@askexenow/exe-os 0.9.2 → 0.9.4

package/dist/bin/exe-agent.js

@@ -1463,10 +1463,10 @@ You report to the COO. All work flows through the COO. These procedures are non-
    Use store_memory to write a structured summary. Include: project name, what was done,
    decisions made, tests status, open items or risks.
 
-6. AFTER committing changes to exe-os itself \u2014 REBUILD (mandatory, never skip):
-   - Run: npm run deploy
-   - This builds, installs globally, and re-registers hooks/MCP in one step.
-   - Do NOT ask permission. Do NOT say "want me to rebuild?" \u2014 just do it.
+6. AFTER committing changes to exe-os itself \u2014 REBUILD:
+   - If you are the COO or CTO on the MAIN branch (not a worktree): run \`npm run deploy\`.
+   - If you are in a git worktree: run \`npm run build\` ONLY. NEVER run deploy from a worktree \u2014 it re-registers hooks pointing at the worktree path, and deleting the worktree breaks every hook system-wide.
+   - Engineers and specialists: ALWAYS use \`npm run build\` only. Deploy is restricted to COO and CTO on main.
    - If the build fails, fix the error and retry before moving on.
 
 7. AFTER reporting \u2014 CHECK FOR NEXT WORK (mandatory):

package/dist/bin/exe-boot.js

@@ -8285,10 +8285,10 @@ You report to the COO. All work flows through the COO. These procedures are non-
    Use store_memory to write a structured summary. Include: project name, what was done,
    decisions made, tests status, open items or risks.
 
-6. AFTER committing changes to exe-os itself \u2014 REBUILD (mandatory, never skip):
-   - Run: npm run deploy
-   - This builds, installs globally, and re-registers hooks/MCP in one step.
-   - Do NOT ask permission. Do NOT say "want me to rebuild?" \u2014 just do it.
+6. AFTER committing changes to exe-os itself \u2014 REBUILD:
+   - If you are the COO or CTO on the MAIN branch (not a worktree): run \`npm run deploy\`.
+   - If you are in a git worktree: run \`npm run build\` ONLY. NEVER run deploy from a worktree \u2014 it re-registers hooks pointing at the worktree path, and deleting the worktree breaks every hook system-wide.
+   - Engineers and specialists: ALWAYS use \`npm run build\` only. Deploy is restricted to COO and CTO on main.
    - If the build fails, fix the error and retry before moving on.
 
 7. AFTER reporting \u2014 CHECK FOR NEXT WORK (mandatory):

package/dist/bin/exe-call.js

@@ -596,10 +596,10 @@ You report to the COO. All work flows through the COO. These procedures are non-
    Use store_memory to write a structured summary. Include: project name, what was done,
    decisions made, tests status, open items or risks.
 
-6. AFTER committing changes to exe-os itself \u2014 REBUILD (mandatory, never skip):
-   - Run: npm run deploy
-   - This builds, installs globally, and re-registers hooks/MCP in one step.
-   - Do NOT ask permission. Do NOT say "want me to rebuild?" \u2014 just do it.
+6. AFTER committing changes to exe-os itself \u2014 REBUILD:
+   - If you are the COO or CTO on the MAIN branch (not a worktree): run \`npm run deploy\`.
+   - If you are in a git worktree: run \`npm run build\` ONLY. NEVER run deploy from a worktree \u2014 it re-registers hooks pointing at the worktree path, and deleting the worktree breaks every hook system-wide.
+   - Engineers and specialists: ALWAYS use \`npm run build\` only. Deploy is restricted to COO and CTO on main.
    - If the build fails, fix the error and retry before moving on.
 
 7. AFTER reporting \u2014 CHECK FOR NEXT WORK (mandatory):

package/dist/bin/exe-launch-agent.js

@@ -2019,10 +2019,10 @@ You report to the COO. All work flows through the COO. These procedures are non-
    Use store_memory to write a structured summary. Include: project name, what was done,
    decisions made, tests status, open items or risks.
 
