-LEVPSCVX.js";
+} from "./chunk-UOCQQHZT.js";
+import {
+  crypto_exports,
+  init_crypto
+} from "./chunk-HJMM4QMY.js";
 import {
   createARecord
 } from "./chunk-X2Z5GT3V.js";
 import {
   embed,
   init_embedder
-} from "./chunk-YTTVKPOQ.js";
+} from "./chunk-CSVYC6HH.js";
 import {
   readMcpHttpEvents,
   summarizeMcpTransport,
   writeMcpTransportSummary
-} from "./chunk-OMHM3NGK.js";
+} from "./chunk-LUOLBU54.js";
 import {
   init_tasks,
   updateTask
-} from "./chunk-WTPYZG4I.js";
+} from "./chunk-CYCRC2KN.js";
 import {
   fastDbInit
-} from "./chunk-KJMSHBWT.js";
+} from "./chunk-ELXPFTBJ.js";
 import {
   getIdentity,
   listIdentities,
   updateIdentity
-} from "./chunk-BOPKW4AV.js";
+} from "./chunk-MQV4UKTS.js";
 import {
   MAX_CONCURRENT_WORKERS
-} from "./chunk-BI3COBMQ.js";
+} from "./chunk-VTZ4QOBS.js";
 import {
   getProjectName,
   init_project_name
-} from "./chunk-LPGBKR4H.js";
+} from "./chunk-TOR5ZPKF.js";
 import {
   hybridSearch,
   recentRecords
-} from "./chunk-EBMHOMN2.js";
+} from "./chunk-OIUPHIN2.js";
 import {
   getActiveAgent
-} from "./chunk-TCOTFMDP.js";
+} from "./chunk-XDJWGR2S.js";
 import {
   attachDocumentMetadata,
   flushBatch,
@@ -198,19 +202,19 @@ import {
   reserveVersions,
   vectorToBlob,
   writeMemory
-} from "./chunk-OVFU26ZD.js";
-import {
-  resolveTask,
-  writeCheckpoint
-} from "./chunk-EZ2TJX6O.js";
+} from "./chunk-IU3CXV4S.js";
 import {
   init_task_scope,
+  init_tasks_crud,
   init_tmux_routing,
   resolveExeSession,
+  resolveTask,
   sessionScopeFilter,
   strictSessionScopeFilter,
-  tmux_routing_exports
-} from "./chunk-FQZY4M45.js";
+  tmux_routing_exports,
+  updateTaskStatus,
+  writeCheckpoint
+} from "./chunk-YWCPAQBH.js";
 import {
   init_session_registry,
   listSessions
@@ -223,7 +227,7 @@ import {
   init_agent_config,
   loadAgentConfig,
   setAgentRuntime
-} from "./chunk-K7E72WGL.js";
+} from "./chunk-HHV26QTD.js";
 import {
   DEFAULT_RUNTIME,
   init_runtime_table
@@ -234,7 +238,7 @@ import {
   assertFeature,
   assertMemoryLimit,
   init_plan_limits
-} from "./chunk-GRLQJ27R.js";
+} from "./chunk-F6PIXTHZ.js";
 import {
   getAccountByName,
   getDefaultAccount
@@ -243,14 +247,14 @@ import {
   createNewTrigger,
   isScheduledTrigger,
   loadTriggers
-} from "./chunk-N6BE2CUT.js";
+} from "./chunk-VEGDNUBO.js";
 import {
   pushConversationToCRM
 } from "./chunk-GCNWCYJI.js";
 import {
   getClient,
   init_database
-} from "./chunk-2G6QGXVX.js";
+} from "./chunk-UEWGUOXB.js";
 import {
   EMPLOYEES_PATH,
   addEmployee,
@@ -263,7 +267,7 @@ import {
   loadEmployees,
   loadEmployeesSync,
   saveEmployees
-} from "./chunk-ZKYHW6KY.js";
+} from "./chunk-ZHJNMC4W.js";
 import {
   getMasterKey
 } from "./chunk-XUHFQHGZ.js";
@@ -280,12 +284,12 @@ import {
   readCachedLicenseToken,
   saveLicense,
   validateLicense
-} from "./chunk-UMLRHSAP.js";
+} from "./chunk-KNS5ETKF.js";
 import {
   EXE_AI_DIR,
   init_config,
   loadConfig
-} from "./chunk-ISRQKXHM.js";
+} from "./chunk-IG5XFUYJ.js";
 import {
   __toCommonJS
 } from "./chunk-KFQGP6VL.js";
@@ -879,7 +883,7 @@ async function searchConversations(query, limit) {
 }
 async function searchWiki(query, limit) {
   try {
-    const { createWikiClient, chatInWorkspace, listWorkspaces } = await import("./wiki-client-ZWA545PZ.js");
+    const { createWikiClient, chatInWorkspace, listWorkspaces } = await import("./wiki-client-UFR4R7YH.js");
     const client = await createWikiClient();
     if (!client) return [];
     const workspaces = await listWorkspaces(client);
@@ -1424,7 +1428,7 @@ async function handleSupersede(input) {
   }
   try {
     const { getClient: getClient2 } = await import("./lib/database.js");
-    const { getActiveAgent: getActiveAgent2 } = await import("./active-agent-EFZ6YZIM.js");
+    const { getActiveAgent: getActiveAgent2 } = await import("./active-agent-GFBVE3ES.js");
     const { writeMemory: writeMemory2, flushBatch: flushBatch2 } = await import("./lib/store.js");
     const { randomUUID: randomUUID2 } = await import("crypto");
     const client = getClient2();
@@ -1442,8 +1446,8 @@ async function handleSupersede(input) {
     });
     const { agentId, agentRole } = getActiveAgent2();
     const sessionId = process.env.SESSION_ID ?? "manual";
-    const { getProjectName: getProjectName2 } = await import("./project-name-PL2ZDWNU.js");
-    const projectName = input.project_name ?? getProjectName2(process.cwd());
+    const { getProjectName: getProjectName2 } = await import("./project-name-7G6XPXQ6.js");
+    const projectName = input.project_name ?? getProjectName2();
     const newId = randomUUID2();
     await writeMemory2({
       id: newId,
@@ -1533,9 +1537,9 @@ function registerMemory(server) {
         return handleSupersede(input);
       }
       if (action === "core_get" || action === "core_set" || action === "core_delete") {
-        const { getActiveAgent: getActiveAgent2 } = await import("./active-agent-EFZ6YZIM.js");
+        const { getActiveAgent: getActiveAgent2 } = await import("./active-agent-GFBVE3ES.js");
         const { agentId } = getActiveAgent2();
-        const { getCoreMemory, setCoreMemory, deleteCoreMemory, formatCoreMemoryBlock } = await import("./core-memory-DUENM2P6.js");
+        const { getCoreMemory, setCoreMemory, deleteCoreMemory, formatCoreMemoryBlock } = await import("./core-memory-JOTETVSY.js");
         if (action === "core_get") {
           const entries = await getCoreMemory(agentId);
           const block = formatCoreMemoryBlock(entries);
@@ -1928,6 +1932,36 @@ function registerCloseTask(server) {
         }
       } catch {
       }
+      let mergeWarning = "";
+      try {
