@askexenow/exe-os 0.9.140 → 0.9.141

package/dist/{chunk-5K3CCPNX.js → chunk-CXXGHL7T.js}

@@ -1,19 +1,19 @@
 import {
   getToolUsageStats
-} from "./chunk-GLGWGMPD.js";
+} from "./chunk-XIIVMIS4.js";
 import {
   AUTO_WAKE_MAX_RETRIES
-} from "./chunk-UE3BYGWY.js";
+} from "./chunk-47D4UN72.js";
 import {
   getToolCapabilityIndex
-} from "./chunk-3RNNTTBH.js";
+} from "./chunk-267IKUT5.js";
 import {
   getCachedLicenseGate
-} from "./chunk-7HZFWAIR.js";
+} from "./chunk-DH6N5G4T.js";
 import {
   isRerankerAvailable,
   rerankWithScores
-} from "./chunk-H24OVCAN.js";
+} from "./chunk-AJOZXJLJ.js";
 import {
   getEntityByName,
   getEntityNeighbors,
@@ -21,14 +21,14 @@ import {
   getHotEntities,
   getRelationships,
   searchEntities
-} from "./chunk-6LKDJ5WX.js";
+} from "./chunk-XOVQ43JR.js";
 import {
   isToolAllowed,
   isToolAllowedForPlan
 } from "./chunk-E6ORBQHP.js";
 import {
   listRecentSessionEvents
-} from "./chunk-ABCDEJUD.js";
+} from "./chunk-BBOD5TVX.js";
 import {
   analyzeBlastRadius,
   buildCodeContextIndex,
@@ -37,68 +37,68 @@ import {
   searchCodeContext,
   searchCodeContextSemantic,
   traceCodeSymbol
-} from "./chunk-BZHXUKVC.js";
+} from "./chunk-U3Q3WNGY.js";
 import {
   runDriftProbes
-} from "./chunk-4YNGDNDI.js";
+} from "./chunk-7M3DNYMR.js";
 import {
   exportOrchestration,
   importOrchestration,
   validatePackage
-} from "./chunk-NX4WEVG6.js";
+} from "./chunk-Q53ZYTIU.js";
 import {
   loadOrchestrationPhase,
   setOrchestrationPhase
-} from "./chunk-KNEH2MGD.js";
+} from "./chunk-GIGLGGYL.js";
 import {
   createOrRefreshResumeTask,
   init_capacity_monitor
-} from "./chunk-34O6PRWE.js";
+} from "./chunk-GVGISFMN.js";
 import {
   registerCompleteReminder
-} from "./chunk-RGKPVKUO.js";
+} from "./chunk-LGPTAJZC.js";
 import {
   registerDeactivateBehavior
-} from "./chunk-PS4UUDIG.js";
+} from "./chunk-DUDPJVAC.js";
 import {
   registerSendMessage
-} from "./chunk-6EBG7VWN.js";
+} from "./chunk-ENL5P2CU.js";
 import {
   registerCreateTask
-} from "./chunk-2JAEWE7P.js";
+} from "./chunk-NTALKXBR.js";
 import {
   registerListTasks
-} from "./chunk-5LJQSXUG.js";
+} from "./chunk-P3RKVFBX.js";
 import {
   registerUpdateTask
-} from "./chunk-CLIW2CES.js";
+} from "./chunk-NW4AUWIT.js";
 import {
   registerCreateReminder
-} from "./chunk-35FFFDS2.js";
+} from "./chunk-6V6UTSOP.js";
 import {
   registerListReminders
-} from "./chunk-O2RVWP3S.js";
+} from "./chunk-TSPBIMZV.js";
 import {
   completeReminder,
   createReminder,
   listReminders
-} from "./chunk-3TTJPQAE.js";
+} from "./chunk-BKEJSHDE.js";
 import {
   status
-} from "./chunk-4ITOWLHX.js";
+} from "./chunk-UEJTDPRA.js";
 import {
   TOKENS_PER_IDLE_MINUTE,
   countKillsSince,
   init_session_kill_telemetry,
   sumTokensSavedSince
-} from "./chunk-QUG6EMZQ.js";
+} from "./chunk-EZUWMBWA.js";
 import {
   getAgentSpend
-} from "./chunk-2ZWYALO4.js";
+} from "./chunk-SFURTBMT.js";
 import {
   createSchedule,
   parseHumanCron
-} from "./chunk-OX6D5AF3.js";
+} from "./chunk-LNX37VPO.js";
 import {
   exportGraphHTML,
   generateGraphReport
@@ -106,53 +106,53 @@ import {
 import {
   entityId,
   mergeEntities
-} from "./chunk-YKOW7KMK.js";
+} from "./chunk-F4OU2ETP.js";
 import {
   formatReport,
   runAudit
-} from "./chunk-5WIEDLGY.js";
+} from "./chunk-S3FDCJNF.js";
 import {
   runHealthCheck
-} from "./chunk-SPMZRVXK.js";
+} from "./chunk-LCZRXRB7.js";
 import {
   hasFailures,
   runHealth,
   runTest
-} from "./chunk-Q3MIJPXM.js";
+} from "./chunk-EAVACBVO.js";
 import {
   findSimilarTrajectories,
   hashSignature,
   init_skill_learning
-} from "./chunk-UCNCSKGH.js";
+} from "./chunk-N5MH3CN2.js";
 import {
   deactivateBehavior,
   init_behaviors,
   listBehaviorsByDomain,
   storeBehavior
-} from "./chunk-QCJ3Y52V.js";
+} from "./chunk-NFX6MDEO.js";
 import {
   countUnconsolidated,
   groupMemories,