-6. AFTER committing changes to exe-os itself \u2014 REBUILD (mandatory, never skip):
-   - Run: npm run deploy
-   - This builds, installs globally, and re-registers hooks/MCP in one step.
-   - Do NOT ask permission. Do NOT say "want me to rebuild?" \u2014 just do it.
+6. AFTER committing changes to exe-os itself \u2014 REBUILD:
+   - If you are the COO or CTO on the MAIN branch (not a worktree): run \`npm run deploy\`.
+   - If you are in a git worktree: run \`npm run build\` ONLY. NEVER run deploy from a worktree \u2014 it re-registers hooks pointing at the worktree path, and deleting the worktree breaks every hook system-wide.
+   - Engineers and specialists: ALWAYS use \`npm run build\` only. Deploy is restricted to COO and CTO on main.
    - If the build fails, fix the error and retry before moving on.
 
 7. AFTER reporting \u2014 CHECK FOR NEXT WORK (mandatory):

package/dist/bin/exe-new-employee.js

@@ -1735,20 +1735,39 @@ function setupGhostty(home) {
   const configPath = path9.join(configDir, "config");
   const backupPath = path9.join(configDir, "config.backup");
   mkdirSync6(configDir, { recursive: true });
+  const START_MARKER = "# \u2500\u2500 exe-os:ghostty-start \u2500\u2500";
+  const END_MARKER = "# \u2500\u2500 exe-os:ghostty-end \u2500\u2500";
+  const assetContent = readFileSync8(assetPath, "utf8").trim();
+  const markedSection = `${START_MARKER}
+${assetContent}
+${END_MARKER}`;
   if (existsSync9(configPath)) {
     const existing = readFileSync8(configPath, "utf8");
-    if (existing.includes("Exe OS")) {
-      copyFileSync(assetPath, configPath);
+    if (existing.includes(START_MARKER) && existing.includes(END_MARKER)) {
+      const before = existing.slice(0, existing.indexOf(START_MARKER));
+      const after = existing.slice(existing.indexOf(END_MARKER) + END_MARKER.length);
+      writeFileSync6(configPath, `${before}${markedSection}${after}`);
+    } else if (existing.includes("Exe OS")) {
+      if (!existsSync9(backupPath)) {
+        copyFileSync(configPath, backupPath);
+        process.stderr.write(`exe-os: backed up existing Ghostty config to ${backupPath}
+`);
+      }
+      writeFileSync6(configPath, `${markedSection}
+`);
     } else {
       if (!existsSync9(backupPath)) {
         copyFileSync(configPath, backupPath);
         process.stderr.write(`exe-os: backed up existing Ghostty config to ${backupPath}
 `);
       }
-      copyFileSync(assetPath, configPath);
+      writeFileSync6(configPath, `${markedSection}
+
+${existing}`);
     }
   } else {
-    copyFileSync(assetPath, configPath);
+    writeFileSync6(configPath, `${markedSection}
+`);
   }
   process.stderr.write("exe-os: Ghostty config installed\n");
 }

package/dist/bin/install.js

@@ -1123,20 +1123,39 @@ function setupGhostty(home) {
   const configPath = path5.join(configDir, "config");
   const backupPath = path5.join(configDir, "config.backup");
   mkdirSync3(configDir, { recursive: true });
+  const START_MARKER = "# \u2500\u2500 exe-os:ghostty-start \u2500\u2500";
+  const END_MARKER = "# \u2500\u2500 exe-os:ghostty-end \u2500\u2500";
+  const assetContent = readFileSync4(assetPath, "utf8").trim();
+  const markedSection = `${START_MARKER}
+${assetContent}
+${END_MARKER}`;
   if (existsSync5(configPath)) {
     const existing = readFileSync4(configPath, "utf8");
-    if (existing.includes("Exe OS")) {
-      copyFileSync(assetPath, configPath);
+    if (existing.includes(START_MARKER) && existing.includes(END_MARKER)) {
+      const before = existing.slice(0, existing.indexOf(START_MARKER));
+      const after = existing.slice(existing.indexOf(END_MARKER) + END_MARKER.length);
+      writeFileSync3(configPath, `${before}${markedSection}${after}`);
+    } else if (existing.includes("Exe OS")) {
+      if (!existsSync5(backupPath)) {
+        copyFileSync(configPath, backupPath);
+        process.stderr.write(`exe-os: backed up existing Ghostty config to ${backupPath}
+`);
+      }
+      writeFileSync3(configPath, `${markedSection}
+`);
     } else {
       if (!existsSync5(backupPath)) {
         copyFileSync(configPath, backupPath);
         process.stderr.write(`exe-os: backed up existing Ghostty config to ${backupPath}
 `);
       }
-      copyFileSync(assetPath, configPath);
+      writeFileSync3(configPath, `${markedSection}
+
+${existing}`);
     }
   } else {
-    copyFileSync(assetPath, configPath);
+    writeFileSync3(configPath, `${markedSection}
+`);
   }
   process.stderr.write("exe-os: Ghostty config installed\n");
 }