+        const { getClient: getClient2 } = await import("./lib/database.js");
+        const client = getClient2();
+        const taskRow = await client.execute({
+          sql: "SELECT assigned_to FROM tasks WHERE id = ? OR task_file LIKE ? OR title LIKE ? LIMIT 1",
+          args: [task_id, `%${task_id}%`, `%${task_id}%`]
+        });
+        const assignee = taskRow.rows[0]?.assigned_to;
+        if (assignee) {
+          const { execSync } = await import("child_process");
+          try {
+            const openPRs = execSync(
+              `gh pr list --state open --json number,title,headRefName --author ${assignee} 2>/dev/null`,
+              { encoding: "utf8", timeout: 5e3 }
+            ).trim();
+            const prs = JSON.parse(openPRs || "[]");
+            if (prs.length > 0) {
+              const prList = prs.map((p) => `  #${p.number}: ${p.title} (${p.headRefName})`).join("\n");
+              mergeWarning = `
+
+\u26A0\uFE0F MERGE CHECK: ${assignee} has ${prs.length} open PR(s) \u2014 did you merge before closing?
+${prList}
+Run: gh pr merge <number> --squash --delete-branch`;
+            }
+          } catch {
+          }
+        }
+      } catch {
+      }
       const baseDir = process.cwd();
       const task = await updateTask({
         taskId: task_id,
@@ -1938,6 +1972,7 @@ function registerCloseTask(server) {
       });
       let text3 = `Task "${task.title}" marked ${task.status}.
 File: ${task.taskFile}`;
+      if (mergeWarning) text3 += mergeWarning;
       if ((status2 === "done" || status2 === "closed") && task.nextTask) {
         text3 += `
 
@@ -2004,6 +2039,7 @@ function registerCheckpointTask(server) {
 init_capacity_monitor();
 init_database();
 init_task_scope();
+init_tasks_crud();
 import { z as z15 } from "zod";
 var RESUME_CONTEXT_TASK_LIMIT = 10;
 function registerResumeEmployee(server) {
@@ -2041,15 +2077,23 @@ function registerResumeEmployee(server) {
         };
       }
       try {
-        const { isTmuxSessionAlive } = await import("./tasks-crud-MDCY6JHU.js");
+        const { isTmuxSessionAlive } = await import("./tasks-crud-ZRXPR3UB.js");
         const now = (/* @__PURE__ */ new Date()).toISOString();
         for (const row of openTasks.rows) {
           const status2 = String(row.status);
           const assignedTmux = row.assigned_tmux != null ? String(row.assigned_tmux) : null;
           if (status2 === "in_progress" && assignedTmux && !isTmuxSessionAlive(assignedTmux)) {
+            try {
+              await updateTaskStatus({ taskId: String(row.id), status: "open" });
+            } catch {
+              await client.execute({
+                sql: "UPDATE tasks SET status = 'open', updated_at = ? WHERE id = ?",
+                args: [now, String(row.id)]
+              });
+            }
             await client.execute({
-              sql: "UPDATE tasks SET status = 'open', assigned_tmux = NULL, updated_at = ? WHERE id = ?",
-              args: [now, String(row.id)]
+              sql: "UPDATE tasks SET assigned_tmux = NULL WHERE id = ?",
+              args: [String(row.id)]
             });
             process.stderr.write(
               `[resume_employee] Released dead claim on "${String(row.title)}" (was ${assignedTmux})
@@ -2119,7 +2163,7 @@ var REQUIRED_FIELDS2 = {
   update: ["task_id", "status"],
   close: ["task_id", "result"],
   checkpoint: ["task_id", "step", "context_summary"],
-  resume: ["agent_id", "project_name"]
+  resume: ["agent_id"]
 };
 function errorResult2(text3) {
   return {
@@ -2227,7 +2271,20 @@ function registerStoreBehavior(server) {
       }
     },
     async ({ content, domain, priority, agent_id, project_name }) => {
-      const resolvedAgent = agent_id ?? getActiveAgent().agentId;
+      const activeAgent = getActiveAgent();
+      const resolvedAgent = agent_id ?? activeAgent.agentId;
+      if (agent_id && agent_id !== activeAgent.agentId) {
+        try {
+          const { canCoordinate: canCoordinate2 } = await import("./lib/employees.js");
+          if (!canCoordinate2(activeAgent.agentId, activeAgent.agentRole ?? "employee")) {
+            return {
+              content: [{ type: "text", text: `Authorization denied: only coordinators can write behaviors for other agents. You (${activeAgent.agentId}) cannot write behaviors for ${agent_id}.` }],
+              isError: true
+            };
+          }
+        } catch {
+        }
+      }
       let resolvedProject;
       if (project_name === "global" || project_name === null) {
         resolvedProject = void 0;
@@ -2864,8 +2921,8 @@ function registerIngestDocument(server) {
     },
     async (input) => {
       try {
-        const { assertFeature: assertFeature2 } = await import("./plan-limits-3FXBGHWT.js");
-        const { assertMemoryLimit: assertMemoryLimit2 } = await import("./plan-limits-3FXBGHWT.js");
+        const { assertFeature: assertFeature2 } = await import("./plan-limits-AMJUHUCR.js");
+        const { assertMemoryLimit: assertMemoryLimit2 } = await import("./plan-limits-AMJUHUCR.js");
         await assertFeature2("wiki");
         await assertMemoryLimit2();
         const result3 = await ingestDocument(input);
@@ -3335,7 +3392,99 @@ function registerSendWhatsapp(server) {
 
 // src/mcp/tools/query-conversations.ts
 init_database();
+import { z as z31 } from "zod";
+
+// src/lib/unified-query.ts
 import { z as z30 } from "zod";
+var PaginationSchema = {
+  limit: z30.coerce.number().int().min(1).max(100).optional().describe("Max results to return (default 25, max 100)"),
+  offset: z30.coerce.number().int().min(0).optional().describe("Number of results to skip for pagination")
+};
+var DateRangeSchema = {
