@askexenow/exe-os 0.9.140 → 0.9.142

package/dist/{chunk-5K3CCPNX.js → chunk-4CBBN2XD.js}

@@ -1,19 +1,19 @@
 import {
   getToolUsageStats
-} from "./chunk-GLGWGMPD.js";
+} from "./chunk-XIIVMIS4.js";
 import {
   AUTO_WAKE_MAX_RETRIES
-} from "./chunk-UE3BYGWY.js";
+} from "./chunk-JMMY24KD.js";
 import {
   getToolCapabilityIndex
-} from "./chunk-3RNNTTBH.js";
+} from "./chunk-267IKUT5.js";
 import {
   getCachedLicenseGate
-} from "./chunk-7HZFWAIR.js";
+} from "./chunk-DH6N5G4T.js";
 import {
   isRerankerAvailable,
   rerankWithScores
-} from "./chunk-H24OVCAN.js";
+} from "./chunk-AJOZXJLJ.js";
 import {
   getEntityByName,
   getEntityNeighbors,
@@ -21,14 +21,14 @@ import {
   getHotEntities,
   getRelationships,
   searchEntities
-} from "./chunk-6LKDJ5WX.js";
+} from "./chunk-XOVQ43JR.js";
 import {
   isToolAllowed,
   isToolAllowedForPlan
 } from "./chunk-E6ORBQHP.js";
 import {
   listRecentSessionEvents
-} from "./chunk-ABCDEJUD.js";
+} from "./chunk-KCLL5ECT.js";
 import {
   analyzeBlastRadius,
   buildCodeContextIndex,
@@ -37,68 +37,68 @@ import {
   searchCodeContext,
   searchCodeContextSemantic,
   traceCodeSymbol
-} from "./chunk-BZHXUKVC.js";
+} from "./chunk-U3Q3WNGY.js";
 import {
   runDriftProbes
-} from "./chunk-4YNGDNDI.js";
+} from "./chunk-7M3DNYMR.js";
 import {
   exportOrchestration,
   importOrchestration,
   validatePackage
-} from "./chunk-NX4WEVG6.js";
+} from "./chunk-Q53ZYTIU.js";
 import {
   loadOrchestrationPhase,
   setOrchestrationPhase
-} from "./chunk-KNEH2MGD.js";
+} from "./chunk-GIGLGGYL.js";
 import {
   createOrRefreshResumeTask,
   init_capacity_monitor
-} from "./chunk-34O6PRWE.js";
+} from "./chunk-UB7E2FEB.js";
 import {
   registerCompleteReminder
-} from "./chunk-RGKPVKUO.js";
+} from "./chunk-LGPTAJZC.js";
 import {
   registerDeactivateBehavior
-} from "./chunk-PS4UUDIG.js";
+} from "./chunk-DUDPJVAC.js";
 import {
   registerSendMessage
-} from "./chunk-6EBG7VWN.js";
+} from "./chunk-LFVL3R6H.js";
 import {
   registerCreateTask
-} from "./chunk-2JAEWE7P.js";
+} from "./chunk-25QUV6FU.js";
 import {
   registerListTasks
-} from "./chunk-5LJQSXUG.js";
+} from "./chunk-CK5ZAMWX.js";
 import {
   registerUpdateTask
-} from "./chunk-CLIW2CES.js";
+} from "./chunk-32Z4GK25.js";
 import {
   registerCreateReminder
-} from "./chunk-35FFFDS2.js";
+} from "./chunk-6V6UTSOP.js";
 import {
   registerListReminders
-} from "./chunk-O2RVWP3S.js";
+} from "./chunk-TSPBIMZV.js";
 import {
   completeReminder,
   createReminder,
   listReminders
-} from "./chunk-3TTJPQAE.js";
+} from "./chunk-BKEJSHDE.js";
 import {
   status
-} from "./chunk-4ITOWLHX.js";
+} from "./chunk-MRX42FAS.js";
 import {
   TOKENS_PER_IDLE_MINUTE,
   countKillsSince,
   init_session_kill_telemetry,
   sumTokensSavedSince
-} from "./chunk-QUG6EMZQ.js";
+} from "./chunk-EZUWMBWA.js";
 import {
   getAgentSpend
-} from "./chunk-2ZWYALO4.js";
+} from "./chunk-SFURTBMT.js";
 import {
   createSchedule,
   parseHumanCron
-} from "./chunk-OX6D5AF3.js";
+} from "./chunk-LNX37VPO.js";
 import {
   exportGraphHTML,
   generateGraphReport
@@ -106,53 +106,53 @@ import {
 import {
   entityId,
   mergeEntities
-} from "./chunk-YKOW7KMK.js";
+} from "./chunk-F4OU2ETP.js";
 import {
   formatReport,
   runAudit
-} from "./chunk-5WIEDLGY.js";
+} from "./chunk-S3FDCJNF.js";
 import {
   runHealthCheck
-} from "./chunk-SPMZRVXK.js";