package/dist/bin/setup.js

@@ -4400,10 +4400,10 @@ You report to the COO. All work flows through the COO. These procedures are non-
    Use store_memory to write a structured summary. Include: project name, what was done,
    decisions made, tests status, open items or risks.
 
-6. AFTER committing changes to exe-os itself \u2014 REBUILD (mandatory, never skip):
-   - Run: npm run deploy
-   - This builds, installs globally, and re-registers hooks/MCP in one step.
-   - Do NOT ask permission. Do NOT say "want me to rebuild?" \u2014 just do it.
+6. AFTER committing changes to exe-os itself \u2014 REBUILD:
+   - If you are the COO or CTO on the MAIN branch (not a worktree): run \`npm run deploy\`.
+   - If you are in a git worktree: run \`npm run build\` ONLY. NEVER run deploy from a worktree \u2014 it re-registers hooks pointing at the worktree path, and deleting the worktree breaks every hook system-wide.
+   - Engineers and specialists: ALWAYS use \`npm run build\` only. Deploy is restricted to COO and CTO on main.
    - If the build fails, fix the error and retry before moving on.
 
 7. AFTER reporting \u2014 CHECK FOR NEXT WORK (mandatory):

package/dist/lib/employee-templates.js

@@ -307,10 +307,10 @@ You report to the COO. All work flows through the COO. These procedures are non-
    Use store_memory to write a structured summary. Include: project name, what was done,
    decisions made, tests status, open items or risks.
 
-6. AFTER committing changes to exe-os itself \u2014 REBUILD (mandatory, never skip):
-   - Run: npm run deploy
-   - This builds, installs globally, and re-registers hooks/MCP in one step.
-   - Do NOT ask permission. Do NOT say "want me to rebuild?" \u2014 just do it.
+6. AFTER committing changes to exe-os itself \u2014 REBUILD:
+   - If you are the COO or CTO on the MAIN branch (not a worktree): run \`npm run deploy\`.
+   - If you are in a git worktree: run \`npm run build\` ONLY. NEVER run deploy from a worktree \u2014 it re-registers hooks pointing at the worktree path, and deleting the worktree breaks every hook system-wide.
+   - Engineers and specialists: ALWAYS use \`npm run build\` only. Deploy is restricted to COO and CTO on main.
    - If the build fails, fix the error and retry before moving on.
 