+  date_from: z30.string().optional().describe("Filter records created/updated after this ISO date (inclusive)"),
+  date_to: z30.string().optional().describe("Filter records created/updated before this ISO date (inclusive)")
+};
+var TextSearchSchema = {
+  text_search: z30.string().optional().describe("Full-text search across relevant fields")
+};
+var SortSchema = {
+  sort_by: z30.string().optional().describe("Field to sort by (tool-specific, default varies)"),
+  sort_order: z30.enum(["asc", "desc"]).optional().describe("Sort direction (default desc)")
+};
+var SourceFilterSchema = {
+  source: z30.string().optional().describe("Filter by data source/platform")
+};
+var StructuredFiltersSchema = {
+  structured_filters: z30.record(z30.string(), z30.unknown()).optional().describe(
+    "Structured field filters: { field: value } for equality, or { field: { op: 'gt'|'lt'|'gte'|'lte'|'contains'|'neq', value: ... } }"
+  )
+};
+var UnifiedQuerySchema = {
+  ...PaginationSchema,
+  ...DateRangeSchema,
+  ...TextSearchSchema,
+  ...SortSchema,
+  ...SourceFilterSchema,
+  ...StructuredFiltersSchema
+};
+function formatUnifiedResponse(data, opts) {
+  return {
+    data,
+    total: opts.total ?? data.length,
+    offset: opts.offset ?? 0,
+    limit: opts.limit ?? data.length,
+    source: opts.source
+  };
+}
+function buildStructuredFilterClauses(filters, columnMapping) {
+  if (!filters) return [];
+  const clauses = [];
+  for (const [field, value] of Object.entries(filters)) {
+    const column = columnMapping?.[field] ?? field;
+    if (value === null || value === void 0) continue;
+    if (typeof value === "object" && !Array.isArray(value)) {
+      const filter = value;
+      if (!filter.op || filter.value === void 0) continue;
+      switch (filter.op) {
+        case "eq":
+          clauses.push({ sql: `${column} = ?`, args: [filter.value] });
+          break;
+        case "neq":
+          clauses.push({ sql: `${column} != ?`, args: [filter.value] });
+          break;
+        case "gt":
+          clauses.push({ sql: `${column} > ?`, args: [filter.value] });
+          break;
+        case "lt":
+          clauses.push({ sql: `${column} < ?`, args: [filter.value] });
+          break;
+        case "gte":
+          clauses.push({ sql: `${column} >= ?`, args: [filter.value] });
+          break;
+        case "lte":
+          clauses.push({ sql: `${column} <= ?`, args: [filter.value] });
+          break;
+        case "contains":
+          clauses.push({ sql: `${column} LIKE ?`, args: [`%${filter.value}%`] });
+          break;
+        default:
+          break;
+      }
+    } else {
+      clauses.push({ sql: `${column} = ?`, args: [value] });
+    }
+  }
+  return clauses;
+}
+function buildSortClause(sortBy, sortOrder, defaultSort = "created_at DESC", allowedColumns) {
+  if (!sortBy) return `ORDER BY ${defaultSort}`;
+  if (allowedColumns && !allowedColumns.has(sortBy)) return `ORDER BY ${defaultSort}`;
+  if (!/^[a-zA-Z_][a-zA-Z0-9_.]*$/.test(sortBy)) return `ORDER BY ${defaultSort}`;
+  const order = sortOrder === "asc" ? "ASC" : "DESC";
+  return `ORDER BY ${sortBy} ${order}`;
+}
+
+// src/mcp/tools/query-conversations.ts
 function registerQueryConversations(server) {
   server.registerTool(
     "query_conversations",
@@ -3343,14 +3492,16 @@ function registerQueryConversations(server) {
       title: "Query Conversations",
       description: "Search across all adapter messages by content, sender, date range, or platform. Returns messages with source attribution (platform, sender, timestamp).",
       inputSchema: {
-        query: z30.string().optional().describe("Full-text search query across message content and responses"),
-        sender: z30.string().optional().describe("Filter by sender ID or name (partial match)"),
-        platform: z30.string().optional().describe("Filter by platform: whatsapp, signal, telegram, discord, imessage, slack, email, webchat"),
-        after: z30.string().optional().describe("Filter messages after this ISO 8601 date (e.g. 2026-04-01)"),
-        before: z30.string().optional().describe("Filter messages before this ISO 8601 date (e.g. 2026-04-15)"),
-        channel_id: z30.string().optional().describe("Filter by channel/chat ID"),
-        thread_id: z30.string().optional().describe("Filter by conversation thread ID"),
-        limit: z30.number().int().min(1).max(100).optional().default(25).describe("Max results to return (default 25, max 100)")
+        query: z31.string().optional().describe("Full-text search query across message content and responses"),
+        sender: z31.string().optional().describe("Filter by sender ID or name (partial match)"),
+        platform: z31.string().optional().describe("Filter by platform: whatsapp, signal, telegram, discord, imessage, slack, email, webchat"),
+        after: z31.string().optional().describe("Filter messages after this ISO 8601 date (alias for date_from)"),
+        before: z31.string().optional().describe("Filter messages before this ISO 8601 date (alias for date_to)"),
+        channel_id: z31.string().optional().describe("Filter by channel/chat ID"),
+        thread_id: z31.string().optional().describe("Filter by conversation thread ID"),
+        ...DateRangeSchema,
+        ...SortSchema,
+        ...PaginationSchema
       }
     },
     async (params) => {
@@ -3372,13 +3523,15 @@ function registerQueryConversations(server) {
           conditions.push(`c.platform = ?`);
           args.push(params.platform);
         }
-        if (params.after) {
+        const dateFrom = params.date_from ?? params.after;
+        const dateTo = params.date_to ?? params.before;
+        if (dateFrom) {
           conditions.push(`c.timestamp >= ?`);