+} from "./chunk-LCZRXRB7.js";
 import {
   hasFailures,
   runHealth,
   runTest
-} from "./chunk-Q3MIJPXM.js";
+} from "./chunk-EAVACBVO.js";
 import {
   findSimilarTrajectories,
   hashSignature,
   init_skill_learning
-} from "./chunk-UCNCSKGH.js";
+} from "./chunk-N5MH3CN2.js";
 import {
   deactivateBehavior,
   init_behaviors,
   listBehaviorsByDomain,
   storeBehavior
-} from "./chunk-QCJ3Y52V.js";
+} from "./chunk-NFX6MDEO.js";
 import {
   countUnconsolidated,
   groupMemories,
   runConsolidation,
   selectUnconsolidated
-} from "./chunk-Z6BTUUPK.js";
+} from "./chunk-U7M7ZURS.js";
 import {
   renderClientCOOTemplate
-} from "./chunk-SQLEKC4E.js";
+} from "./chunk-6EZRMPDA.js";
 import {
   deactivateGlobalProcedure,
   loadGlobalProcedures,
   storeGlobalProcedure
-} from "./chunk-D7BPHQGX.js";
+} from "./chunk-GOCW7Z6D.js";
 import {
   PLATFORM_PROCEDURES
-} from "./chunk-DMFM77DV.js";
+} from "./chunk-WZDI6UJ6.js";
 import {
   clearCloudReuploadRequired,
   cloudSync,
   getCloudReuploadRequired,
   markCloudReuploadRequired
-} from "./chunk-UOCQQHZT.js";
+} from "./chunk-5PZ3HSGP.js";
 import {
   crypto_exports,
   init_crypto
@@ -163,27 +163,22 @@ import {
 import {
   embed,
   init_embedder
-} from "./chunk-CSVYC6HH.js";
+} from "./chunk-4OHIVMHS.js";
 import {
   readMcpHttpEvents,
   summarizeMcpTransport,
   writeMcpTransportSummary
-} from "./chunk-LUOLBU54.js";
+} from "./chunk-NMT6QFEE.js";
 import {
   init_tasks,
   updateTask
-} from "./chunk-CYCRC2KN.js";
+} from "./chunk-JSVRX6IW.js";
 import {
   fastDbInit
-} from "./chunk-ELXPFTBJ.js";
-import {
-  getIdentity,
-  listIdentities,
-  updateIdentity
-} from "./chunk-MQV4UKTS.js";
+} from "./chunk-7A2YCQNM.js";
 import {
   MAX_CONCURRENT_WORKERS
-} from "./chunk-VTZ4QOBS.js";
+} from "./chunk-CQX2WDI5.js";
 import {
   getProjectName,
   init_project_name
@@ -191,10 +186,10 @@ import {
 import {
   hybridSearch,
   recentRecords
-} from "./chunk-OIUPHIN2.js";
+} from "./chunk-2NWMGMNH.js";
 import {
   getActiveAgent
-} from "./chunk-XDJWGR2S.js";
+} from "./chunk-CBSUVFZ7.js";
 import {
   attachDocumentMetadata,
   flushBatch,
@@ -202,7 +197,7 @@ import {
   reserveVersions,
   vectorToBlob,
   writeMemory
-} from "./chunk-IU3CXV4S.js";
+} from "./chunk-LR3QFARI.js";
 import {
   init_task_scope,
   init_tasks_crud,
@@ -214,7 +209,7 @@ import {
   tmux_routing_exports,
   updateTaskStatus,
   writeCheckpoint
-} from "./chunk-YWCPAQBH.js";
+} from "./chunk-AOJHEMHE.js";
 import {
   init_session_registry,
   listSessions
@@ -227,7 +222,7 @@ import {
   init_agent_config,
   loadAgentConfig,
   setAgentRuntime
-} from "./chunk-HHV26QTD.js";
+} from "./chunk-SOHGHGWU.js";
 import {
   DEFAULT_RUNTIME,
   init_runtime_table
@@ -238,7 +233,7 @@ import {
   assertFeature,
   assertMemoryLimit,
   init_plan_limits
-} from "./chunk-F6PIXTHZ.js";
+} from "./chunk-NMG76472.js";
 import {
   getAccountByName,
   getDefaultAccount
@@ -247,30 +242,32 @@ import {
   createNewTrigger,
   isScheduledTrigger,
   loadTriggers
-} from "./chunk-VEGDNUBO.js";
+} from "./chunk-72O7CSKA.js";
 import {
   pushConversationToCRM
 } from "./chunk-GCNWCYJI.js";
-import {
-  getClient,
-  init_database
-} from "./chunk-UEWGUOXB.js";
 import {
   EMPLOYEES_PATH,
   addEmployee,
   canCoordinate,
   employees_exports,
+  getClient,
   getEmployee,
+  getIdentity,