   runConsolidation,
   selectUnconsolidated
-} from "./chunk-Z6BTUUPK.js";
+} from "./chunk-U7M7ZURS.js";
 import {
   renderClientCOOTemplate
-} from "./chunk-SQLEKC4E.js";
+} from "./chunk-6EZRMPDA.js";
 import {
   deactivateGlobalProcedure,
   loadGlobalProcedures,
   storeGlobalProcedure
-} from "./chunk-D7BPHQGX.js";
+} from "./chunk-GOCW7Z6D.js";
 import {
   PLATFORM_PROCEDURES
-} from "./chunk-DMFM77DV.js";
+} from "./chunk-WZDI6UJ6.js";
 import {
   clearCloudReuploadRequired,
   cloudSync,
   getCloudReuploadRequired,
   markCloudReuploadRequired
-} from "./chunk-UOCQQHZT.js";
+} from "./chunk-IBWVMMLN.js";
 import {
   crypto_exports,
   init_crypto
@@ -163,27 +163,22 @@ import {
 import {
   embed,
   init_embedder
-} from "./chunk-CSVYC6HH.js";
+} from "./chunk-4OHIVMHS.js";
 import {
   readMcpHttpEvents,
   summarizeMcpTransport,
   writeMcpTransportSummary
-} from "./chunk-LUOLBU54.js";
+} from "./chunk-NMT6QFEE.js";
 import {
   init_tasks,
   updateTask
-} from "./chunk-CYCRC2KN.js";
+} from "./chunk-RGKFUMLQ.js";
 import {
   fastDbInit
-} from "./chunk-ELXPFTBJ.js";
-import {
-  getIdentity,
-  listIdentities,
-  updateIdentity
-} from "./chunk-MQV4UKTS.js";
+} from "./chunk-7A2YCQNM.js";
 import {
   MAX_CONCURRENT_WORKERS
-} from "./chunk-VTZ4QOBS.js";
+} from "./chunk-CQX2WDI5.js";
 import {
   getProjectName,
   init_project_name
@@ -191,10 +186,10 @@ import {
 import {
   hybridSearch,
   recentRecords
-} from "./chunk-OIUPHIN2.js";
+} from "./chunk-2NWMGMNH.js";
 import {
   getActiveAgent
-} from "./chunk-XDJWGR2S.js";
+} from "./chunk-CBSUVFZ7.js";
 import {
   attachDocumentMetadata,
   flushBatch,
@@ -202,7 +197,7 @@ import {
   reserveVersions,
   vectorToBlob,
   writeMemory
-} from "./chunk-IU3CXV4S.js";
+} from "./chunk-LR3QFARI.js";
 import {
   init_task_scope,
   init_tasks_crud,
@@ -214,7 +209,7 @@ import {
   tmux_routing_exports,
   updateTaskStatus,
   writeCheckpoint
-} from "./chunk-YWCPAQBH.js";
+} from "./chunk-Y3JNBCZI.js";
 import {
   init_session_registry,
   listSessions
@@ -227,7 +222,7 @@ import {
   init_agent_config,
   loadAgentConfig,
   setAgentRuntime
-} from "./chunk-HHV26QTD.js";
+} from "./chunk-SOHGHGWU.js";
 import {
   DEFAULT_RUNTIME,
   init_runtime_table
@@ -238,7 +233,7 @@ import {
   assertFeature,
   assertMemoryLimit,
   init_plan_limits
-} from "./chunk-F6PIXTHZ.js";
+} from "./chunk-NMG76472.js";
 import {
   getAccountByName,
   getDefaultAccount
@@ -247,30 +242,32 @@ import {
   createNewTrigger,
   isScheduledTrigger,
   loadTriggers
-} from "./chunk-VEGDNUBO.js";
+} from "./chunk-T7SJCDG3.js";
 import {
   pushConversationToCRM
 } from "./chunk-GCNWCYJI.js";
-import {
-  getClient,
-  init_database
-} from "./chunk-UEWGUOXB.js";
 import {
   EMPLOYEES_PATH,
   addEmployee,
   canCoordinate,
   employees_exports,
+  getClient,
   getEmployee,
+  getIdentity,
+  init_database,
   init_employees,
+  init_identity,
   isCoordinatorName,
   isCoordinatorRole,
+  listIdentities,
   loadEmployees,
   loadEmployeesSync,
-  saveEmployees
-} from "./chunk-ZHJNMC4W.js";
+  saveEmployees,
+  updateIdentity
+} from "./chunk-55LEDLDE.js";
 import {
   getMasterKey
-} from "./chunk-XUHFQHGZ.js";
+} from "./chunk-4JZNDVZH.js";
 import {
   checkForUpdate
 } from "./chunk-MZIGUUDQ.js";
@@ -284,12 +281,12 @@ import {
   readCachedLicenseToken,
   saveLicense,
   validateLicense
-} from "./chunk-KNS5ETKF.js";
+} from "./chunk-GLVF7ENO.js";
 import {
   EXE_AI_DIR,
   init_config,
   loadConfig
-} from "./chunk-IG5XFUYJ.js";
+} from "./chunk-VA42PIIY.js";
 import {
   __toCommonJS
 } from "./chunk-KFQGP6VL.js";
@@ -883,7 +880,7 @@ async function searchConversations(query, limit) {
 }
 async function searchWiki(query, limit) {
   try {
-    const { createWikiClient, chatInWorkspace, listWorkspaces } = await import("./wiki-client-UFR4R7YH.js");