-          args.push(params.after);
+          args.push(dateFrom);
         }
-        if (params.before) {
+        if (dateTo) {
           conditions.push(`c.timestamp <= ?`);
-          args.push(params.before);
+          args.push(dateTo);
         }
         if (params.channel_id) {
           conditions.push(`c.channel_id = ?`);
@@ -3389,16 +3542,19 @@ function registerQueryConversations(server) {
           args.push(params.thread_id);
         }
         const whereClause = conditions.length > 0 ? `WHERE ${conditions.join(" AND ")}` : "";
+        const ALLOWED_SORT_COLS = /* @__PURE__ */ new Set(["timestamp", "platform", "sender_id", "sender_name", "created_at"]);
+        const orderBy = buildSortClause(params.sort_by, params.sort_order, "c.timestamp DESC", ALLOWED_SORT_COLS);
         const limit = params.limit ?? 25;
-        args.push(limit);
+        const offset = params.offset ?? 0;
+        args.push(limit, offset);
         const result3 = await client.execute({
           sql: `SELECT c.id, c.platform, c.sender_id, c.sender_name, c.sender_phone,
                        c.sender_email, c.channel_id, c.thread_id, c.content_text,
                        c.agent_response, c.agent_name, c.timestamp
                 FROM conversations c
                 ${whereClause}
-                ORDER BY c.timestamp DESC
-                LIMIT ?`,
+                ${orderBy}
+                LIMIT ? OFFSET ?`,
           args
         });
         const conversations = result3.rows.map((row) => ({
@@ -3419,8 +3575,8 @@ function registerQueryConversations(server) {
         }));
         const countResult = await client.execute({
           sql: `SELECT COUNT(*) as total FROM conversations c ${whereClause}`,
-          args: args.slice(0, -1)
-          // exclude limit
+          args: args.slice(0, -2)
+          // exclude limit and offset
         });
         const total = Number(countResult.rows[0]?.total) || 0;
         return {
@@ -3428,11 +3584,7 @@ function registerQueryConversations(server) {
             {
               type: "text",
               text: JSON.stringify(
-                {
-                  total,
-                  returned: conversations.length,
-                  conversations
-                },
+                formatUnifiedResponse(conversations, { total, offset, limit, source: "conversations" }),
                 null,
                 2
               )
@@ -3459,84 +3611,8 @@ function registerQueryConversations(server) {
 // src/mcp/tools/query-company-brain.ts
 init_config();
 import { z as z32 } from "zod";
-
-// src/lib/unified-query.ts
-import { z as z31 } from "zod";
-var PaginationSchema = {
-  limit: z31.coerce.number().int().min(1).max(100).optional().describe("Max results to return (default 25, max 100)"),
-  offset: z31.coerce.number().int().min(0).optional().describe("Number of results to skip for pagination")
-};
-var DateRangeSchema = {
-  date_from: z31.string().optional().describe("Filter records created/updated after this ISO date (inclusive)"),
-  date_to: z31.string().optional().describe("Filter records created/updated before this ISO date (inclusive)")
-};
-var TextSearchSchema = {
-  text_search: z31.string().optional().describe("Full-text search across relevant fields")
-};
-var SortSchema = {
-  sort_by: z31.string().optional().describe("Field to sort by (tool-specific, default varies)"),
-  sort_order: z31.enum(["asc", "desc"]).optional().describe("Sort direction (default desc)")
-};
-var SourceFilterSchema = {
-  source: z31.string().optional().describe("Filter by data source/platform")
-};
-var StructuredFiltersSchema = {
-  structured_filters: z31.record(z31.string(), z31.unknown()).optional().describe(
-    "Structured field filters: { field: value } for equality, or { field: { op: 'gt'|'lt'|'gte'|'lte'|'contains'|'neq', value: ... } }"
-  )
-};
-var UnifiedQuerySchema = {
-  ...PaginationSchema,
-  ...DateRangeSchema,
-  ...TextSearchSchema,
-  ...SortSchema,
-  ...SourceFilterSchema,
-  ...StructuredFiltersSchema
-};
-function buildStructuredFilterClauses(filters, columnMapping) {
-  if (!filters) return [];
-  const clauses = [];
-  for (const [field, value] of Object.entries(filters)) {
-    const column = columnMapping?.[field] ?? field;
-    if (value === null || value === void 0) continue;
-    if (typeof value === "object" && !Array.isArray(value)) {
-      const filter = value;
-      if (!filter.op || filter.value === void 0) continue;
-      switch (filter.op) {
-        case "eq":
-          clauses.push({ sql: `${column} = ?`, args: [filter.value] });
-          break;
-        case "neq":
-          clauses.push({ sql: `${column} != ?`, args: [filter.value] });
-          break;
-        case "gt":
-          clauses.push({ sql: `${column} > ?`, args: [filter.value] });
-          break;
-        case "lt":
-          clauses.push({ sql: `${column} < ?`, args: [filter.value] });
-          break;
-        case "gte":
-          clauses.push({ sql: `${column} >= ?`, args: [filter.value] });
-          break;
-        case "lte":
-          clauses.push({ sql: `${column} <= ?`, args: [filter.value] });
-          break;
-        case "contains":
-          clauses.push({ sql: `${column} LIKE ?`, args: [`%${filter.value}%`] });
-          break;
-        default:
-          break;
-      }
-    } else {
-      clauses.push({ sql: `${column} = ?`, args: [value] });
-    }
-  }
-  return clauses;
-}
-
-// src/mcp/tools/query-company-brain.ts
 var FETCH_TIMEOUT_MS = 1e4;
-var QUERY_SCOPE = z32.enum(["raw", "crm", "wiki", "memory", "gateway", "all"]);
+var QUERY_SCOPE = z32.enum(["raw", "crm", "wiki", "memory", "gateway", "all", "cross"]);
