@askexenow/exe-os 0.9.140 → 0.9.141

package/dist/{task-enforcement-YMGIERU4.js → task-enforcement-V2CQEPXS.js}

@@ -3,7 +3,7 @@ import {
   init_tmux_routing,
   sendIntercom,
   updateTaskStatus
-} from "./chunk-YWCPAQBH.js";
+} from "./chunk-Y3JNBCZI.js";
 import "./chunk-2OG5NAO2.js";
 import "./chunk-NEAHEC5G.js";
 import "./chunk-KRLOFIPI.js";
@@ -11,21 +11,20 @@ import "./chunk-57HCNSFO.js";
 import "./chunk-MBRLA4E3.js";
 import "./chunk-DC4ZD76Y.js";
 import "./chunk-PJHHFJAN.js";
-import "./chunk-HHV26QTD.js";
+import "./chunk-SOHGHGWU.js";
 import "./chunk-JT76KRZQ.js";
-import "./chunk-F6PIXTHZ.js";
+import "./chunk-NMG76472.js";
 import "./chunk-HP43GLZ6.js";
 import "./chunk-ELE2C7L4.js";
 import "./chunk-WZQ4CPRG.js";
-import "./chunk-UEWGUOXB.js";
-import "./chunk-7SVGVGE3.js";
-import "./chunk-4NYQAS33.js";
-import "./chunk-GUDCQBRY.js";
+import "./chunk-DU4ZN7VF.js";
 import "./chunk-6BFIFI5F.js";
-import "./chunk-ZHJNMC4W.js";
-import "./chunk-KNS5ETKF.js";
-import "./chunk-IG5XFUYJ.js";
-import "./chunk-X2IMCCM5.js";
+import "./chunk-55LEDLDE.js";
+import "./chunk-5UCBVXKO.js";
+import "./chunk-4NYQAS33.js";
+import "./chunk-GLVF7ENO.js";
+import "./chunk-VA42PIIY.js";
+import "./chunk-FZ23OZL3.js";
 import "./chunk-KFQGP6VL.js";
 
 // src/lib/task-enforcement.ts

package/dist/{task-scope-RMJLXJ7S.js → task-scope-EY3G5623.js}

@@ -3,7 +3,7 @@ import {
   init_task_scope,
   sessionScopeFilter,
   strictSessionScopeFilter
-} from "./chunk-YWCPAQBH.js";
+} from "./chunk-Y3JNBCZI.js";
 import "./chunk-2OG5NAO2.js";
 import "./chunk-NEAHEC5G.js";
 import "./chunk-KRLOFIPI.js";
@@ -11,21 +11,20 @@ import "./chunk-57HCNSFO.js";
 import "./chunk-MBRLA4E3.js";
 import "./chunk-DC4ZD76Y.js";
 import "./chunk-PJHHFJAN.js";
-import "./chunk-HHV26QTD.js";
+import "./chunk-SOHGHGWU.js";
 import "./chunk-JT76KRZQ.js";
-import "./chunk-F6PIXTHZ.js";
+import "./chunk-NMG76472.js";
 import "./chunk-HP43GLZ6.js";
 import "./chunk-ELE2C7L4.js";
 import "./chunk-WZQ4CPRG.js";
-import "./chunk-UEWGUOXB.js";
-import "./chunk-7SVGVGE3.js";
-import "./chunk-4NYQAS33.js";
-import "./chunk-GUDCQBRY.js";
+import "./chunk-DU4ZN7VF.js";
 import "./chunk-6BFIFI5F.js";
-import "./chunk-ZHJNMC4W.js";
-import "./chunk-KNS5ETKF.js";
-import "./chunk-IG5XFUYJ.js";
-import "./chunk-X2IMCCM5.js";
+import "./chunk-55LEDLDE.js";
+import "./chunk-5UCBVXKO.js";
+import "./chunk-4NYQAS33.js";
+import "./chunk-GLVF7ENO.js";
+import "./chunk-VA42PIIY.js";
+import "./chunk-FZ23OZL3.js";
 import "./chunk-KFQGP6VL.js";
 init_task_scope();
 export {