+    const { createWikiClient, chatInWorkspace, listWorkspaces } = await import("./wiki-client-NGWOSMCV.js");
     const client = await createWikiClient();
     if (!client) return [];
     const workspaces = await listWorkspaces(client);
@@ -1428,7 +1425,7 @@ async function handleSupersede(input) {
   }
   try {
     const { getClient: getClient2 } = await import("./lib/database.js");
-    const { getActiveAgent: getActiveAgent2 } = await import("./active-agent-GFBVE3ES.js");
+    const { getActiveAgent: getActiveAgent2 } = await import("./active-agent-OTOFSYIV.js");
     const { writeMemory: writeMemory2, flushBatch: flushBatch2 } = await import("./lib/store.js");
     const { randomUUID: randomUUID2 } = await import("crypto");
     const client = getClient2();
@@ -1537,9 +1534,9 @@ function registerMemory(server) {
         return handleSupersede(input);
       }
       if (action === "core_get" || action === "core_set" || action === "core_delete") {
-        const { getActiveAgent: getActiveAgent2 } = await import("./active-agent-GFBVE3ES.js");
+        const { getActiveAgent: getActiveAgent2 } = await import("./active-agent-OTOFSYIV.js");
         const { agentId } = getActiveAgent2();
-        const { getCoreMemory, setCoreMemory, deleteCoreMemory, formatCoreMemoryBlock } = await import("./core-memory-JOTETVSY.js");
+        const { getCoreMemory, setCoreMemory, deleteCoreMemory, formatCoreMemoryBlock } = await import("./core-memory-N74JWH4M.js");
         if (action === "core_get") {
           const entries = await getCoreMemory(agentId);
           const block = formatCoreMemoryBlock(entries);
@@ -1618,10 +1615,11 @@ function registerQueryRelationships(server) {
         query: z11.string().optional().describe("What relationships to find (natural language)"),
         entity_name: z11.string().optional().describe("Specific entity to explore (for example an agent, project, or vendor name)"),
         relationship_type: z11.string().optional().describe("Filter by relationship type (e.g., 'implemented', 'depends_on', 'worked_on')"),
-        max_depth: z11.number().default(2).describe("How many hops to traverse (default: 2)")
+        max_depth: z11.number().default(2).describe("How many hops to traverse (default: 2)"),
+        as_of: z11.string().optional().describe("ISO 8601 timestamp for time-travel. Returns relationships valid at that point in time.")
       }
     },
-    async ({ query, entity_name, relationship_type, max_depth }) => {
+    async ({ query, entity_name, relationship_type, max_depth, as_of }) => {
       const client = getClient();
       if (entity_name) {
         const entity = await getEntityByName(client, entity_name);
@@ -1645,13 +1643,14 @@ ${matchList}`
           };
         }
         const rels = await getRelationships(client, entity.id, {
-          type: relationship_type
+          type: relationship_type,
+          asOf: as_of
         });
         if (rels.length === 0) {
           return {
             content: [{
               type: "text",
-              text: `Entity "${entity.name}" (${entity.type}) exists but has no recorded relationships.`
+              text: `Entity "${entity.name}" (${entity.type}) exists but has no recorded relationships${as_of ? ` as of ${as_of}` : ""}.`
             }]
           };
         }
@@ -1659,7 +1658,7 @@ ${matchList}`
           const confLabel = r.confidenceLabel && r.confidenceLabel !== "extracted" ? `[${r.confidenceLabel.toUpperCase()} ${r.confidence.toFixed(1)}] ` : "";
           return `- ${confLabel}${r.sourceName} \u2192[${r.type}]\u2192 ${r.targetName} (w: ${r.weight.toFixed(1)})`;
         });
-        const neighbors = await getEntityNeighbors(client, entity.id, max_depth);
+        const neighbors = await getEntityNeighbors(client, entity.id, max_depth, as_of);
         const neighborLine = neighbors.length > 1 ? `
 
