@askexenow/exe-os 0.9.229 → 0.9.232

package/dist/{chunk-NUVDSQNY.js → chunk-K4KJEH4Y.js}

@@ -1,11 +1,11 @@
 import {
   ingest
-} from "./chunk-OSMMWGJ2.js";
+} from "./chunk-AQSGZ3DL.js";
 import {
   listWorkflowDefinitions,
   runWorkflow,
   startWorkflow
-} from "./chunk-YKIPAQZG.js";
+} from "./chunk-TCUOOFBS.js";
 import {
   initCRMBridge
 } from "./chunk-ONKIWA3R.js";

package/dist/{chunk-7NNXBDOO.js → chunk-KDJRFJDL.js}

@@ -1,7 +1,7 @@
 // src/lib/keychain.ts
 import { readFile, writeFile, unlink, mkdir, chmod, rename, copyFile } from "fs/promises";
 import { existsSync, statSync, writeFileSync, readFileSync } from "fs";
-import { execSync } from "child_process";
+import { execSync, execFileSync, spawnSync } from "child_process";
 import crypto from "crypto";
 import path from "path";
 import os from "os";
@@ -108,17 +108,18 @@ function macKeychainSet(value, service = SERVICE) {
   if (!nativeKeychainAllowed()) return false;
   if (process.platform !== "darwin") return false;
   try {
+    process.stderr.write("[exe-os] Storing encryption key in macOS Keychain. You may see a system prompt \u2014 please allow it.\n");
     try {
-      execSync(
-        `security delete-generic-password -s "${service}" -a "${ACCOUNT}" 2>/dev/null`,
-        { timeout: 5e3 }
-      );
+      execFileSync("security", ["delete-generic-password", "-s", service, "-a", ACCOUNT], {
+        timeout: 5e3,
+        stdio: ["pipe", "pipe", "pipe"]
+      });
     } catch {
     }
-    execSync(
-      `security add-generic-password -s "${service}" -a "${ACCOUNT}" -w "${value}"`,
-      { timeout: 5e3 }
-    );
+    execFileSync("security", ["add-generic-password", "-s", service, "-a", ACCOUNT, "-w", value], {
+      timeout: 5e3,
+      stdio: ["pipe", "pipe", "pipe"]
+    });
     return true;
   } catch {
     return false;
@@ -151,11 +152,20 @@ function linuxSecretGet(service = SERVICE) {
 function linuxSecretSet(value, service = SERVICE) {
   if (!linuxSecretAvailable()) return false;
   try {
-    execSync(
-      `echo -n "${value}" | secret-tool store --label="exe-os master key" service "${service}" account "${ACCOUNT}" 2>/dev/null`,
-      { timeout: 5e3 }
-    );
-    return true;
+    const result = spawnSync("secret-tool", [
+      "store",
+      "--label",
+      "exe-os master key",
+      "service",
+      service,
+      "account",
+      ACCOUNT
+    ], {
+      input: value,
+      stdio: ["pipe", "pipe", "pipe"],
+      timeout: 5e3
+    });
+    return result.status === 0;
   } catch {
     return false;
   }
@@ -310,7 +320,7 @@ async function getMasterKey() {
       const decrypted = decryptWithMachineKey(content, machineKey);
       if (!decrypted) {
         process.stderr.write(
-          "[keychain] Key decryption failed \u2014 machine may have changed.\n  Use your 24-word recovery phrase during setup: exe-os setup\n"
+          "[keychain] Your computer's hostname or username appears to have changed.\n  Use your 24-word recovery phrase to restore: exe-os setup (option 2)\n"
         );
         return null;
       }
@@ -506,7 +516,7 @@ async function loadBip39() {
     return await import("bip39");
   } catch {
     throw new Error(
-      "bip39 package not found. Run: npm install -g bip39\nOr reinstall exe-os: npm install -g @askexenow/exe-os"
+      "bip39 package not found. Reinstall exe-os: npm install -g @askexenow/exe-os@latest"
     );
   }
 }