package/dist/{tasks-crud-ZRXPR3UB.js → tasks-crud-FPWY4RZ2.js}

@@ -13,7 +13,7 @@ import {
   slugify,
   updateTaskStatus,
   writeCheckpoint
-} from "./chunk-YWCPAQBH.js";
+} from "./chunk-Y3JNBCZI.js";
 import "./chunk-2OG5NAO2.js";
 import "./chunk-NEAHEC5G.js";
 import "./chunk-KRLOFIPI.js";
@@ -21,21 +21,20 @@ import "./chunk-57HCNSFO.js";
 import "./chunk-MBRLA4E3.js";
 import "./chunk-DC4ZD76Y.js";
 import "./chunk-PJHHFJAN.js";
-import "./chunk-HHV26QTD.js";
+import "./chunk-SOHGHGWU.js";
 import "./chunk-JT76KRZQ.js";
-import "./chunk-F6PIXTHZ.js";
+import "./chunk-NMG76472.js";
 import "./chunk-HP43GLZ6.js";
 import "./chunk-ELE2C7L4.js";
 import "./chunk-WZQ4CPRG.js";
-import "./chunk-UEWGUOXB.js";
-import "./chunk-7SVGVGE3.js";
-import "./chunk-4NYQAS33.js";
-import "./chunk-GUDCQBRY.js";
+import "./chunk-DU4ZN7VF.js";
 import "./chunk-6BFIFI5F.js";
-import "./chunk-ZHJNMC4W.js";
-import "./chunk-KNS5ETKF.js";
-import "./chunk-IG5XFUYJ.js";
-import "./chunk-X2IMCCM5.js";
+import "./chunk-55LEDLDE.js";
+import "./chunk-5UCBVXKO.js";
+import "./chunk-4NYQAS33.js";
+import "./chunk-GLVF7ENO.js";
+import "./chunk-VA42PIIY.js";
+import "./chunk-FZ23OZL3.js";
 import "./chunk-KFQGP6VL.js";
 init_tasks_crud();
 export {

package/dist/{tasks-review-NQUJR52I.js → tasks-review-XDSW3WRG.js}

@@ -9,7 +9,7 @@ import {
   init_tasks_review,
   isStale,
   listPendingReviews
-} from "./chunk-YWCPAQBH.js";
+} from "./chunk-Y3JNBCZI.js";
 import "./chunk-2OG5NAO2.js";
 import "./chunk-NEAHEC5G.js";
 import "./chunk-KRLOFIPI.js";
@@ -17,21 +17,20 @@ import "./chunk-57HCNSFO.js";
 import "./chunk-MBRLA4E3.js";
 import "./chunk-DC4ZD76Y.js";
 import "./chunk-PJHHFJAN.js";
-import "./chunk-HHV26QTD.js";
+import "./chunk-SOHGHGWU.js";
 import "./chunk-JT76KRZQ.js";
-import "./chunk-F6PIXTHZ.js";
+import "./chunk-NMG76472.js";
 import "./chunk-HP43GLZ6.js";
 import "./chunk-ELE2C7L4.js";
 import "./chunk-WZQ4CPRG.js";
-import "./chunk-UEWGUOXB.js";
-import "./chunk-7SVGVGE3.js";
-import "./chunk-4NYQAS33.js";
-import "./chunk-GUDCQBRY.js";
+import "./chunk-DU4ZN7VF.js";
 import "./chunk-6BFIFI5F.js";
-import "./chunk-ZHJNMC4W.js";
-import "./chunk-KNS5ETKF.js";
-import "./chunk-IG5XFUYJ.js";
-import "./chunk-X2IMCCM5.js";
+import "./chunk-55LEDLDE.js";
+import "./chunk-5UCBVXKO.js";
+import "./chunk-4NYQAS33.js";
+import "./chunk-GLVF7ENO.js";
+import "./chunk-VA42PIIY.js";
+import "./chunk-FZ23OZL3.js";
 import "./chunk-KFQGP6VL.js";
 init_tasks_review();
 export {

package/dist/{tool-capability-index-6EKGND6H.js → tool-capability-index-7OF3LF4X.js}