+  init_database,
   init_employees,
+  init_identity,
   isCoordinatorName,
   isCoordinatorRole,
+  listIdentities,
   loadEmployees,
   loadEmployeesSync,
-  saveEmployees
-} from "./chunk-ZHJNMC4W.js";
+  saveEmployees,
+  updateIdentity
+} from "./chunk-55LEDLDE.js";
 import {
   getMasterKey
-} from "./chunk-XUHFQHGZ.js";
+} from "./chunk-4JZNDVZH.js";
 import {
   checkForUpdate
 } from "./chunk-MZIGUUDQ.js";
@@ -284,12 +281,12 @@ import {
   readCachedLicenseToken,
   saveLicense,
   validateLicense
-} from "./chunk-KNS5ETKF.js";
+} from "./chunk-GLVF7ENO.js";
 import {
   EXE_AI_DIR,
   init_config,
   loadConfig
-} from "./chunk-IG5XFUYJ.js";
+} from "./chunk-VA42PIIY.js";
 import {
   __toCommonJS
 } from "./chunk-KFQGP6VL.js";
@@ -883,7 +880,7 @@ async function searchConversations(query, limit) {
 }
 async function searchWiki(query, limit) {
   try {
-    const { createWikiClient, chatInWorkspace, listWorkspaces } = await import("./wiki-client-UFR4R7YH.js");
+    const { createWikiClient, chatInWorkspace, listWorkspaces } = await import("./wiki-client-NGWOSMCV.js");
     const client = await createWikiClient();
     if (!client) return [];
     const workspaces = await listWorkspaces(client);
@@ -1428,7 +1425,7 @@ async function handleSupersede(input) {
   }
   try {
     const { getClient: getClient2 } = await import("./lib/database.js");
-    const { getActiveAgent: getActiveAgent2 } = await import("./active-agent-GFBVE3ES.js");
+    const { getActiveAgent: getActiveAgent2 } = await import("./active-agent-OTOFSYIV.js");
     const { writeMemory: writeMemory2, flushBatch: flushBatch2 } = await import("./lib/store.js");
     const { randomUUID: randomUUID2 } = await import("crypto");
     const client = getClient2();
@@ -1537,9 +1534,9 @@ function registerMemory(server) {
         return handleSupersede(input);
       }
       if (action === "core_get" || action === "core_set" || action === "core_delete") {
-        const { getActiveAgent: getActiveAgent2 } = await import("./active-agent-GFBVE3ES.js");
+        const { getActiveAgent: getActiveAgent2 } = await import("./active-agent-OTOFSYIV.js");
         const { agentId } = getActiveAgent2();
-        const { getCoreMemory, setCoreMemory, deleteCoreMemory, formatCoreMemoryBlock } = await import("./core-memory-JOTETVSY.js");
+        const { getCoreMemory, setCoreMemory, deleteCoreMemory, formatCoreMemoryBlock } = await import("./core-memory-N74JWH4M.js");
         if (action === "core_get") {
           const entries = await getCoreMemory(agentId);
           const block = formatCoreMemoryBlock(entries);
@@ -1618,10 +1615,11 @@ function registerQueryRelationships(server) {
         query: z11.string().optional().describe("What relationships to find (natural language)"),
         entity_name: z11.string().optional().describe("Specific entity to explore (for example an agent, project, or vendor name)"),
         relationship_type: z11.string().optional().describe("Filter by relationship type (e.g., 'implemented', 'depends_on', 'worked_on')"),
-        max_depth: z11.number().default(2).describe("How many hops to traverse (default: 2)")
+        max_depth: z11.number().default(2).describe("How many hops to traverse (default: 2)"),
+        as_of: z11.string().optional().describe("ISO 8601 timestamp for time-travel. Returns relationships valid at that point in time.")