 7. AFTER reporting \u2014 CHECK FOR NEXT WORK (mandatory):

package/dist/mcp/server.js

@@ -15240,17 +15240,20 @@ async function insertProcedures(procedures, timestamp, options) {
 }
 async function replaceBehaviorsAndProcedures(behaviors, procedures, timestamp) {
   const client = getClient();
-  await client.execute({
-    sql: "UPDATE behaviors SET active = 0, updated_at = ? WHERE active = 1",
-    args: [timestamp]
-  });
-  await client.execute({
-    sql: "UPDATE global_procedures SET active = 0, updated_at = ? WHERE active = 1",
-    args: [timestamp]
+  const existingBehaviors = await client.execute({
+    sql: "SELECT agent_id, content FROM behaviors WHERE active = 1",
+    args: []
   });
+  const existingBehaviorKeys = new Set(
+    existingBehaviors.rows.map((row) => `${String(row.agent_id)}::${String(row.content)}`)
+  );
+  const newBehaviors = behaviors.filter(
+    (b) => !existingBehaviorKeys.has(`${b.agent_id}::${b.content}`)
+  );
+  const existingProcedureTitles = await getActiveProcedureTitles();
   return {
-    behaviors: await insertBehaviors(behaviors, timestamp),
-    procedures: await insertProcedures(procedures, timestamp)
+    behaviors: await insertBehaviors(newBehaviors, timestamp),
+    procedures: await insertProcedures(procedures, timestamp, { skipTitles: existingProcedureTitles })
   };
 }
 async function mergeRosterEntries(importedRoster, timestamp) {
@@ -15286,10 +15289,16 @@ async function replaceRosterEntries(importedRoster, timestamp) {
 }
 async function importIdentities(identities, updatedBy) {
   const entries = Object.entries(identities);
+  let imported = 0;
   for (const [agentId, content] of entries) {
+    const existing = getIdentity(agentId);
+    if (existing?.raw) {
+      continue;
+    }
     await updateIdentity(agentId, content, updatedBy);
+    imported += 1;
   }
-  return entries.length;
+  return imported;
 }
 async function getActiveProcedureTitles() {
   const client = getClient();
@@ -15458,19 +15467,32 @@ function registerExportOrchestration(server2) {
 import { readFileSync as readFileSync19 } from "fs";
 import { z as z39 } from "zod";
 init_store();
+init_active_agent();
+init_employees();
 function registerImportOrchestration(server2) {
   server2.registerTool(
     "import_orchestration",
     {
       title: "Import Orchestration",
-      description: "Import roster, identities, behaviors, and procedures from an orchestration package.",
+      description: "Import roster, identities, behaviors, and procedures from an orchestration package. Restricted to coordinator/founder.",
       inputSchema: {
         package_path: z39.string().describe("Path to the orchestration package JSON file"),
-        merge_strategy: z39.enum(["replace", "merge"]).default("merge").describe("How to apply the package: replace existing data or merge additively")
+        merge_strategy: z39.enum(["replace", "merge"]).default("merge").describe("How to apply the package: both strategies are additive-only \u2014 existing data is never deleted or overwritten")
       }
     },
     async ({ package_path, merge_strategy }) => {
       try {
+        const caller = getActiveAgent();
+        const allowed = canCoordinate(caller.agentId, caller.agentRole);
+        if (!allowed) {
+          return {
+            content: [{
+              type: "text",
+              text: `Permission denied. Only the coordinator or founder sessions can import orchestration packages. You are "${caller.agentId}".`
+            }],
+            isError: true
+          };
+        }
         await initStore();
         const raw = readFileSync19(package_path, "utf-8");
         const pkg = validatePackage(JSON.parse(raw));

package/dist/tui/App.js

@@ -16773,10 +16773,10 @@ You report to the COO. All work flows through the COO. These procedures are non-
    Use store_memory to write a structured summary. Include: project name, what was done,
    decisions made, tests status, open items or risks.
 
-6. AFTER committing changes to exe-os itself \u2014 REBUILD (mandatory, never skip):
-   - Run: npm run deploy
-   - This builds, installs globally, and re-registers hooks/MCP in one step.
-   - Do NOT ask permission. Do NOT say "want me to rebuild?" \u2014 just do it.
+6. AFTER committing changes to exe-os itself \u2014 REBUILD:
+   - If you are the COO or CTO on the MAIN branch (not a worktree): run \`npm run deploy\`.
+   - If you are in a git worktree: run \`npm run build\` ONLY. NEVER run deploy from a worktree \u2014 it re-registers hooks pointing at the worktree path, and deleting the worktree breaks every hook system-wide.
+   - Engineers and specialists: ALWAYS use \`npm run build\` only. Deploy is restricted to COO and CTO on main.
    - If the build fails, fix the error and retry before moving on.
 
 7. AFTER reporting \u2014 CHECK FOR NEXT WORK (mandatory):

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@askexenow/exe-os",
-  "version": "0.9.2",
+  "version": "0.9.4",
   "description": "AI employee operating system — persistent memory, task management, and multi-agent coordination for Claude Code.",
   "license": "CC-BY-NC-4.0",
   "type": "module",