@@ -1,7 +1,7 @@
 import {
   ToolCapabilityIndex,
   getToolCapabilityIndex
-} from "./chunk-3RNNTTBH.js";
+} from "./chunk-267IKUT5.js";
 import "./chunk-4NYQAS33.js";
 import "./chunk-KFQGP6VL.js";
 export {

package/dist/{tool-telemetry-4C6LTIPM.js → tool-telemetry-QPGPBV5R.js}

@@ -4,7 +4,7 @@ import {
   startToolTelemetryFlush,
   stopToolTelemetryFlush,
   wrapServerWithTelemetry
-} from "./chunk-GLGWGMPD.js";
+} from "./chunk-XIIVMIS4.js";
 import "./chunk-KFQGP6VL.js";
 export {
   getToolUsageStats,

package/dist/tui/App.js

@@ -1,13 +1,13 @@
 #!/usr/bin/env node
 import {
   getSessionPrompt
-} from "../chunk-SQLEKC4E.js";
-import "../chunk-D7BPHQGX.js";
-import "../chunk-DMFM77DV.js";
+} from "../chunk-6EZRMPDA.js";
+import "../chunk-GOCW7Z6D.js";
+import "../chunk-WZDI6UJ6.js";
 import {
   init_task_scope,
   sessionScopeFilter
-} from "../chunk-YWCPAQBH.js";
+} from "../chunk-Y3JNBCZI.js";
 import "../chunk-2OG5NAO2.js";
 import "../chunk-NEAHEC5G.js";
 import "../chunk-KRLOFIPI.js";
@@ -15,28 +15,27 @@ import "../chunk-57HCNSFO.js";
 import "../chunk-MBRLA4E3.js";
 import "../chunk-DC4ZD76Y.js";
 import "../chunk-PJHHFJAN.js";
-import "../chunk-HHV26QTD.js";
+import "../chunk-SOHGHGWU.js";
 import "../chunk-JT76KRZQ.js";
-import "../chunk-F6PIXTHZ.js";
+import "../chunk-NMG76472.js";
 import "../chunk-HP43GLZ6.js";
 import "../chunk-ELE2C7L4.js";
 import {
   init_state_bus,
   orgBus
 } from "../chunk-WZQ4CPRG.js";
-import "../chunk-UEWGUOXB.js";
-import "../chunk-7SVGVGE3.js";
-import "../chunk-4NYQAS33.js";
-import "../chunk-GUDCQBRY.js";
+import "../chunk-DU4ZN7VF.js";
 import "../chunk-6BFIFI5F.js";
 import {
   DEFAULT_COORDINATOR_TEMPLATE_NAME,
   init_employees,
   isCoordinatorName
-} from "../chunk-ZHJNMC4W.js";
-import "../chunk-KNS5ETKF.js";
-import "../chunk-IG5XFUYJ.js";
-import "../chunk-X2IMCCM5.js";
+} from "../chunk-55LEDLDE.js";
+import "../chunk-5UCBVXKO.js";
+import "../chunk-4NYQAS33.js";
+import "../chunk-GLVF7ENO.js";
+import "../chunk-VA42PIIY.js";
+import "../chunk-FZ23OZL3.js";
 import {
   __require
 } from "../chunk-KFQGP6VL.js";
@@ -7400,7 +7399,7 @@ function useOrchestrator(enabled = true) {
     let cancelled = false;
     async function init() {
       try {
-        const { MultiAgentOrchestrator } = await import("../orchestrator-V3EMR3AU.js");
+        const { MultiAgentOrchestrator } = await import("../orchestrator-6ULAKZQP.js");
         const { getCoordinatorName, isCoordinatorRole, loadEmployees } = await import("../lib/employees.js");
         const { isExeSession } = await import("../lib/tmux-routing.js");
         const { listTmuxSessions, inTmux } = await import("../lib/tmux-status.js");
@@ -7441,7 +7440,7 @@ function useOrchestrator(enabled = true) {
         setTotalInProgress(health.totalInProgress);
         try {
           const { getClient } = await import("../lib/database.js");
-          const { sessionScopeFilter: sessionScopeFilter2 } = await import("../task-scope-RMJLXJ7S.js");
+          const { sessionScopeFilter: sessionScopeFilter2 } = await import("../task-scope-EY3G5623.js");
           const client = getClient();
           const uoScope = sessionScopeFilter2();
           const result = await client.execute({
@@ -7473,7 +7472,7 @@ function useOrchestrator(enabled = true) {
   const spawnSession = useCallback5(
     async (agentId) => {
       try {
-        const { createTaskCore } = await import("../tasks-crud-ZRXPR3UB.js");
+        const { createTaskCore } = await import("../tasks-crud-FPWY4RZ2.js");
         const { ensureEmployee } = await import("../lib/tmux-routing.js");
         const { getCoordinatorName } = await import("../lib/employees.js");
         await createTaskCore({
@@ -8096,7 +8095,7 @@ function TasksView({ onBack }) {
     const { withTrace } = await import("../telemetry-SPVGPKU7.js");