package/dist/{chunk-GKM7RYN3.js → chunk-KHEX4NY3.js}

@@ -1,13 +1,13 @@
 import {
   getMasterKey,
   setMasterKey
-} from "./chunk-7NNXBDOO.js";
+} from "./chunk-KDJRFJDL.js";
 import {
   LEGACY_LANCE_PATH,
   MODELS_DIR,
   loadConfig,
   saveConfig
-} from "./chunk-TNTFEWU5.js";
+} from "./chunk-XBXKLACW.js";
 import {
   atomicWriteJsonSync,
   atomicWriteSync
@@ -380,7 +380,7 @@ async function runSetupWizard(opts = {}) {
             "Setup cancelled: recovery phrase was not confirmed. Save the 24-word phrase before continuing \u2014 it is required to recover encrypted memories."
           );
         }
-        const { markKeyBackupConfirmed } = await import("./key-backup-status-TVFMMWTT.js");
+        const { markKeyBackupConfirmed } = await import("./key-backup-status-DRZO77KR.js");
         markKeyBackupConfirmed("setup-wizard");
       }
       state.completedSteps.push(1);
@@ -534,7 +534,7 @@ async function runSetupWizard(opts = {}) {
       if (cloudConfig) {
         config.cloud = cloudConfig;
       }
-      const { applyDefaultOrchestrationPhase } = await import("./orchestration-phase-HXRKMZXM.js");
+      const { applyDefaultOrchestrationPhase } = await import("./orchestration-phase-7VYG3L7X.js");
       applyDefaultOrchestrationPhase(config);
       await saveConfig(config);
       log("");
@@ -828,6 +828,7 @@ async function runSetupWizard(opts = {}) {
           } catch {
             isLicensed = true;
             log("Couldn't reach the license server \u2014 key saved, specialists enabled.");
+            log("  Your key will be re-validated when connected.");
           }
         }
       }
@@ -862,7 +863,7 @@ async function runSetupWizard(opts = {}) {
       log("  Phase 3: Parallel org \u2014 specialists execute in parallel with reviews");
       log("");
       const unlockExecutives = (await askOrEnv("Unlock Phase 2 executives now? (y/N): ", void 0, "n")).toLowerCase() === "y";
-      const { setOrchestrationPhase } = await import("./orchestration-phase-HXRKMZXM.js");
+      const { setOrchestrationPhase } = await import("./orchestration-phase-7VYG3L7X.js");
       if (!unlockExecutives) {
         await setOrchestrationPhase("phase_1_coo", "setup-wizard");
         log("");

package/dist/{chunk-UPSZ2VKV.js → chunk-KQBSNOJL.js}

@@ -1,10 +1,10 @@
 import {
   initStore
-} from "./chunk-HTCBLSIB.js";
+} from "./chunk-PQV5FL3N.js";
 import {
   getClient,
   isInitialized
-} from "./chunk-UJOSFVWG.js";
+} from "./chunk-IYHYMEEV.js";
 
 // src/lib/schedules.ts
 import crypto from "crypto";

package/dist/{chunk-IKTMX6N7.js → chunk-KXOX7SDE.js}

@@ -1,13 +1,13 @@
 import {
   vectorToBlob
-} from "./chunk-HTCBLSIB.js";
+} from "./chunk-PQV5FL3N.js";
 import {
   extractKeywords,
   keywordsToString
 } from "./chunk-CHCA3ZM2.js";
 import {
   isCoordinatorName
-} from "./chunk-UJOSFVWG.js";
+} from "./chunk-IYHYMEEV.js";
 
 // src/lib/consolidation.ts
 import { randomUUID } from "crypto";

package/dist/{chunk-UV4ZHXUP.js → chunk-L55G65Q2.js}

@@ -1,6 +1,6 @@
 import {
   listReminders
-} from "./chunk-R2E4TV5V.js";
+} from "./chunk-7ZOFRNMG.js";
 
 // src/mcp/tools/list-reminders.ts
 import { z } from "zod";

package/dist/{chunk-HQMEOIUJ.js → chunk-LHY4ZRZV.js}

@@ -2,7 +2,7 @@ import {
   connectEmbedDaemon,
   disconnectClient,
   embedViaClient
-} from "./chunk-L24HYX62.js";
+} from "./chunk-2L6GV2VS.js";
 import {
   EMBEDDING_DIM
 } from "./chunk-FXU7JOXK.js";

package/dist/{chunk-MJXEOKIW.js → chunk-LOLA7VLN.js}

@@ -1,6 +1,6 @@
 import {
   processCRMEvent
-} from "./chunk-Z3ZCLTP7.js";
+} from "./chunk-OAOBUDO3.js";
 