       }
     },
-    async ({ query, entity_name, relationship_type, max_depth }) => {
+    async ({ query, entity_name, relationship_type, max_depth, as_of }) => {
       const client = getClient();
       if (entity_name) {
         const entity = await getEntityByName(client, entity_name);
@@ -1645,13 +1643,14 @@ ${matchList}`
           };
         }
         const rels = await getRelationships(client, entity.id, {
-          type: relationship_type
+          type: relationship_type,
+          asOf: as_of
         });
         if (rels.length === 0) {
           return {
             content: [{
               type: "text",
-              text: `Entity "${entity.name}" (${entity.type}) exists but has no recorded relationships.`
+              text: `Entity "${entity.name}" (${entity.type}) exists but has no recorded relationships${as_of ? ` as of ${as_of}` : ""}.`
             }]
           };
         }
@@ -1659,7 +1658,7 @@ ${matchList}`
           const confLabel = r.confidenceLabel && r.confidenceLabel !== "extracted" ? `[${r.confidenceLabel.toUpperCase()} ${r.confidence.toFixed(1)}] ` : "";
           return `- ${confLabel}${r.sourceName} \u2192[${r.type}]\u2192 ${r.targetName} (w: ${r.weight.toFixed(1)})`;
         });
-        const neighbors = await getEntityNeighbors(client, entity.id, max_depth);
+        const neighbors = await getEntityNeighbors(client, entity.id, max_depth, as_of);
         const neighborLine = neighbors.length > 1 ? `
 
 Connected entities (${max_depth} hops): ${neighbors.filter((n) => n.entity.id !== entity.id).map((n) => `${n.entity.name} (${n.entity.type})`).join(", ")}` : "";
@@ -1687,7 +1686,7 @@ ${relLines.join("\n")}${neighborLine}`
         }
         const results = [];
         for (const entity of matches.slice(0, 5)) {
-          const rels = await getRelationships(client, entity.id, { type: relationship_type });
+          const rels = await getRelationships(client, entity.id, { type: relationship_type, asOf: as_of });
           const relSummary = rels.length > 0 ? rels.slice(0, 3).map((r) => `  ${r.sourceName} \u2192[${r.type}]\u2192 ${r.targetName}`).join("\n") : "  (no relationships)";
           results.push(`### ${entity.name} (${entity.type})
 ${relSummary}`);
@@ -1932,7 +1931,7 @@ function registerCloseTask(server) {
         }
       } catch {
       }
-      let mergeWarning = "";
+      let mergeNote = "";
       try {
         const { getClient: getClient2 } = await import("./lib/database.js");
         const client = getClient2();
@@ -1945,17 +1944,39 @@ function registerCloseTask(server) {
           const { execSync } = await import("child_process");
           try {
             const openPRs = execSync(
-              `gh pr list --state open --json number,title,headRefName --author ${assignee} 2>/dev/null`,
+              `gh pr list --state open --json number,title,headRefName 2>/dev/null`,
               { encoding: "utf8", timeout: 5e3 }
             ).trim();
-            const prs = JSON.parse(openPRs || "[]");
+            const allPrs = JSON.parse(openPRs || "[]");
+            const baseName = assignee.replace(/\d+$/, "");
+            const prs = allPrs.filter(
+              (p) => p.headRefName.startsWith(`${assignee}-`) || p.headRefName.startsWith(`${baseName}-`) || p.headRefName === `${assignee}-work` || p.headRefName === `${baseName}-work`
+            );
+            for (const pr of prs) {
+              try {
+                execSync(`gh pr merge ${pr.number} --squash --admin --delete-branch 2>/dev/null`, { timeout: 15e3 });
+                mergeNote += `
+\u2705 Auto-merged PR #${pr.number}: ${pr.title}`;
+                process.stderr.write(`[close-task] Auto-merged PR #${pr.number} (${pr.headRefName})
+`);
+              } catch (mergeErr) {
+                mergeNote += `
+\u26A0\uFE0F Failed to merge PR #${pr.number}: ${mergeErr instanceof Error ? mergeErr.message : "unknown error"}`;
+              }
+            }
             if (prs.length > 0) {
-              const prList = prs.map((p) => `  #${p.number}: ${p.title} (${p.headRefName})`).join("\n");
-              mergeWarning = `
-
-\u26A0\uFE0F MERGE CHECK: ${assignee} has ${prs.length} open PR(s) \u2014 did you merge before closing?