     return withTrace("tui.tasks.loadTasks", async () => {
       try {
-        const { loadTaskList } = await import("../tui-data-A4GTAXBL.js");
+        const { loadTaskList } = await import("../tui-data-FQ2F5WA3.js");
         const tasks = await loadTaskList();
         setAllTasks(
           tasks.map((task) => ({
@@ -8576,7 +8575,7 @@ function GatewayView({ onBack }) {
     setLoading(false);
     if (!state.gatewayUrl) return;
     try {
-      const { connectGateway } = await import("../gateway-client-VFKE2WJX.js");
+      const { connectGateway } = await import("../gateway-client-CJNSI4GG.js");
       const client = await connectGateway(state.gatewayUrl);
       if (!client) return;
       clientRef.current = client;
@@ -8929,7 +8928,7 @@ function TeamView({ onBack, onViewSessions }) {
         let projectsByEmployee = /* @__PURE__ */ new Map();
         let currentTaskByEmployee = /* @__PURE__ */ new Map();
         try {
-          const { loadTeamBadgeCounts, loadTeamDetailMetrics } = await import("../tui-data-A4GTAXBL.js");
+          const { loadTeamBadgeCounts, loadTeamDetailMetrics } = await import("../tui-data-FQ2F5WA3.js");
           setBadgeInFlight(true);
           const badgeCountsPromise = loadTeamBadgeCounts();
           const detailsPromise = loadTeamDetailMetrics(roster.map((emp) => emp.name));
@@ -9209,7 +9208,7 @@ function WikiView({ onBack }) {
   }, []);
   async function loadWiki() {
     try {
-      const { createWikiClient, listWorkspaces: fetchWorkspaces } = await import("../wiki-client-UFR4R7YH.js");
+      const { createWikiClient, listWorkspaces: fetchWorkspaces } = await import("../wiki-client-NGWOSMCV.js");
       const client = await createWikiClient();
       if (!client) {
         setConnected(false);
@@ -9229,7 +9228,7 @@ function WikiView({ onBack }) {
   }
   async function loadDocuments(client, workspaceSlug) {
     try {
-      const { listDocuments: fetchDocuments } = await import("../wiki-client-UFR4R7YH.js");
+      const { listDocuments: fetchDocuments } = await import("../wiki-client-NGWOSMCV.js");
       const docs = await fetchDocuments(client, workspaceSlug);
       setDocuments(docs.map((d) => ({
         filename: d.filename,
@@ -9243,7 +9242,7 @@ function WikiView({ onBack }) {
   }
   async function loadChatHistory(client, workspaceSlug) {
     try {
-      const { getChatHistory: fetchHistory } = await import("../wiki-client-UFR4R7YH.js");
+      const { getChatHistory: fetchHistory } = await import("../wiki-client-NGWOSMCV.js");
       const history = await fetchHistory(client, workspaceSlug);
       setChatHistory(history);
     } catch {
@@ -9258,7 +9257,7 @@ function WikiView({ onBack }) {
     setChatInput("");
     setSending(true);
     try {
-      const { createWikiClient, chatInWorkspace } = await import("../wiki-client-UFR4R7YH.js");
+      const { createWikiClient, chatInWorkspace } = await import("../wiki-client-NGWOSMCV.js");
       const client = await createWikiClient();
       if (!client) {
         setChatHistory((prev) => [
@@ -9295,7 +9294,7 @@ function WikiView({ onBack }) {
     }
     setSearchLoading(true);
     try {
-      const { searchWikiMemoryRows } = await import("../tui-data-A4GTAXBL.js");
+      const { searchWikiMemoryRows } = await import("../tui-data-FQ2F5WA3.js");
       setSearchResults(await searchWikiMemoryRows(query));
     } catch {
       setSearchResults([]);
@@ -9325,7 +9324,7 @@ function WikiView({ onBack }) {
       return;
     }
     try {
-      const { createWikiClient } = await import("../wiki-client-UFR4R7YH.js");
+      const { createWikiClient } = await import("../wiki-client-NGWOSMCV.js");
       const client = await createWikiClient();
       if (!client) return;
       await loadDocuments(client, ws.slug);