 // src/gateway/adapters/crm-webhook.ts
 function parseTwentyWebhook(payload) {

package/dist/{chunk-WA67SFFZ.js → chunk-LZHNW2TW.js}

@@ -1,6 +1,6 @@
 import {
   getClient
-} from "./chunk-UJOSFVWG.js";
+} from "./chunk-IYHYMEEV.js";
 
 // src/lib/token-spend.ts
 import { readdir, stat } from "fs/promises";

package/dist/{chunk-OE6SYHTC.js → chunk-M44DCO63.js}

@@ -1,7 +1,7 @@
 import {
   clean,
   stableId
-} from "./chunk-WWPX2LLP.js";
+} from "./chunk-P6346JIK.js";
 
 // src/lib/reflection-checkpoints.ts
 function parsePayload(payload) {

package/dist/{chunk-UBMGUX6T.js → chunk-M6W3HYEK.js}

@@ -1,6 +1,6 @@
 import {
   ensureWorktree
-} from "./chunk-I2CDSGQW.js";
+} from "./chunk-SBUSQBPP.js";
 import {
   queueIntercom
 } from "./chunk-QI4IXJN7.js";
@@ -10,7 +10,7 @@ import {
 } from "./chunk-4JERP7NT.js";
 import {
   registerSession
-} from "./chunk-G4LLKD4Z.js";
+} from "./chunk-QWRRM2BE.js";
 import {
   getTransport
 } from "./chunk-MVW62NIZ.js";
@@ -19,18 +19,18 @@ import {
 } from "./chunk-CX6GL3ZJ.js";
 import {
   recordOrchestrationEventBestEffort
-} from "./chunk-CTFKTUYN.js";
+} from "./chunk-2OFB7NQW.js";
 import {
   getAgentRuntime,
   normalizeCcModelName
-} from "./chunk-GVP5U4WL.js";
+} from "./chunk-EEAY2YNU.js";
 import {
   RUNTIME_TABLE
 } from "./chunk-NGP6LSV2.js";
 import {
   PlanLimitError,
   assertEmployeeLimitSync
-} from "./chunk-V3QAAU2U.js";
+} from "./chunk-4E2XAON5.js";
 import {
   getSessionKey
 } from "./chunk-CVYC6DUW.js";
@@ -45,7 +45,7 @@ import {
 } from "./chunk-MP2AFCGL.js";
 import {
   ensureAgentSymlink
-} from "./chunk-RMPAMMYW.js";
+} from "./chunk-WUHYKL36.js";
 import {
   expandDualPrefixTools
 } from "./chunk-HYZV25LY.js";
@@ -57,13 +57,13 @@ import {
   isCoordinatorName,
   loadEmployees,
   loadEmployeesSync
-} from "./chunk-UJOSFVWG.js";
+} from "./chunk-IYHYMEEV.js";
 import {
   loadDeviceId
-} from "./chunk-D4IVTUNN.js";
+} from "./chunk-OZCZNEYI.js";
 import {
   EXE_AI_DIR
-} from "./chunk-TNTFEWU5.js";
+} from "./chunk-XBXKLACW.js";
 import {
   atomicWriteJsonSync,
   atomicWriteSync
@@ -503,7 +503,7 @@ async function createTaskCore(input) {
         if (isCoordinatorSession) {
           earlySessionScope = resolved;
         } else {
-          const { getSessionProject } = await import("./session-scope-SMT225X3.js");
+          const { getSessionProject } = await import("./session-scope-DWIP4IKM.js");
           const sessionProject = getSessionProject(resolved);
           if (sessionProject && sessionProject !== input.projectName) {
             scopeMismatchWarning = `session/project mismatch: session "${resolved}" owns "${sessionProject}" but task targets "${input.projectName}". Routed to default scope.`;
@@ -761,7 +761,7 @@ async function queryTaskRows(opts) {
   }
   if (opts.founderId !== null) {
     try {
-      const { founderScopeFilter } = await import("./founder-context-3N6BMG7B.js");
+      const { founderScopeFilter } = await import("./founder-context-ZNGQ5NGW.js");
       const founderFilter = founderScopeFilter(opts.founderId);
       const cleaned = founderFilter.sql.replace(/^\s*AND\s+/, "");
       conditions.push(cleaned);
@@ -970,7 +970,7 @@ async function updateTaskStatus(input) {
     } catch {
     }
     try {
-      const { writeNotification: writeNotification2 } = await import("./notifications-H4F77BYT.js");
+      const { writeNotification: writeNotification2 } = await import("./notifications-TNCGZ5W2.js");
       await writeNotification2({
         agentId: reviewer,
         agentRole: isCoordinatorName(reviewer) ? "COO" : "manager",
@@ -1309,7 +1309,7 @@ ${input.result ?? ""}`;
         args: [taskId]
       });
       let merged = { assertions: [], resolved: [] };
-      if (existing.rows.length > 0 && existing.rows[0].assertions) {
+      if (existing.rows.length > 0 && existing.rows[0]?.assertions) {
         try {
           const prev = JSON.parse(String(existing.rows[0].assertions));
           merged.assertions = prev.assertions ?? [];
@@ -1376,7 +1376,7 @@ ${input.result ?? ""}`;
   }
   if (shouldWriteCompletionMemory && input.result) {
     try {
-      const { writeMemoryViaDaemon } = await import("./memory-queue-client-5XBHYAQR.js");
+      const { writeMemoryViaDaemon } = await import("./memory-queue-client-MGXFQ62G.js");
       await writeMemoryViaDaemon({
         raw_text: input.result,
         agent_id: String(row.assigned_to),
@@ -1479,7 +1479,7 @@ ${input.result ?? ""}`;
   }
   if (input.status === "done" || input.status === "needs_review") {
     try {
-      const { incrementSkillSuccess } = await import("./skill-refinement-LKJHUW2U.js");
+      const { incrementSkillSuccess } = await import("./skill-refinement-X2MCBDTB.js");
       await incrementSkillSuccess(
         String(row.assigned_to),
         row.project_name ? String(row.project_name) : null
@@ -2913,7 +2913,7 @@ async function verifyPaneAtCapacity(sessionName) {
       reason: `capture-pane failed: ${err instanceof Error ? err.message : String(err)}`
     };
   }
-  const { isAtCapacity } = await import("./capacity-monitor-HZPAFQZH.js");
+  const { isAtCapacity } = await import("./capacity-monitor-GGTPFYQG.js");
   if (!isAtCapacity(pane)) {
     return {
       atCapacity: false,