 var QUERY_ACTION = z32.enum(["search", "list_sources", "sql"]);
 var LOCAL_GATEWAY_HTTP_HOSTS = /^(localhost|127\.0\.0\.1|::1|exe-gateway|gateway)$/i;
 function assertSecureGatewayUrlForToken(gatewayUrl, authToken) {
@@ -3577,12 +3653,13 @@ function registerQueryCompanyBrain(server) {
         sql: z32.string().optional().describe("Read-only SELECT/WITH SQL. Required for action=sql."),
         scope: QUERY_SCOPE.default("all").describe("Which data scope to search/read (raw, crm, wiki, memory, gateway, all)"),
         source: z32.string().optional().describe("Filter raw events by source (shopify, asana, etc.)"),
-        limit: z32.coerce.number().int().min(1).max(100).default(20).describe("Max results per scope"),
+        ...PaginationSchema,
         ...DateRangeSchema,
         ...SortSchema
       }
     },
-    async ({ action, query, sql, scope, source, limit, date_from, date_to, sort_by, sort_order }) => {
+    async ({ action, query, sql, scope, source, limit, offset, date_from, date_to, sort_by, sort_order, ...rest }) => {
+      const userContext = rest._userContext;
       const resolvedAction = action ?? "search";
       if (resolvedAction === "search" && !query?.trim()) {
         return {
@@ -3639,11 +3716,14 @@ function registerQueryCompanyBrain(server) {
           isError: true
         };
       }
+      const resolvedLimit = limit ?? 25;
+      const resolvedOffset = offset ?? 0;
       if (resolvedAction === "search") {
         url.searchParams.set("q", query.trim());
         url.searchParams.set("scope", scope);
         if (source) url.searchParams.set("source", source);
-        url.searchParams.set("limit", String(limit));
+        url.searchParams.set("limit", String(resolvedLimit));
+        if (resolvedOffset > 0) url.searchParams.set("offset", String(resolvedOffset));
         if (date_from) url.searchParams.set("date_from", date_from);
         if (date_to) url.searchParams.set("date_to", date_to);
         if (sort_by) url.searchParams.set("sort_by", sort_by);
@@ -3654,9 +3734,10 @@ function registerQueryCompanyBrain(server) {
           method: resolvedAction === "sql" ? "POST" : "GET",
           headers: {
             ...authToken ? { Authorization: `Bearer ${authToken}` } : {},
-            ...resolvedAction === "sql" ? { "Content-Type": "application/json" } : {}
+            ...resolvedAction === "sql" ? { "Content-Type": "application/json" } : {},
+            ...userContext ? { "X-User-Id": userContext.userId } : {}
           },
-          body: resolvedAction === "sql" ? JSON.stringify({ sql: sql.trim(), max_rows: limit }) : void 0,
+          body: resolvedAction === "sql" ? JSON.stringify({ sql: sql.trim(), max_rows: resolvedLimit }) : void 0,
           signal: AbortSignal.timeout(FETCH_TIMEOUT_MS)
         });
         if (!response.ok) {
@@ -3696,6 +3777,57 @@ function registerQueryCompanyBrain(server) {
   );
 }
 
+// src/lib/gotrue-client.ts
+var GOTRUE_TIMEOUT_MS = 1e4;
+async function validateGoTrueToken(token, gotrueUrl) {
+  const url = gotrueUrl ?? process.env.GOTRUE_URL ?? process.env.EXE_GOTRUE_URL;
+  if (!url) return null;
+  try {
+    const res = await fetch(`${url}/user`, {
+      headers: {
+        Authorization: `Bearer ${token}`,
+        "Content-Type": "application/json"
+      },
+      signal: AbortSignal.timeout(GOTRUE_TIMEOUT_MS)
+    });
+    if (!res.ok) return null;
+    const user = await res.json();
+    return user;
+  } catch {
+    return null;
+  }
+}
+async function getGoTrueUser(userId, gotrueUrl) {
+  const url = gotrueUrl ?? process.env.GOTRUE_URL ?? process.env.EXE_GOTRUE_URL;
+  const adminToken2 = process.env.GOTRUE_ADMIN_TOKEN ?? process.env.EXE_GOTRUE_ADMIN_TOKEN;
+  if (!url || !adminToken2) return null;
+  try {
+    const res = await fetch(`${url}/admin/users/${userId}`, {
+      headers: {
+        Authorization: `Bearer ${adminToken2}`,
+        "Content-Type": "application/json"
+      },
+      signal: AbortSignal.timeout(GOTRUE_TIMEOUT_MS)
+    });
+    if (!res.ok) return null;
+    return await res.json();
+  } catch {
+    return null;
+  }
+}
+async function resolveUserContext(params) {
+  if (params.auth_token) {
+    const user = await validateGoTrueToken(params.auth_token);
+    if (user) return { userId: user.id, user };
+  }
+  if (params.user_id) {
+    const user = await getGoTrueUser(params.user_id);
+    if (user) return { userId: user.id, user };
+    return { userId: params.user_id, user: { id: params.user_id } };
+  }
+  return null;
+}
+
 // src/mcp/tools/gateway.ts
 function errorResult6(text3) {
   return { content: [{ type: "text", text: text3 }], isError: true };
@@ -3729,11 +3861,25 @@ function registerGateway(server) {
       thread_id: z33.string().optional().describe("Conversation thread filter"),
       limit: z33.coerce.number().int().min(1).max(100).optional().describe("Max results"),
       scope: z33.enum(["raw", "wiki", "memory", "gateway", "all"]).optional().describe("Company Brain scope"),
-      source: z33.string().optional().describe("Company Brain raw event source filter")
+      source: z33.string().optional().describe("Company Brain raw event source filter"),
+      auth_token: z33.string().optional().describe("GoTrue JWT for user authentication"),
+      user_id: z33.string().optional().describe("GoTrue user ID (admin lookup fallback)")
     }
   }, async (input, extra) => {
     const action = input.action;
-    const { action: _action, ...args } = input;
+    const { action: _action, auth_token, user_id, ...args } = input;
+    if (auth_token || user_id) {
+      const userCtx = await resolveUserContext({
+        auth_token,
+        user_id
+      });