package/dist/{tui-data-A4GTAXBL.js → tui-data-FQ2F5WA3.js}

@@ -1,7 +1,7 @@
 import {
   init_task_scope,
   sessionScopeFilter
-} from "./chunk-YWCPAQBH.js";
+} from "./chunk-Y3JNBCZI.js";
 import "./chunk-2OG5NAO2.js";
 import "./chunk-NEAHEC5G.js";
 import "./chunk-KRLOFIPI.js";
@@ -9,24 +9,23 @@ import "./chunk-57HCNSFO.js";
 import "./chunk-MBRLA4E3.js";
 import "./chunk-DC4ZD76Y.js";
 import "./chunk-PJHHFJAN.js";
-import "./chunk-HHV26QTD.js";
+import "./chunk-SOHGHGWU.js";
 import "./chunk-JT76KRZQ.js";
-import "./chunk-F6PIXTHZ.js";
+import "./chunk-NMG76472.js";
 import "./chunk-HP43GLZ6.js";
 import "./chunk-ELE2C7L4.js";
 import "./chunk-WZQ4CPRG.js";
+import "./chunk-DU4ZN7VF.js";
+import "./chunk-6BFIFI5F.js";
 import {
   getClient,
   init_database
-} from "./chunk-UEWGUOXB.js";
-import "./chunk-7SVGVGE3.js";
+} from "./chunk-55LEDLDE.js";
+import "./chunk-5UCBVXKO.js";
 import "./chunk-4NYQAS33.js";
-import "./chunk-GUDCQBRY.js";
-import "./chunk-6BFIFI5F.js";
-import "./chunk-ZHJNMC4W.js";
-import "./chunk-KNS5ETKF.js";
-import "./chunk-IG5XFUYJ.js";
-import "./chunk-X2IMCCM5.js";
+import "./chunk-GLVF7ENO.js";
+import "./chunk-VA42PIIY.js";
+import "./chunk-FZ23OZL3.js";
 import "./chunk-KFQGP6VL.js";
 
 // src/lib/tui-data.ts

package/dist/{worker-gate-H43H32OF.js → worker-gate-WM2RGEZE.js}

@@ -5,9 +5,9 @@ import {
   releaseBackfillLock,
   tryAcquireBackfillLock,
   tryAcquireWorkerSlot
-} from "./chunk-VTZ4QOBS.js";
-import "./chunk-IG5XFUYJ.js";
-import "./chunk-X2IMCCM5.js";
+} from "./chunk-CQX2WDI5.js";
+import "./chunk-VA42PIIY.js";
+import "./chunk-FZ23OZL3.js";
 import "./chunk-KFQGP6VL.js";
 export {
   MAX_CONCURRENT_WORKERS,

package/dist/{workflow-engine-EPWKDGHR.js → workflow-engine-6QPTYDQI.js}

@@ -10,8 +10,8 @@ import {
   persistWorkflows,
   runWorkflow,
   startWorkflow
-} from "./chunk-5PB6BRLA.js";
-import "./chunk-VEGDNUBO.js";
+} from "./chunk-QWOQHCRO.js";
+import "./chunk-T7SJCDG3.js";
 import "./chunk-KFQGP6VL.js";
 export {
   advanceWorkflow,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@askexenow/exe-os",
-  "version": "0.9.140",
+  "version": "0.9.141",
   "description": "AI employee operating system — persistent memory, task management, and multi-agent coordination for Claude Code.",
   "license": "SEE LICENSE IN LICENSE",
   "type": "module",