package/dist/{chunk-3MK3R5E6.js → chunk-MJYZJP7O.js}

@@ -1,13 +1,13 @@
 import {
   deactivateBehavior
-} from "./chunk-7DNX45WB.js";
+} from "./chunk-QHFTK5EF.js";
 import {
   getActiveAgent
-} from "./chunk-DLXTKVBO.js";
+} from "./chunk-DUBO7325.js";
 import {
   canCoordinate,
   getClient
-} from "./chunk-UJOSFVWG.js";
+} from "./chunk-IYHYMEEV.js";
 
 // src/mcp/tools/deactivate-behavior.ts
 import { z } from "zod";
@@ -24,7 +24,7 @@ function registerDeactivateBehavior(server) {
     async ({ behavior_id }) => {
       const caller = getActiveAgent();
       try {
-        const { StewardGate } = await import("./steward-gate-6IKH335D.js");
+        const { StewardGate } = await import("./steward-gate-PR2N5XHY.js");
         const steward = new StewardGate();
         const gateDecision = await steward.checkAuthority(caller.agentId || "unknown", "deactivate_behavior", behavior_id);
         if (!gateDecision.allowed) {

package/dist/{chunk-Z3TT2SVJ.js → chunk-NV3WPNBM.js}

@@ -1,6 +1,6 @@
 import {
   isCoordinatorRole
-} from "./chunk-UJOSFVWG.js";
+} from "./chunk-IYHYMEEV.js";
 
 // src/lib/task-router.ts
 import { randomUUID } from "crypto";

package/dist/{chunk-WZ2RVKRO.js → chunk-O7A2X7MH.js}

@@ -1,9 +1,9 @@
 import {
   updateTask
-} from "./chunk-BZAQ4UG7.js";
+} from "./chunk-V5QHETEF.js";
 import {
   TASK_ALREADY_CLAIMED_PREFIX
-} from "./chunk-UBMGUX6T.js";
+} from "./chunk-M6W3HYEK.js";
 