 Connected entities (${max_depth} hops): ${neighbors.filter((n) => n.entity.id !== entity.id).map((n) => `${n.entity.name} (${n.entity.type})`).join(", ")}` : "";
@@ -1687,7 +1686,7 @@ ${relLines.join("\n")}${neighborLine}`
         }
         const results = [];
         for (const entity of matches.slice(0, 5)) {
-          const rels = await getRelationships(client, entity.id, { type: relationship_type });
+          const rels = await getRelationships(client, entity.id, { type: relationship_type, asOf: as_of });
           const relSummary = rels.length > 0 ? rels.slice(0, 3).map((r) => `  ${r.sourceName} \u2192[${r.type}]\u2192 ${r.targetName}`).join("\n") : "  (no relationships)";
           results.push(`### ${entity.name} (${entity.type})
 ${relSummary}`);
@@ -2077,7 +2076,7 @@ function registerResumeEmployee(server) {
         };
       }
       try {
-        const { isTmuxSessionAlive } = await import("./tasks-crud-ZRXPR3UB.js");
+        const { isTmuxSessionAlive } = await import("./tasks-crud-FPWY4RZ2.js");
         const now = (/* @__PURE__ */ new Date()).toISOString();
         for (const row of openTasks.rows) {
           const status2 = String(row.status);
@@ -2506,6 +2505,7 @@ ${lines.join("\n")}`
 import { z as z22 } from "zod";
 