package/release-notes.json

@@ -1,6 +1,109 @@
 {
-  "current": "0.9.140",
+  "current": "0.9.141",
   "notes": {
+    "0.9.141": {
+      "version": "0.9.141",
+      "date": "2026-05-26",
+      "features": [
+        "entity type hierarchy — subtypes with rollup queries (PG-2)",
+        "temporal validity windows for graph queries (PG-3)",
+        "backup restore CLI + restoreBackup function",
+        "ESLint setup + dependency hygiene + any type reduction",
+        "config(action=\"hire\") MCP tool — COO can hire employees directly",
+        "GM (General Manager) role template + hiring guidance",
+        "merge gate warning in close_task — catches unmerged PRs",
+        "behavior hygiene — platform procedure + COO identity + company procedure",
+        "MCP auto-reconnect to daemon — survives deploy restarts transparently",
+        "event-driven notifications — stop polling managers, let task state drive everything",
+        "MCP disconnect tracker + daemon observability",
+        "MCP lifecycle logging to file — FULL transparency on every disconnect",
+        "automatic P0 bug fixing — daemon auto-dispatch + GitHub Actions fallback",
+        "enforce worktrees for engineer sessions — prevent direct main commits",
+        "multi-device coordination — routing, handoff, device status",
+        "hook tamper protection — SHA-256 manifest + verification before spawn",
+        "governed collaborative memory — visibility tags + write governance",
+        "cache-sharing protocol — pub/sub memory bus for inter-agent sharing",
+        "multi-modal memory — media attachments on memories",
+        "comprehensive \"last 20%\" integration tests + audit_trail read path",
+        "wire memory poisoning defense into writeMemory() pipeline",
+        "memory poisoning defense — trust levels, anomaly detection, quarantine",
+        "VPS Phase 4 — media→R2 bridge + cross-product queries + migration CLI",
+        "Palantir typed ontology — schema, validation, temporal edges",
+        "R2 media storage client — shared upload/download for all products"
+      ],
+      "fixes": [
+        "stale task escalation — surface alive-but-stalled agents to COO",
+        "cloud sync upsert + entity type hierarchy + temporal validity + file_copy security",
+        "daemon memory leak + duplicate watchdog + HTTP body limit + WAL flush",
+        "heap pressure alarm was false positive — compared heapUsed/heapTotal instead of heapUsed/heapLimit",
+        "strengthen scoped SQL audit — cover UPDATE/INSERT, expand exemptions",
+        "hard block tmux send-keys for non-coordinator agents",
+        "MCP disconnect procedure — explicitly block tmux send-keys workaround",
+        "file_copy MCP tool — path boundary enforcement + symlink traversal block",
+        "cloud sync task pull uses ON CONFLICT upsert with updated_at guard",
+        "multi-instance Tom dispatch — create_task fans out to tom2, tom3",
+        "atomic writes for agent-config.json, roster (orchestration + rename)",
+        "atomic JSON writes + config.json corruption recovery",
+        "boot poll timeout no longer fails dispatch — session exists, task pending",
+        "master key clobber guard + COO naming in user-facing strings",
+        "MCP port retry + instant embed skip when OOM marker set",
+        "install.ts uses spawn lock + SIGTERM grace + restart cooldown",
+        "daemon restart hardening — OOM guard + 60s cooldown + health check guard",
+        "stop daemon crash loop — embed client no longer kills daemon when OOM marker set",
+        "support endpoints askexe.com → cloud.askexe.com (bypass CF WAF)",
+        "reduce any types 68→52, typed adapter factories + HTTP responses",
+        "pg pool limits, queue overflow health log, any reduction 71→68",
+        "reduce any types 81→71, tighten lint budget to 72",
+        "/exe-afk detects non-tmux sessions, suggests /loop instead",
+        "cross-repo boundary — platform procedure + pre-tool-use guard",
+        "UNIQUE dedup index + dependency hygiene + ESM import fix"
+      ],
+      "security": [
+        "fix shell injection, SSRF, socket leaks, backup validation",
+        "bump v0.9.139 — 2 CRITICAL security fixes, 14 bug fixes, 6 features, customer config preservation",
+        "fix 2 CRITICAL + 1 HIGH from post-fix audit",
+        "validate X-Agent-Role against roster — prevent privilege escalation",
+        "release: stack v0.9.8 — security hardening + Hygo bug fixes",
+        "add webhook HMAC-SHA256 validation + disable query param auth in prod",