-${prList}
-Run: gh pr merge <number> --squash --delete-branch`;
+              try {
+                execSync("git pull origin main 2>/dev/null", { timeout: 1e4 });
+                mergeNote += "\n\u2705 Pulled latest main";
+              } catch {
+                mergeNote += "\n\u26A0\uFE0F git pull failed \u2014 run manually";
+              }
+              try {
+                execSync("npm run build 2>/dev/null", { timeout: 6e4 });
+                mergeNote += "\n\u2705 Build verified";
+              } catch {
+                mergeNote += "\n\u26A0\uFE0F Build failed after merge \u2014 investigate";
+              }
             }
           } catch {
           }
@@ -1972,7 +1993,53 @@ Run: gh pr merge <number> --squash --delete-branch`;
       });
       let text3 = `Task "${task.title}" marked ${task.status}.
 File: ${task.taskFile}`;
-      if (mergeWarning) text3 += mergeWarning;
+      if (mergeNote) text3 += mergeNote;
+      let respawnNote = "";
+      if (status2 === "closed" || status2 === "done") {
+        try {
+          const { getClient: getRespawnClient } = await import("./lib/database.js");
+          const rClient = getRespawnClient();
+          const assignee = task.assignedTo;
+          if (assignee) {
+            const remaining = await rClient.execute({
+              sql: "SELECT COUNT(*) as cnt FROM tasks WHERE assigned_to = ? AND status IN ('open', 'in_progress')",
+              args: [assignee]
+            });
+            const count = Number(remaining.rows[0]?.cnt ?? 0);
+            if (count > 0) {
+              try {
+                const { isMultiInstance } = await import("./lib/employees.js");
+                if (isMultiInstance(assignee)) {
+                  const { resolveExeSession: resolveExeSession2, employeeSessionName, ensureEmployee } = await import("./lib/tmux-routing.js");
+                  const exeSession = resolveExeSession2();
+                  if (exeSession) {
+                    const oldSession = employeeSessionName(assignee, exeSession);
+                    const { execSync } = await import("child_process");
+                    try {
+                      execSync(`tmux kill-session -t ${oldSession} 2>/dev/null`, { timeout: 3e3 });
+                    } catch {
+                    }
+                    const baseName = assignee.replace(/\d+$/, "") || assignee;
+                    try {
+                      execSync(`git worktree remove .worktrees/${baseName} --force 2>/dev/null`, { timeout: 5e3, cwd: baseDir });
+                      process.stderr.write(`[close-task] Pruned worktree .worktrees/${baseName}
+`);
+                    } catch {
+                    }
+                    const result4 = ensureEmployee(assignee, exeSession, baseDir, { autoInstance: true });
+                    respawnNote = `
+
+\u{1F504} Auto-respawn: ${assignee} has ${count} more task(s). Killed old session, spawned ${result4.sessionName ?? "fresh instance"} with clean worktree.`;
+                  }
+                }
+              } catch {
+              }
+            }
+          }
+        } catch {
+        }
+      }
+      if (respawnNote) text3 += respawnNote;
       if ((status2 === "done" || status2 === "closed") && task.nextTask) {
         text3 += `
 
@@ -2077,7 +2144,7 @@ function registerResumeEmployee(server) {
         };
       }
       try {
-        const { isTmuxSessionAlive } = await import("./tasks-crud-ZRXPR3UB.js");
+        const { isTmuxSessionAlive } = await import("./tasks-crud-JHHIROCS.js");
         const now = (/* @__PURE__ */ new Date()).toISOString();
         for (const row of openTasks.rows) {
           const status2 = String(row.status);
@@ -2113,7 +2180,10 @@ function registerResumeEmployee(server) {
         const { ensureEmployee, resolveExeSession: resolveExeSession2 } = await import("./lib/tmux-routing.js");
         const exeSession = resolveExeSession2();
         if (!exeSession) throw new Error("No coordinator session found");
-        const result3 = ensureEmployee(agent_id, exeSession, process.cwd());
+        const { isMultiInstance } = await import("./lib/employees.js");
+        const result3 = ensureEmployee(agent_id, exeSession, process.cwd(), {
+          autoInstance: isMultiInstance(agent_id)
+        });
         switch (result3.status) {
           case "intercom_sent":
             dispatchStatus = `
@@ -2283,6 +2353,10 @@ function registerStoreBehavior(server) {
             };
           }
         } catch {
+          return {
+            content: [{ type: "text", text: `Authorization denied: unable to verify coordinator role for ${activeAgent.agentId}. Cross-agent behavior writes require roster validation.` }],