 // src/mcp/tools/update-task.ts
 import { z } from "zod";
@@ -39,7 +39,7 @@ function registerUpdateTask(server) {
       const status = rawStatus;
       let callerAgentId;
       try {
-        const { getActiveAgent: getAgent } = await import("./active-agent-GJDG4CAW.js");
+        const { getActiveAgent: getAgent } = await import("./active-agent-QFQKXG3F.js");
         callerAgentId = getAgent().agentId;
       } catch {
       }

package/dist/{chunk-MSCB4ACU.js → chunk-OANEAQ7F.js}

@@ -1,22 +1,23 @@
 import {
   extractMemoryGraph
-} from "./chunk-36DAY227.js";
+} from "./chunk-XUBNHBQE.js";
 import {
   flushBatch,
   writeMemory
-} from "./chunk-HTCBLSIB.js";
+} from "./chunk-PQV5FL3N.js";
 import {
   extractKeywords
 } from "./chunk-CHCA3ZM2.js";
 import {
   getActiveAgent
-} from "./chunk-DLXTKVBO.js";
+} from "./chunk-DUBO7325.js";
 
 // src/mcp/tools/import-conversations.ts
 import { z } from "zod";
 import crypto from "crypto";
 import { readdir, readFile, stat } from "fs/promises";
-import path from "path";
+import path, { resolve, normalize } from "path";
+import os from "os";
 
 // src/lib/conversation-parser.ts
 function detectFormat(content, filePath) {
@@ -231,6 +232,27 @@ function registerImportConversations(server) {
       const { agentId: currentAgentId, agentRole } = getActiveAgent();
       const agentId = overrideAgentId ?? currentAgentId;
       const projectName = project_name ?? "imported";
+      const resolvedPath = resolve(normalize(inputPath));
+      const home = process.env.HOME || os.homedir();
+      const blocked = ["/etc", "/root", "/var", "/usr", "/sys", "/proc"];
+      const sensitiveHome = [".ssh", ".gnupg", ".aws", ".config/gcloud"];
+      for (const dir of blocked) {
+        if (resolvedPath.startsWith(dir + "/") || resolvedPath === dir) {
+          return {
+            content: [{ type: "text", text: `Access denied: cannot read files from ${dir}` }],
+            isError: true
+          };
+        }
+      }
+      for (const rel of sensitiveHome) {
+        const full = resolve(home, rel);
+        if (resolvedPath.startsWith(full + "/") || resolvedPath === full) {
+          return {
+            content: [{ type: "text", text: `Access denied: cannot read files from ~/${rel}` }],
+            isError: true
+          };
+        }
+      }
       let files;
       try {
         files = await readInputFiles(inputPath);

package/dist/{chunk-OI6MVDSY.js → chunk-OE6XFO2J.js}

@@ -1,6 +1,6 @@
 import {
   completeReminder
-} from "./chunk-R2E4TV5V.js";
+} from "./chunk-7ZOFRNMG.js";
 
 // src/mcp/tools/complete-reminder.ts
 import { z } from "zod";

package/dist/{chunk-ETSREHYC.js → chunk-OVG7IQTZ.js}

@@ -1,10 +1,10 @@
 import {
   enqueueMemory
-} from "./chunk-AZSCW64F.js";
+} from "./chunk-XIQZTFQQ.js";
 import {
   isClientConnected,
   sendDaemonRequest
-} from "./chunk-L24HYX62.js";
+} from "./chunk-2L6GV2VS.js";
 
 // src/lib/memory-queue-client.ts
 async function writeMemoryViaDaemon(entry) {

package/dist/{chunk-D4IVTUNN.js → chunk-OZCZNEYI.js}

@@ -1,6 +1,6 @@
 import {
   EXE_AI_DIR
-} from "./chunk-TNTFEWU5.js";
+} from "./chunk-XBXKLACW.js";
 
 // src/lib/license.ts
 import { readFileSync, writeFileSync, existsSync, mkdirSync, statSync } from "fs";

package/dist/{chunk-FF62UWIJ.js → chunk-P6Z6TTQZ.js}

@@ -1,6 +1,6 @@
 import {
   loadEmployeesSync
-} from "./chunk-UJOSFVWG.js";
+} from "./chunk-IYHYMEEV.js";
 
 // src/adapters/mcp-http-config.ts
 import { chmodSync, existsSync, mkdirSync, readFileSync, writeFileSync } from "fs";

package/dist/{chunk-26PUEPOY.js → chunk-PBFEGM26.js}

@@ -1,12 +1,12 @@
 import {
   storeBehavior
-} from "./chunk-7DNX45WB.js";
+} from "./chunk-QHFTK5EF.js";
 import {
   getClient
-} from "./chunk-UJOSFVWG.js";
+} from "./chunk-IYHYMEEV.js";
 import {
   loadConfig
-} from "./chunk-TNTFEWU5.js";
+} from "./chunk-XBXKLACW.js";
 