+        "pin GitHub Actions to SHAs, update jose to 6.2.3",
+        "harden support intake against abuse and data leakage",
+        "bump to v0.9.22 — Codex MCP parity + customer bug fixes + security audit remediation",
+        "audit: pre-hygo exe-gateway security report",
+        "add SECURITY.md — trust document for pre-install security evaluation",
+        "fix 4 pricing tier bypass vulnerabilities (audit F1-F4)"
+      ],
+      "other": [
+        "ops: journalctl rotation + certbot expiry alerting",
+        "revert: daemon heap back to 33% of RAM — no artificial cap",
+        "v0.9.140 publish + heap cap 4GB (was 33% unbounded)",
+        "PG-1 cross-repo entity federation design document",
+        "add lint step + automated npm publish workflow",
+        "audit: scoped SQL + package budget + TUI vendored + TODO classification",
+        "add full readiness audit evidence",
+        "roadmap: Cross-Repo Ontology — Palantir-level graph (PG-1 through PG-10)",
+        "capture mcp restart self-healing roadmap",
+        "Enforce chain of command task review parity",
+        "document raw SQL fallback in orchestrator auto-approve path",
+        "Finalize orchestration rollout fixes",
+        "Scope device governance task queries",
+        "bump v0.9.138 — 7 critical bug fixes, 10 features, 16 commits",
+        "bump v0.9.137 — Memanto typed schema, push notifications, lazy consolidation",
+        "bump v0.9.136 — daemon OOM fix, process monitor, auto-notify reviewer",
+        "bump v0.9.135 — code debt cleanup, 28 new tests, full observability",
+        "Codex MCP regression tests (18) + DB singleton integration tests (10)",
+        "release notes for v0.9.134",
+        "benchmark score entry for f95b862",
+        "add GitHub Actions CI pipeline — build + test on push",
+        "gitignore GitHub workflows — add via web UI instead",
+        "remove ci.yml — GitHub token lacks workflow scope, will add via web UI",
+        "gitignore — add dist-next, db.sqlite, .wrangler; remove temp scripts",
+        "accumulated fixes — hooks, adapters, config, cloud-sync, rate-limiter, CI pipeline"
+      ],
+      "migration_notes": [
+        "If daemon goes down, agents will now fail instead of silently",
+        "exe-daemon.ts kills old embed.pid process and cleans up"
+      ]
+    },
     "0.9.140": {
       "version": "0.9.140",
       "date": "2026-05-26",
@@ -404,105 +507,6 @@
         "If daemon goes down, agents will now fail instead of silently",
         "exe-daemon.ts kills old embed.pid process and cleans up"
       ]
-    },
-    "0.9.136": {
-      "version": "0.9.136",
-      "date": "2026-05-21",
-      "features": [
-        "push notifications — Telegram + email on task completion and daemon crash",
-        "auto-notify reviewer on task completion + file_copy MCP tool",
-        "daemon process monitor — CPU tracking, orphan detection, high-CPU alerting",
-        "Hygo integration — workflow engine, Asana connector, wiki ACL, GoTrue auth, unified query",
-        "routing audit log + daemon health log — full observability for session routing and daemon lifecycle",
-        "proxy unified cloud routes through api router",
-        "add typed apiWatchdog config for daemon API auto-recovery",
-        "wire reflection layer into production — schema, search, daemon",
-        "wire memory cards + reflection into BEAM benchmark harness",
-        "standalone harnesses for MemBench, REALTALK, MemoryArena",
-        "standalone benchmark harnesses for LongMemEval, LoCoMo, BEAM",
-        "multi-product support for bug reports and feature requests",
-        "memory reflection layer + sandboxed BEAM benchmark harness",
-        "P2 feature batch — orchestration, retrieval, conflict resolution",
-        "P1 feature batch — 8 memory & orchestration improvements",
-        "separate badge from detail fetch pipeline with badgeInFlight flag",
-        "per-agent MCP scoping via set_agent_config",
-        "flip MCP default to consolidated (19 tools) — legacy deprecated",
-        "behavior audit trail — created_by, device_id, session tracking",
-        "detailed filing steps for bugs + feature requests in platform procedures",
-        "document five layers — when to use platform/company/identity/behavior/memory",
-        "customer-facing support procedures — file bugs, check status, get fixes",
-        "add update lifecycle + first install procedures to platform procedures",
-        "add bug fix triage procedure — close upstream reports so customers see status",