+            isError: true
+          };
         }
       }
       let resolvedProject;
@@ -2309,6 +2383,12 @@ function registerStoreBehavior(server) {
           }
         }
       } catch {
+        if (agent_id && agent_id !== activeAgent.agentId) {
+          return {
+            content: [{ type: "text", text: `Unable to verify agent "${resolvedAgent}" \u2014 roster file unavailable. Cannot store cross-agent behavior without roster validation.` }],
+            isError: true
+          };
+        }
       }
       const id = await storeBehavior({
         agentId: resolvedAgent,
@@ -2506,6 +2586,7 @@ ${lines.join("\n")}`
 import { z as z22 } from "zod";
 
 // src/mcp/tools/get-identity.ts
+init_identity();
 import { z as z20 } from "zod";
 function registerGetIdentity(server) {
   server.registerTool(
@@ -2556,6 +2637,7 @@ ${identity.body}`
 }
 
 // src/mcp/tools/update-identity.ts
+init_identity();
 import { z as z21 } from "zod";
 init_employees();
 function registerUpdateIdentity(server) {
@@ -2921,8 +3003,8 @@ function registerIngestDocument(server) {
     },
     async (input) => {
       try {
-        const { assertFeature: assertFeature2 } = await import("./plan-limits-AMJUHUCR.js");
-        const { assertMemoryLimit: assertMemoryLimit2 } = await import("./plan-limits-AMJUHUCR.js");
+        const { assertFeature: assertFeature2 } = await import("./plan-limits-BO2HMJ6S.js");
+        const { assertMemoryLimit: assertMemoryLimit2 } = await import("./plan-limits-BO2HMJ6S.js");
         await assertFeature2("wiki");
         await assertMemoryLimit2();
         const result3 = await ingestDocument(input);
@@ -3914,10 +3996,11 @@ function registerGetEntityNeighbors(server) {
       title: "Get Entity Neighbors",
       description: "Get connected entities for a given entity name. Returns neighbors with relationship types, directions, and weights.",
       inputSchema: {
-        entity_name: z34.string().describe("Name of the entity to find neighbors for")
+        entity_name: z34.string().describe("Name of the entity to find neighbors for"),
+        as_of: z34.string().optional().describe("ISO 8601 timestamp for time-travel. Returns only relationships valid at that point in time.")
       }
     },
-    async ({ entity_name }) => {
+    async ({ entity_name, as_of }) => {
       try {
         const client = getClient();
         const entity = await getEntityByName(client, entity_name);
@@ -3932,7 +4015,8 @@ function registerGetEntityNeighbors(server) {
           };
         }
         const relationships = await getRelationships(client, entity.id, {
-          direction: "both"
+          direction: "both",
+          asOf: as_of
         });
         if (relationships.length === 0) {
           return {
@@ -4116,8 +4200,8 @@ function registerExportGraph(server) {
         const html = await exportGraphHTML(client);
         const fs = await import("fs");
         const path18 = await import("path");
-        const os4 = await import("os");
-        const outDir = path18.join(os4.homedir(), ".exe-os", "exports");
+        const os5 = await import("os");
+        const outDir = path18.join(os5.homedir(), ".exe-os", "exports");
         fs.mkdirSync(outDir, { recursive: true });
         const timestamp = (/* @__PURE__ */ new Date()).toISOString().replace(/[:.]/g, "-").slice(0, 19);
         const filePath = path18.join(outDir, `graph-${timestamp}.html`);
@@ -4332,6 +4416,7 @@ function registerGraph(server) {
       project_name: z40.string().optional().describe("Project filter"),
       relationship_type: z40.string().optional().describe("Relationship type filter"),
       since: z40.string().optional().describe("ISO lower-bound timestamp"),
+      as_of: z40.string().optional().describe("ISO 8601 timestamp for time-travel queries. Returns relationships valid at that point in time. Omit for current relationships only."),
       limit: z40.coerce.number().int().min(1).max(200).optional().describe("Result limit"),
       depth: z40.coerce.number().int().min(1).max(3).optional().describe("Neighbor traversal depth"),
       output_path: z40.string().optional().describe("Path for export_graph output"),
@@ -4409,7 +4494,7 @@ function registerSetAgentConfig(server) {
           content: [
             {
               type: "text",
-              text: `Access denied. set_agent_config is COO-only. Your role: ${agentRole}`
+              text: `Access denied. set_agent_config is coordinator-only. Your role: ${agentRole}`
             }
           ],
           isError: true
@@ -5052,7 +5137,7 @@ async function getAgentSessionLoad() {