+      if (auth_token && !userCtx) {
+        return errorResult6("Authentication failed \u2014 invalid GoTrue token");
+      }
+      if (userCtx) {
+        args._userContext = userCtx;
+      }
+    }
     let toolName;
     if (action === "send_whatsapp") {
       if (!Array.isArray(args.recipients) || args.recipients.length === 0 || !args.message) {
@@ -4906,7 +5052,7 @@ async function getAgentSessionLoad() {
       return { sessions: [], totalLive: 0, busySessions: 0, idleSessions: 0 };
     }
     const { getClient: getClient2 } = await import("./lib/database.js");
-    const { sessionScopeFilter: sessionScopeFilter2 } = await import("./task-scope-2L5DLU6T.js");
+    const { sessionScopeFilter: sessionScopeFilter2 } = await import("./task-scope-RMJLXJ7S.js");
     const client = getClient2();
     const scope = sessionScopeFilter2();
     for (const s of liveAgentSessions) {
@@ -6508,7 +6654,7 @@ function registerCreateTrigger(server) {
       }
     },
     async ({ name, event, conditions, actions, project, enabled, schedule, query }) => {
-      const { assertFeature: assertFeature2 } = await import("./plan-limits-3FXBGHWT.js");
+      const { assertFeature: assertFeature2 } = await import("./plan-limits-AMJUHUCR.js");
       const gatedActions = {
         send_whatsapp: "external_agents",
         update_wiki: "wiki"
@@ -7272,6 +7418,7 @@ function registerGlobalProcedure(server) {
 
 // src/mcp/tools/config.ts
 var ACTION_TO_TOOL2 = {
+  hire: "hire_employee",
   set_agent_config: "set_agent_config",
   list_employees: "list_employees",
   agent_spend: "get_agent_spend",
@@ -7346,7 +7493,8 @@ function registerConfig(server) {
     description: "Consolidated COO/admin tool for runtime config, system health, licensing, triggers, orchestration import/export, and company procedures.",
     inputSchema: {
       action: z67.enum(Object.keys(ACTION_TO_TOOL2)).describe("Admin/config operation"),
-      agent_id: z67.string().optional().describe("Agent id for set_agent_config/agent_spend/session queries"),
+      agent_id: z67.string().optional().describe("Agent id for set_agent_config/agent_spend/session queries/hire"),
+      role: z67.string().optional().describe("Role template for action=hire: coo, cto, cmo, gm, principal-engineer, content-specialist, ai-specialist, staff-code-reviewer"),
       runtime: z67.string().optional().describe("Runtime for set_agent_config"),
       model: z67.string().optional().describe("Model for set_agent_config"),
       reasoning_effort: z67.string().optional().describe("Reasoning effort for Codex agents"),
@@ -7398,6 +7546,70 @@ function registerConfig(server) {
     if (action === "activate_license" && !args.license_key) return errorResult8('config action "activate_license" requires license_key');
     if (action === "create_trigger" && (!args.name || !args.event || !Array.isArray(args.actions))) return errorResult8('config action "create_trigger" requires name, event, and actions');
     if ((action === "company_procedure" || action === "global_procedure") && args.action === "store" && (!args.title || !args.content)) return errorResult8(`config action "${action}" subaction=store requires title and content`);
+    if (action === "hire") {
+      const employeeName = args.agent_id?.toLowerCase().trim();
+      const role = args.role ?? "specialist";
+      if (!employeeName) return errorResult8('config action "hire" requires agent_id (employee name)');
+      try {
+        const { validateEmployeeName, hireEmployee, registerBinSymlinks } = await import("./lib/employees.js");
+        const validation = validateEmployeeName(employeeName);
+        if (!validation.valid) return errorResult8(`Invalid name: ${validation.error}`);
+        const { loadEmployeesSync: loadEmployeesSync2 } = await import("./lib/employees.js");
+        const existing = loadEmployeesSync2();
+        if (existing.some((e) => e.name === employeeName)) return errorResult8(`Employee "${employeeName}" already exists.`);
+        try {
+          const { assertEmployeeLimit: assertEmployeeLimit2 } = await import("./plan-limits-AMJUHUCR.js");
+          await assertEmployeeLimit2();
+        } catch (e) {
+          return errorResult8(e instanceof Error ? e.message : "Employee limit reached.");
+        }
+        await hireEmployee({
+          name: employeeName,
+          role,
+          createdAt: (/* @__PURE__ */ new Date()).toISOString(),
+          templateName: role,
+          templateVersion: 1
+        });
+        try {
+          const { getTemplate: getIdentityTemplate, getTemplateForTitle } = await import("./lib/identity-templates.js");
+          const { identityPath } = await import("./lib/identity.js");
+          const { existsSync: existsSync10, mkdirSync: mkdirSync4, writeFileSync: writeFileSync5 } = await import("fs");
+          const path18 = await import("path");
+          const template = getIdentityTemplate(role) ?? getTemplateForTitle(role);
+          const idPath = identityPath(employeeName);
+          const dir = path18.dirname(idPath);
+          if (!existsSync10(dir)) mkdirSync4(dir, { recursive: true });
+          if (template) {
+            writeFileSync5(idPath, template.replace(/^agent_id: \w+/m, `agent_id: ${employeeName}`), "utf-8");
+          } else {
+            writeFileSync5(idPath, `---
+role: ${role}
+title: ${role}
+agent_id: ${employeeName}
+org_level: specialist
+---
+
+You are ${employeeName}. Role: ${role}.`, "utf-8");
+          }
+        } catch {
+        }
+        try {
+          registerBinSymlinks(employeeName);
+        } catch {
+        }
+        try {
+          const { generateSessionWrappers } = await import("./lib/session-wrappers.js");