-        "add review chain procedure — managers must actively pull, never wait"
-      ],
-      "fixes": [
-        "daemon OOM crash — cloud-sync exponential backoff + circuit breaker + heap monitoring",
-        "replace hardcoded agent name→role map with dynamic roster lookup",
-        "add logging to 45 silent catches — tasks.ts, cloud-sync.ts, exe-daemon.ts",
-        "test regressions — backward-compat exports, test fixture schema, config defaults",
-        "upgrade commit discipline to p0 — one track = one commit, never batch",
-        "use consolidated mcp boot prompt",
-        "auto-start agents after spawn — no more idle prompt",
-        "move atomic swap from build to deploy — builds never disrupt daemon",
-        "disable MCP session TTL — sessions live forever until daemon restart",
-        "complete DB safety suite — auto-restore, write drain, pre-restart backup",
-        "WAL checkpoint on shutdown + integrity check on startup",
-        "warn when caller session unknown in create_task — helps diagnose scope bugs",
-        "route all employee spawns through exe-launch-agent for session-aware MCP",
-        "4 customer audit bugs — honest feature status, auto-approve disabled, visibility TODO",
-        "archive consolidated source memories — stop search inflation",
-        "wire Ebbinghaus strength into vector search + type definition",
-        "v0.9.133 — session routing, Codex MCP compat, 12 bug fixes from customer audit",
-        "bind api router analytics dataset in wrangler",
-        "daemon watchdog uses typed config, wire startup call, fix tsc warnings",
-        "tasks-crud session isolation uses ALS instead of stale process.env",
-        "license gate re-checks key file if missing at boot — prevents permanent lockout after npm update",
-        "enable lean MCP for all spawned agent sessions — prevents OAuth browser popups",
-        "hard session isolation gate in create_task — reject cross-scope dispatch",
-        "code quality audit — DB singleton test + silent catch logging",
-        "enable tsup splitting — shared DB module eliminates \"client not initialized\" after daemon restart"
-      ],
-      "security": [
-        "release: stack v0.9.8 — security hardening + Hygo bug fixes",
-        "add webhook HMAC-SHA256 validation + disable query param auth in prod",
-        "pin GitHub Actions to SHAs, update jose to 6.2.3",
-        "harden support intake against abuse and data leakage",
-        "bump to v0.9.22 — Codex MCP parity + customer bug fixes + security audit remediation",
-        "audit: pre-hygo exe-gateway security report",
-        "add SECURITY.md — trust document for pre-install security evaluation",
-        "fix 4 pricing tier bypass vulnerabilities (audit F1-F4)"
-      ],
-      "other": [
-        "bump v0.9.136 — daemon OOM fix, process monitor, auto-notify reviewer",
-        "bump v0.9.135 — code debt cleanup, 28 new tests, full observability",
-        "Codex MCP regression tests (18) + DB singleton integration tests (10)",
-        "release notes for v0.9.134",
-        "benchmark score entry for f95b862",
-        "add GitHub Actions CI pipeline — build + test on push",
-        "gitignore GitHub workflows — add via web UI instead",
-        "remove ci.yml — GitHub token lacks workflow scope, will add via web UI",
-        "gitignore — add dist-next, db.sqlite, .wrangler; remove temp scripts",
-        "accumulated fixes — hooks, adapters, config, cloud-sync, rate-limiter, CI pipeline",
-        "stack manifest v0.9.9 — session routing, DB safety, Codex MCP, 20 fixes",
-        "protect api router cloud migration routes",
-        "Proxy cloud sync routes through api router",
-        "bump v0.9.132",
-        "bump v0.9.131 — lean MCP for agents, session isolation gate, card/reflection pipeline",
-        "bump v0.9.130 — hard session isolation gate",
-        "bump v0.9.129",
-        "bump v0.9.128 — shared DB module fix",
-        "bump v0.9.127 — DB init before MCP session tools",
-        "bump v0.9.126 — revert to port 48739",
-        "bump v0.9.125",
-        "bump v0.9.120 — fixed MCP port 48700 with auto-recovery",
-        "bump v0.9.123 — multi-product support for bug/feature reports",
-        "rewrite runtime architecture — exe-os is Mode 1 stopgap, exe-build is the product",
-        "bump v0.9.122 — publish gate for dynamic imports + all Yoda fixes"
-      ],
-      "migration_notes": [
-        "If daemon goes down, agents will now fail instead of silently",
-        "exe-daemon.ts kills old embed.pid process and cleans up"
-      ]
     }
   }
 }