 // src/mcp/tools/get-identity.ts
+init_identity();
 import { z as z20 } from "zod";
 function registerGetIdentity(server) {
   server.registerTool(
@@ -2556,6 +2556,7 @@ ${identity.body}`
 }
 
 // src/mcp/tools/update-identity.ts
+init_identity();
 import { z as z21 } from "zod";
 init_employees();
 function registerUpdateIdentity(server) {
@@ -2921,8 +2922,8 @@ function registerIngestDocument(server) {
     },
     async (input) => {
       try {
-        const { assertFeature: assertFeature2 } = await import("./plan-limits-AMJUHUCR.js");
-        const { assertMemoryLimit: assertMemoryLimit2 } = await import("./plan-limits-AMJUHUCR.js");
+        const { assertFeature: assertFeature2 } = await import("./plan-limits-BO2HMJ6S.js");
+        const { assertMemoryLimit: assertMemoryLimit2 } = await import("./plan-limits-BO2HMJ6S.js");
         await assertFeature2("wiki");
         await assertMemoryLimit2();
         const result3 = await ingestDocument(input);
@@ -3914,10 +3915,11 @@ function registerGetEntityNeighbors(server) {
       title: "Get Entity Neighbors",
       description: "Get connected entities for a given entity name. Returns neighbors with relationship types, directions, and weights.",
       inputSchema: {
-        entity_name: z34.string().describe("Name of the entity to find neighbors for")
+        entity_name: z34.string().describe("Name of the entity to find neighbors for"),
+        as_of: z34.string().optional().describe("ISO 8601 timestamp for time-travel. Returns only relationships valid at that point in time.")
       }
     },
-    async ({ entity_name }) => {
+    async ({ entity_name, as_of }) => {
       try {
         const client = getClient();
         const entity = await getEntityByName(client, entity_name);
@@ -3932,7 +3934,8 @@ function registerGetEntityNeighbors(server) {
           };
         }
         const relationships = await getRelationships(client, entity.id, {
-          direction: "both"
+          direction: "both",
+          asOf: as_of
         });
         if (relationships.length === 0) {
           return {
@@ -4116,8 +4119,8 @@ function registerExportGraph(server) {
         const html = await exportGraphHTML(client);
         const fs = await import("fs");
         const path18 = await import("path");
-        const os4 = await import("os");
-        const outDir = path18.join(os4.homedir(), ".exe-os", "exports");
+        const os5 = await import("os");
+        const outDir = path18.join(os5.homedir(), ".exe-os", "exports");
         fs.mkdirSync(outDir, { recursive: true });
         const timestamp = (/* @__PURE__ */ new Date()).toISOString().replace(/[:.]/g, "-").slice(0, 19);
         const filePath = path18.join(outDir, `graph-${timestamp}.html`);
@@ -4332,6 +4335,7 @@ function registerGraph(server) {
       project_name: z40.string().optional().describe("Project filter"),
       relationship_type: z40.string().optional().describe("Relationship type filter"),
       since: z40.string().optional().describe("ISO lower-bound timestamp"),
+      as_of: z40.string().optional().describe("ISO 8601 timestamp for time-travel queries. Returns relationships valid at that point in time. Omit for current relationships only."),
       limit: z40.coerce.number().int().min(1).max(200).optional().describe("Result limit"),
       depth: z40.coerce.number().int().min(1).max(3).optional().describe("Neighbor traversal depth"),
       output_path: z40.string().optional().describe("Path for export_graph output"),
@@ -4409,7 +4413,7 @@ function registerSetAgentConfig(server) {
           content: [
             {
               type: "text",
-              text: `Access denied. set_agent_config is COO-only. Your role: ${agentRole}`
+              text: `Access denied. set_agent_config is coordinator-only. Your role: ${agentRole}`
             }
           ],
           isError: true
@@ -5052,7 +5056,7 @@ async function getAgentSessionLoad() {
       return { sessions: [], totalLive: 0, busySessions: 0, idleSessions: 0 };
     }
     const { getClient: getClient2 } = await import("./lib/database.js");
-    const { sessionScopeFilter: sessionScopeFilter2 } = await import("./task-scope-RMJLXJ7S.js");
+    const { sessionScopeFilter: sessionScopeFilter2 } = await import("./task-scope-EY3G5623.js");
     const client = getClient2();
     const scope = sessionScopeFilter2();
     for (const s of liveAgentSessions) {
@@ -6654,7 +6658,7 @@ function registerCreateTrigger(server) {
       }
     },
     async ({ name, event, conditions, actions, project, enabled, schedule, query }) => {
-      const { assertFeature: assertFeature2 } = await import("./plan-limits-AMJUHUCR.js");
+      const { assertFeature: assertFeature2 } = await import("./plan-limits-BO2HMJ6S.js");
       const gatedActions = {
         send_whatsapp: "external_agents",
         update_wiki: "wiki"
@@ -7558,7 +7562,7 @@ function registerConfig(server) {
         const existing = loadEmployeesSync2();
         if (existing.some((e) => e.name === employeeName)) return errorResult8(`Employee "${employeeName}" already exists.`);
         try {
-          const { assertEmployeeLimit: assertEmployeeLimit2 } = await import("./plan-limits-AMJUHUCR.js");
+          const { assertEmployeeLimit: assertEmployeeLimit2 } = await import("./plan-limits-BO2HMJ6S.js");
           await assertEmployeeLimit2();
         } catch (e) {
           return errorResult8(e instanceof Error ? e.message : "Employee limit reached.");
@@ -7599,7 +7603,7 @@ You are ${employeeName}. Role: ${role}.`, "utf-8");
         }
         try {
           const { generateSessionWrappers } = await import("./lib/session-wrappers.js");
-          const { resolvePackageRoot } = await import("./installer-3RTZXZ57.js");
+          const { resolvePackageRoot } = await import("./installer-JF7ARD2O.js");
           generateSessionWrappers(resolvePackageRoot());
         } catch {
         }
@@ -7635,7 +7639,7 @@ function registerListWikiPages(server) {
       }
     },
     async ({ workspace, folder }) => {
-      const { assertFeature: assertFeature2 } = await import("./plan-limits-AMJUHUCR.js");
+      const { assertFeature: assertFeature2 } = await import("./plan-limits-BO2HMJ6S.js");
       await assertFeature2("wiki");
       const apiUrl = process.env.EXE_WIKI_API_URL;
       const apiKey = process.env.EXE_WIKI_API_KEY;
@@ -7735,7 +7739,7 @@ function registerGetWikiPage(server) {
       }
     },
     async ({ workspace, document_id, title }) => {
-      const { assertFeature: assertFeature2 } = await import("./plan-limits-AMJUHUCR.js");
+      const { assertFeature: assertFeature2 } = await import("./plan-limits-BO2HMJ6S.js");
       await assertFeature2("wiki");
       const apiUrl = process.env.EXE_WIKI_API_URL;
       const apiKey = process.env.EXE_WIKI_API_KEY;
@@ -7930,7 +7934,7 @@ function registerWiki(server) {
       if (!legacyToolName) return errorResult9(`Unknown wiki action: ${String(input.action)}`);
       const { action: _action, user_id, ...legacyArgs } = input;
       if (user_id && legacyArgs.workspace) {
-        const { checkWikiAccess } = await import("./wiki-acl-P7WEIMJV.js");
+        const { checkWikiAccess } = await import("./wiki-acl-BIEVKTJC.js");
         const { allowed } = await checkWikiAccess(
           String(user_id),
           String(legacyArgs.workspace),
@@ -9089,7 +9093,7 @@ function registerWorkflowTool(server) {
         getWorkflowInstance,
         listWorkflowInstances,
         approveWorkflowStep
-      } = await import("./workflow-engine-EPWKDGHR.js");
+      } = await import("./workflow-engine-6QPTYDQI.js");
       try {
         switch (input.action) {
           case "create_workflow": {
@@ -9213,8 +9217,25 @@ function formatInstanceStatus(inst, def) {
 