+          const { resolvePackageRoot } = await import("./installer-3RTZXZ57.js");
+          generateSessionWrappers(resolvePackageRoot());
+        } catch {
+        }
+        return {
+          content: [{ type: "text", text: `\u2705 Hired ${employeeName} (role: ${role}). Identity written, launchers registered. Dispatch work with create_task(assigned_to="${employeeName}").` }]
+        };
+      } catch (e) {
+        return errorResult8(`Hire failed: ${e instanceof Error ? e.message : String(e)}`);
+      }
+    }
     const toolName = ACTION_TO_TOOL2[action];
     const tool = legacy.get(toolName);
     if (!tool) return errorResult8(`Legacy config handler not found for action "${action}" (${toolName})`);
@@ -7423,7 +7635,7 @@ function registerListWikiPages(server) {
       }
     },
     async ({ workspace, folder }) => {
-      const { assertFeature: assertFeature2 } = await import("./plan-limits-3FXBGHWT.js");
+      const { assertFeature: assertFeature2 } = await import("./plan-limits-AMJUHUCR.js");
       await assertFeature2("wiki");
       const apiUrl = process.env.EXE_WIKI_API_URL;
       const apiKey = process.env.EXE_WIKI_API_KEY;
@@ -7523,7 +7735,7 @@ function registerGetWikiPage(server) {
       }
     },
     async ({ workspace, document_id, title }) => {
-      const { assertFeature: assertFeature2 } = await import("./plan-limits-3FXBGHWT.js");
+      const { assertFeature: assertFeature2 } = await import("./plan-limits-AMJUHUCR.js");
       await assertFeature2("wiki");
       const apiUrl = process.env.EXE_WIKI_API_URL;
       const apiKey = process.env.EXE_WIKI_API_KEY;
@@ -7718,7 +7930,7 @@ function registerWiki(server) {
       if (!legacyToolName) return errorResult9(`Unknown wiki action: ${String(input.action)}`);
       const { action: _action, user_id, ...legacyArgs } = input;
       if (user_id && legacyArgs.workspace) {
-        const { checkWikiAccess } = await import("./wiki-acl-RVCO4WSP.js");
+        const { checkWikiAccess } = await import("./wiki-acl-P7WEIMJV.js");
         const { allowed } = await checkWikiAccess(
           String(user_id),
           String(legacyArgs.workspace),
@@ -8569,9 +8781,10 @@ function registerCrm(server) {
       ...PaginationSchema,
       ...DateRangeSchema,
       ...TextSearchSchema,
-      ...SortSchema
+      ...SortSchema,
+      ...StructuredFiltersSchema
     }
-  }, async ({ action, id, query, table, limit, offset, date_from, date_to, text_search, sort_by, sort_order }) => {
+  }, async ({ action, id, query, table, limit, offset, date_from, date_to, text_search, sort_by, sort_order, structured_filters }) => {
     try {
       if (action === "get_person" && !id && !query) return text('crm action "get_person" requires id or query', true);
       if (action === "describe_table" && !table) return text('crm action "describe_table" requires table', true);
@@ -8625,15 +8838,38 @@ function registerCrm(server) {
         args.push(date_to);
         clauses.push(`p.created_at <= $${args.length}`);
       }
+      if (structured_filters && typeof structured_filters === "object") {
+        const sfClauses = buildStructuredFilterClauses(
+          structured_filters
+        );
+        for (const sf of sfClauses) {
+          args.push(...sf.args);
+          let pgSql = sf.sql;
+          let paramIdx = args.length - sf.args.length;
+          pgSql = pgSql.replace(/\?/g, () => `$${++paramIdx}`);
+          clauses.push(`p.${pgSql}`);
+        }
+      }
       const where = clauses.length > 0 ? `WHERE ${clauses.join(" AND ")}` : "";
       const orderCol = sort_by && /^[a-zA-Z_]+$/.test(sort_by) ? `p.${sort_by}` : "(p.id)::text";
       const orderDir = sort_order === "asc" ? "ASC" : "DESC";
+      const countArgs = [...args];
+      const countRows = await prisma.$queryRawUnsafe(
+        `SELECT COUNT(*)::int AS total FROM ${relation} p ${where}`,
+        ...countArgs
+      );
+      const total = Number(countRows[0]?.total) || 0;
       args.push(lim, off);
       const rows = await prisma.$queryRawUnsafe(
         `SELECT to_jsonb(p) AS person FROM ${relation} p ${where} ORDER BY ${orderCol} ${orderDir} LIMIT $${args.length - 1} OFFSET $${args.length}`,
         ...args
       );
-      return text(JSON.stringify({ people: rows.map((r) => r.person ?? r) }, null, 2));
+      const people = rows.map((r) => r.person ?? r);
+      return text(JSON.stringify(
+        formatUnifiedResponse(people, { total, offset: off, limit: lim, source: "crm" }),
+        null,
+        2
+      ));
     } catch (err) {
       return text(`crm failed: ${err instanceof Error ? err.message : String(err)}`, true);
     }
@@ -8853,7 +9089,7 @@ function registerWorkflowTool(server) {
         getWorkflowInstance,
         listWorkflowInstances,
         approveWorkflowStep
-      } = await import("./workflow-engine-7W4MSNBF.js");
+      } = await import("./workflow-engine-EPWKDGHR.js");
       try {
         switch (input.action) {
           case "create_workflow": {
@@ -9083,10 +9319,30 @@ function buildMarkdown(input) {
     section("Local patch diff", input.localPatchDiff)
   ].join("\n");
 }
+function prepareUpstreamPayload(payload) {
+  const redacted = { ...payload };
+  if (redacted.agent_id) {
+    redacted.agent_id = crypto5.createHash("sha256").update(String(redacted.agent_id)).digest("hex").slice(0, 12);
+  }
+  if (redacted.project_name) {
+    redacted.project_name = crypto5.createHash("sha256").update(String(redacted.project_name)).digest("hex").slice(0, 12);
+  }
+  delete redacted.agent_role;
+  try {
+    const { encryptSyncBlob, isSyncCryptoInitialized } = (init_crypto(), __toCommonJS(crypto_exports));
+    if (isSyncCryptoInitialized()) {