       return { sessions: [], totalLive: 0, busySessions: 0, idleSessions: 0 };
     }
     const { getClient: getClient2 } = await import("./lib/database.js");
-    const { sessionScopeFilter: sessionScopeFilter2 } = await import("./task-scope-RMJLXJ7S.js");
+    const { sessionScopeFilter: sessionScopeFilter2 } = await import("./task-scope-QNRAYD7S.js");
     const client = getClient2();
     const scope = sessionScopeFilter2();
     for (const s of liveAgentSessions) {
@@ -6654,7 +6739,7 @@ function registerCreateTrigger(server) {
       }
     },
     async ({ name, event, conditions, actions, project, enabled, schedule, query }) => {
-      const { assertFeature: assertFeature2 } = await import("./plan-limits-AMJUHUCR.js");
+      const { assertFeature: assertFeature2 } = await import("./plan-limits-BO2HMJ6S.js");
       const gatedActions = {
         send_whatsapp: "external_agents",
         update_wiki: "wiki"
@@ -7558,7 +7643,7 @@ function registerConfig(server) {
         const existing = loadEmployeesSync2();
         if (existing.some((e) => e.name === employeeName)) return errorResult8(`Employee "${employeeName}" already exists.`);
         try {
-          const { assertEmployeeLimit: assertEmployeeLimit2 } = await import("./plan-limits-AMJUHUCR.js");
+          const { assertEmployeeLimit: assertEmployeeLimit2 } = await import("./plan-limits-BO2HMJ6S.js");
           await assertEmployeeLimit2();
         } catch (e) {
           return errorResult8(e instanceof Error ? e.message : "Employee limit reached.");
@@ -7599,7 +7684,7 @@ You are ${employeeName}. Role: ${role}.`, "utf-8");
         }
         try {
           const { generateSessionWrappers } = await import("./lib/session-wrappers.js");
-          const { resolvePackageRoot } = await import("./installer-3RTZXZ57.js");
+          const { resolvePackageRoot } = await import("./installer-JF7ARD2O.js");
           generateSessionWrappers(resolvePackageRoot());
         } catch {
         }
@@ -7635,7 +7720,7 @@ function registerListWikiPages(server) {
       }
     },
     async ({ workspace, folder }) => {
-      const { assertFeature: assertFeature2 } = await import("./plan-limits-AMJUHUCR.js");
+      const { assertFeature: assertFeature2 } = await import("./plan-limits-BO2HMJ6S.js");
       await assertFeature2("wiki");
       const apiUrl = process.env.EXE_WIKI_API_URL;
       const apiKey = process.env.EXE_WIKI_API_KEY;
@@ -7735,7 +7820,7 @@ function registerGetWikiPage(server) {
       }
     },
     async ({ workspace, document_id, title }) => {
-      const { assertFeature: assertFeature2 } = await import("./plan-limits-AMJUHUCR.js");
+      const { assertFeature: assertFeature2 } = await import("./plan-limits-BO2HMJ6S.js");
       await assertFeature2("wiki");
       const apiUrl = process.env.EXE_WIKI_API_URL;
       const apiKey = process.env.EXE_WIKI_API_KEY;
@@ -7930,7 +8015,7 @@ function registerWiki(server) {
       if (!legacyToolName) return errorResult9(`Unknown wiki action: ${String(input.action)}`);
       const { action: _action, user_id, ...legacyArgs } = input;
       if (user_id && legacyArgs.workspace) {
-        const { checkWikiAccess } = await import("./wiki-acl-P7WEIMJV.js");
+        const { checkWikiAccess } = await import("./wiki-acl-BIEVKTJC.js");
         const { allowed } = await checkWikiAccess(
           String(user_id),
           String(legacyArgs.workspace),
@@ -8056,6 +8141,20 @@ ${lines.join("\n")}`
           };
         }
         const resolvedAgent = agent_id ?? getActiveAgent().agentId;
+        const isCrossAgentWrite = agent_id != null && agent_id !== getActiveAgent().agentId;
+        if (isCrossAgentWrite) {
+          const caller2 = getActiveAgent();
+          const allowed2 = canCoordinate(caller2.agentId, caller2.agentRole);
+          if (!allowed2) {
+            return {
+              content: [{
+                type: "text",
+                text: `Permission denied. Only the coordinator or founder sessions can store behaviors for other agents. You are "${caller2.agentId}".`
+              }],
+              isError: true
+            };
+          }
+        }
         if (resolvedAgent && resolvedAgent !== "default") {
           try {
             const { loadEmployeesSync: loadEmployeesSync2 } = await import("./lib/employees.js");
@@ -8070,17 +8169,11 @@ ${lines.join("\n")}`
               };
             }
           } catch {
-          }
-        }
-        if (agent_id) {
-          const caller2 = getActiveAgent();
-          if (agent_id !== caller2.agentId) {
-            const allowed2 = canCoordinate(caller2.agentId, caller2.agentRole);