 // src/mcp/tools/file-copy.ts
 import { z as z82 } from "zod";
-import { copyFileSync, existsSync as existsSync9, mkdirSync as mkdirSync3, statSync as statSync2 } from "fs";
+import { copyFileSync, existsSync as existsSync9, lstatSync, mkdirSync as mkdirSync3, realpathSync, statSync as statSync2 } from "fs";
 import path15 from "path";
+import os4 from "os";
+function getAllowedRoots() {
+  const roots = [];
+  roots.push(path15.resolve(process.cwd()));
+  const home = os4.homedir();
+  roots.push(path15.join(home, ".exe-os"));
+  roots.push(path15.join(process.cwd(), ".worktrees"));
+  roots.push(path15.join(home));
+  return roots;
+}
+function isWithinBoundary(resolvedPath, roots) {
+  const normalized = path15.normalize(resolvedPath);
+  return roots.some((root) => {
+    const normalizedRoot = path15.normalize(root);
+    return normalized === normalizedRoot || normalized.startsWith(normalizedRoot + path15.sep);
+  });
+}
 function registerFileCopy(server) {
   server.registerTool(
     "file_copy",
@@ -9234,10 +9255,34 @@ function registerFileCopy(server) {
         if (!existsSync9(srcPath)) {
           return { content: [{ type: "text", text: `Source file not found: ${srcPath}` }], isError: true };
         }
+        const srcLstat = lstatSync(srcPath);
+        if (srcLstat.isSymbolicLink()) {
+          const realSrc = realpathSync(srcPath);
+          const roots = getAllowedRoots();
+          if (!isWithinBoundary(realSrc, roots)) {
+            return {
+              content: [{ type: "text", text: `Security: source symlink resolves outside allowed boundaries: ${realSrc}` }],
+              isError: true
+            };
+          }
+        }
         const srcStat = statSync2(srcPath);
         if (!srcStat.isFile()) {
           return { content: [{ type: "text", text: `Source is not a file: ${srcPath}` }], isError: true };
         }
+        const allowedRoots = getAllowedRoots();
+        if (!isWithinBoundary(srcPath, allowedRoots)) {
+          return {
+            content: [{ type: "text", text: `Security: source path escapes allowed boundaries: ${srcPath}` }],
+            isError: true
+          };
+        }
+        if (!isWithinBoundary(dstPath, allowedRoots)) {
+          return {
+            content: [{ type: "text", text: `Security: destination path escapes allowed boundaries: ${dstPath}` }],
+            isError: true
+          };
+        }
         if (existsSync9(dstPath) && !overwrite) {
           return { content: [{ type: "text", text: `Destination already exists: ${dstPath}. Set overwrite=true to replace.` }], isError: true };
         }
@@ -10099,7 +10144,7 @@ function registerGetSessionEvents(server) {
       const targetAgent = agent_id?.trim() || active.agentId;
       if (!canReadAgent(active.agentRole, active.agentId, targetAgent)) {
         return {
-          content: [{ type: "text", text: "Permission denied: only COO/CTO may read another agent's session events." }],
+          content: [{ type: "text", text: "Permission denied: only coordinators/CTO may read another agent's session events." }],
           isError: true
         };
       }
@@ -10136,7 +10181,7 @@ function registerGetLastAssistantResponse(server) {
       const targetAgent = agent_id?.trim() || active.agentId;
       if (!canReadAgent(active.agentRole, active.agentId, targetAgent)) {
         return {
-          content: [{ type: "text", text: "Permission denied: only COO/CTO may read another agent's last response." }],
+          content: [{ type: "text", text: "Permission denied: only coordinators/CTO may read another agent's last response." }],
           isError: true
         };
       }