+      const jsonBuf = Buffer.from(JSON.stringify(redacted), "utf-8");
+      const encrypted = encryptSyncBlob(jsonBuf);
+      return { body: JSON.stringify({ encrypted, version: 1 }), contentType: "application/json", encrypted: true };
+    }
+  } catch {
+  }
+  return { body: JSON.stringify(redacted), contentType: "application/json", encrypted: false };
+}
 async function maybeSendUpstream(payload) {
   const config = await loadConfig();
   const routerUrl = process.env.API_ROUTER_URL?.replace(/\/+$/, "");
-  const endpoint2 = config.support?.bugReportEndpoint || process.env.EXE_BUG_REPORT_ENDPOINT || (routerUrl ? `${routerUrl}/v1/support/bug-reports` : "https://askexe.com/v1/support/bug-reports");
+  const endpoint2 = config.support?.bugReportEndpoint || process.env.EXE_BUG_REPORT_ENDPOINT || (routerUrl ? `${routerUrl}/v1/support/bug-reports` : "https://cloud.askexe.com/v1/support/bug-reports");
   const token = config.support?.bugReportToken || process.env.EXE_BUG_REPORT_TOKEN;
   const licenseKey = loadLicense() || process.env.EXE_LICENSE_KEY || config.cloud?.apiKey;
   const licenseToken = readCachedLicenseToken();
@@ -9098,19 +9354,21 @@ async function maybeSendUpstream(payload) {
     if (parsed.protocol !== "https:" && !["localhost", "127.0.0.1", "::1"].includes(parsed.hostname)) {
       return "failed: insecure endpoint rejected";
     }
+    const { body, contentType, encrypted } = prepareUpstreamPayload(payload);
     const response = await fetch(parsed, {
       method: "POST",
       headers: {
-        "content-type": "application/json",
+        "content-type": contentType,
         ...token ? { authorization: `Bearer ${token}` } : {},
         ...licenseKey ? { "x-exe-license-key": licenseKey } : {},
-        ...licenseToken ? { "x-exe-license-token": licenseToken } : {}
+        ...licenseToken ? { "x-exe-license-token": licenseToken } : {},
+        ...encrypted ? { "x-exe-encrypted": "aes-256-gcm" } : {}
       },
-      body: JSON.stringify(payload),
+      body,
       signal: AbortSignal.timeout(1e4)
     });
     if (!response.ok) return `failed: HTTP ${response.status}`;
-    return "sent";
+    return encrypted ? "sent (encrypted)" : "sent (redacted)";
   } catch (err) {
     return `failed: ${err instanceof Error ? err.message : String(err)}`;
   }
@@ -9305,7 +9563,7 @@ function buildMarkdown2(input) {
 async function maybeSendUpstream2(payload) {
   const config = await loadConfig();
   const routerUrl = process.env.API_ROUTER_URL?.replace(/\/+$/, "");
-  const endpoint2 = config.support?.featureRequestEndpoint || process.env.EXE_FEATURE_REQUEST_ENDPOINT || (routerUrl ? `${routerUrl}/v1/support/feature-requests` : "https://askexe.com/v1/support/feature-requests");
+  const endpoint2 = config.support?.featureRequestEndpoint || process.env.EXE_FEATURE_REQUEST_ENDPOINT || (routerUrl ? `${routerUrl}/v1/support/feature-requests` : "https://cloud.askexe.com/v1/support/feature-requests");
   const token = config.support?.featureRequestToken || process.env.EXE_FEATURE_REQUEST_TOKEN;
   const licenseKey = loadLicense() || process.env.EXE_LICENSE_KEY || config.cloud?.apiKey;
   const licenseToken = readCachedLicenseToken();
@@ -9529,7 +9787,7 @@ function registerSupportTools(server) {
           isError: true
         };
       }
-      const endpoint2 = new URL("https://askexe.com/v1/support/my-reports");
+      const endpoint2 = new URL("https://cloud.askexe.com/v1/support/my-reports");
       endpoint2.searchParams.set("status", status2);
       endpoint2.searchParams.set("limit", String(limit));
       const headers = { "content-type": "application/json" };
@@ -9595,7 +9853,7 @@ function registerSupportTools(server) {
           isError: true
         };
       }
-      const endpoint2 = new URL("https://askexe.com/v1/support/my-feature-requests");
+      const endpoint2 = new URL("https://cloud.askexe.com/v1/support/my-feature-requests");
       endpoint2.searchParams.set("status", status2);
       endpoint2.searchParams.set("limit", String(limit));
       const headers = { "content-type": "application/json" };
@@ -10002,7 +10260,7 @@ function registerCodeContext(server) {
 
 // src/mcp/tools/support-inbox.ts
 import { z as z89 } from "zod";
-var DEFAULT_ENDPOINT = "https://askexe.com/admin/support/bug-reports";
+var DEFAULT_ENDPOINT = "https://cloud.askexe.com/admin/support/bug-reports";
 var STATUS = z89.enum(["open", "triaged", "fixed", "closed", "wontfix"]);
 function adminToken() {
   return process.env.ASKEXE_SUPPORT_ADMIN_TOKEN || process.env.EXE_SUPPORT_ADMIN_TOKEN;
@@ -10424,6 +10682,21 @@ function registerDiagnostics(server) {
       if (action === "drift") {
         return handleDrift(input);
       }
+      if (action === "audit_trail") {
+        try {
+          const { getClient: getClient2 } = await import("./lib/database.js");
+          const client = await getClient2();
+          const limit = Number(input.limit ?? 50);
+          const result3 = await client.execute({
+            sql: `SELECT id, agent_id, tool_name, decision, reason, timestamp FROM audit_trail ORDER BY timestamp DESC LIMIT ?`,
+            args: [limit]
+          });
+          const rows = result3.rows.map((r) => `[${r.timestamp}] ${r.agent_id} | ${r.tool_name} \u2192 ${r.decision}${r.reason ? ` (${r.reason})` : ""}`).join("\n");
+          return { content: [{ type: "text", text: rows || "No audit trail entries." }] };
+        } catch (err) {
+          return { content: [{ type: "text", text: `Audit trail query failed: ${err instanceof Error ? err.message : String(err)}` }], isError: true };
+        }
+      }
       const handler = handlers.get(action);
       if (!handler) {
         return {