-            if (!allowed2) {
+            if (isCrossAgentWrite) {
               return {
                 content: [{
                   type: "text",
-                  text: `Permission denied. Only the coordinator or founder sessions can store behaviors for other agents. You are "${caller2.agentId}".`
+                  text: `Unable to verify agent "${resolvedAgent}" \u2014 roster file unavailable. Cannot store cross-agent behavior without roster validation.`
                 }],
                 isError: true
               };
@@ -9089,7 +9182,7 @@ function registerWorkflowTool(server) {
         getWorkflowInstance,
         listWorkflowInstances,
         approveWorkflowStep
-      } = await import("./workflow-engine-EPWKDGHR.js");
+      } = await import("./workflow-engine-PK2TC7UE.js");
       try {
         switch (input.action) {
           case "create_workflow": {
@@ -9213,8 +9306,25 @@ function formatInstanceStatus(inst, def) {
 
 // src/mcp/tools/file-copy.ts
 import { z as z82 } from "zod";
-import { copyFileSync, existsSync as existsSync9, mkdirSync as mkdirSync3, statSync as statSync2 } from "fs";
+import { copyFileSync, existsSync as existsSync9, lstatSync, mkdirSync as mkdirSync3, realpathSync, statSync as statSync2 } from "fs";
 import path15 from "path";
+import os4 from "os";
+function getAllowedRoots() {
+  const roots = [];
+  roots.push(path15.resolve(process.cwd()));
+  const home = os4.homedir();
+  roots.push(path15.join(home, ".exe-os"));
+  roots.push(path15.join(process.cwd(), ".worktrees"));
+  roots.push(path15.join(home));
+  return roots;
+}
+function isWithinBoundary(resolvedPath, roots) {
+  const normalized = path15.normalize(resolvedPath);
+  return roots.some((root) => {
+    const normalizedRoot = path15.normalize(root);
+    return normalized === normalizedRoot || normalized.startsWith(normalizedRoot + path15.sep);
+  });
+}
 function registerFileCopy(server) {
   server.registerTool(
     "file_copy",
@@ -9234,10 +9344,34 @@ function registerFileCopy(server) {
         if (!existsSync9(srcPath)) {
           return { content: [{ type: "text", text: `Source file not found: ${srcPath}` }], isError: true };
         }
+        const srcLstat = lstatSync(srcPath);
+        if (srcLstat.isSymbolicLink()) {
+          const realSrc = realpathSync(srcPath);
+          const roots = getAllowedRoots();
+          if (!isWithinBoundary(realSrc, roots)) {
+            return {
+              content: [{ type: "text", text: `Security: source symlink resolves outside allowed boundaries: ${realSrc}` }],
+              isError: true
+            };
+          }
+        }
         const srcStat = statSync2(srcPath);
         if (!srcStat.isFile()) {
           return { content: [{ type: "text", text: `Source is not a file: ${srcPath}` }], isError: true };
         }
+        const allowedRoots = getAllowedRoots();
+        if (!isWithinBoundary(srcPath, allowedRoots)) {
+          return {
+            content: [{ type: "text", text: `Security: source path escapes allowed boundaries: ${srcPath}` }],
+            isError: true
+          };
+        }
+        if (!isWithinBoundary(dstPath, allowedRoots)) {
+          return {
+            content: [{ type: "text", text: `Security: destination path escapes allowed boundaries: ${dstPath}` }],
+            isError: true
+          };
+        }
         if (existsSync9(dstPath) && !overwrite) {
           return { content: [{ type: "text", text: `Destination already exists: ${dstPath}. Set overwrite=true to replace.` }], isError: true };
         }
@@ -10099,7 +10233,7 @@ function registerGetSessionEvents(server) {
       const targetAgent = agent_id?.trim() || active.agentId;
       if (!canReadAgent(active.agentRole, active.agentId, targetAgent)) {
         return {
-          content: [{ type: "text", text: "Permission denied: only COO/CTO may read another agent's session events." }],
+          content: [{ type: "text", text: "Permission denied: only coordinators/CTO may read another agent's session events." }],
           isError: true
         };
       }
@@ -10136,7 +10270,7 @@ function registerGetLastAssistantResponse(server) {
       const targetAgent = agent_id?.trim() || active.agentId;
       if (!canReadAgent(active.agentRole, active.agentId, targetAgent)) {
         return {
-          content: [{ type: "text", text: "Permission denied: only COO/CTO may read another agent's last response." }],
+          content: [{ type: "text", text: "Permission denied: only coordinators/CTO may read another agent's last response." }],
           isError: true
         };
       }