package/dist/{chunk-7HZFWAIR.js → chunk-DH6N5G4T.js}

@@ -2,7 +2,7 @@ import {
   checkLicense,
   init_license,
   loadLicense
-} from "./chunk-KNS5ETKF.js";
+} from "./chunk-GLVF7ENO.js";
 
 // src/lib/license-gate.ts
 init_license();

package/dist/{chunk-GUDCQBRY.js → chunk-DU4ZN7VF.js}

@@ -1,7 +1,7 @@
 import {
   init_employees,
   loadEmployees
-} from "./chunk-ZHJNMC4W.js";
+} from "./chunk-55LEDLDE.js";
 import {
   __esm
 } from "./chunk-KFQGP6VL.js";

package/dist/{chunk-PS4UUDIG.js → chunk-DUDPJVAC.js}

@@ -1,18 +1,16 @@
 import {
   deactivateBehavior,
   init_behaviors
-} from "./chunk-QCJ3Y52V.js";
+} from "./chunk-NFX6MDEO.js";
 import {
   getActiveAgent
-} from "./chunk-XDJWGR2S.js";
-import {
-  getClient,
-  init_database
-} from "./chunk-UEWGUOXB.js";
+} from "./chunk-CBSUVFZ7.js";
 import {
   canCoordinate,
+  getClient,
+  init_database,
   init_employees
-} from "./chunk-ZHJNMC4W.js";
+} from "./chunk-55LEDLDE.js";
 
 // src/mcp/tools/deactivate-behavior.ts
 init_behaviors();