 // src/lib/skill-learning.ts
 import crypto from "crypto";

package/dist/{chunk-HTCBLSIB.js → chunk-PQV5FL3N.js}

@@ -6,7 +6,7 @@ import {
   findScopedDuplicate,
   governMemoryRecord,
   schedulePostWriteMemoryHygiene
-} from "./chunk-IW53DAYO.js";
+} from "./chunk-HBVVFXTS.js";
 import {
   orgBus
 } from "./chunk-MP2AFCGL.js";
@@ -15,16 +15,16 @@ import {
   ensureSchema,
   getClient,
   initTurso
-} from "./chunk-UJOSFVWG.js";
+} from "./chunk-IYHYMEEV.js";
 import {
   EMBEDDING_DIM
 } from "./chunk-FXU7JOXK.js";
 import {
   getMasterKey
-} from "./chunk-7NNXBDOO.js";
+} from "./chunk-KDJRFJDL.js";
 import {
   loadConfig
-} from "./chunk-TNTFEWU5.js";
+} from "./chunk-XBXKLACW.js";
 
 // src/lib/store.ts
 var _debugStore = process.env.EXE_DEBUG === "1";
@@ -65,7 +65,7 @@ function recordShardFailure(project, error) {
       `[store] Shard circuit OPEN for "${project}" after ${state.failures} consecutive failures. Will retry in ${SHARD_CB_COOLDOWN_MS / 6e4}min. Last error: ${error}
 `
     );
-    void import("./orchestration-events-LXVPJL6S.js").then(({ recordOrchestrationEventBestEffort }) => {
+    void import("./orchestration-events-TMN37OEJ.js").then(({ recordOrchestrationEventBestEffort }) => {
       recordOrchestrationEventBestEffort({
         eventType: "shard.circuit_open",
         source: "store.recordShardFailure",
@@ -149,7 +149,7 @@ async function initStore(options) {
   if (!options?.lightweight) {
     try {
       if (process.env.EXE_DISABLE_SHARDING !== "1") {
-        const { initShardManager } = await import("./shard-manager-ON2WWCRM.js");
+        const { initShardManager } = await import("./shard-manager-PWSOXHZ4.js");
         initShardManager(hexKey);
       }
     } catch (e) {
@@ -162,7 +162,7 @@ async function initStore(options) {
     );
     _nextVersion = (Number(vResult.rows[0]?.max_v) || 0) + 1;
     try {
-      const { loadGlobalProcedures } = await import("./global-procedures-NY3W7L5Q.js");
+      const { loadGlobalProcedures } = await import("./global-procedures-OC5C7BWJ.js");
       await loadGlobalProcedures();
     } catch (e) {
       logStoreWarn("catch", e);
@@ -290,7 +290,7 @@ async function writeMemory(record) {
     founder_id: record.founder_id ?? null
   };
   try {
-    const { checkMemoryPoisoning } = await import("./memory-poisoning-defense-I76FGNHK.js");
+    const { checkMemoryPoisoning } = await import("./memory-poisoning-defense-RNLXBWNU.js");
     const poisonResult = await checkMemoryPoisoning({
       memoryId: dbRow.id,
       vector: Array.isArray(dbRow.vector) ? dbRow.vector : void 0,
@@ -314,10 +314,10 @@ async function writeMemory(record) {
     timestamp: record.timestamp
   });
   const MAX_PENDING = 1e3;
-  if (_pendingRecords.length > MAX_PENDING) {
-    const dropped = _pendingRecords.length - MAX_PENDING;
-    _pendingRecords = _pendingRecords.slice(-MAX_PENDING);
-    console.warn(`[store] Dropped ${dropped} oldest pending records (overflow)`);
+  if (_pendingRecords.length >= MAX_PENDING) {
+    _pendingRecords.shift();
+    process.stderr.write(`[exe-os] \u26A0 Memory buffer full (${MAX_PENDING}) \u2014 oldest record dropped. This indicates sustained high write volume.
+`);
   }
   if (_flushTimer === null) {
     _flushTimer = setInterval(() => {
@@ -478,19 +478,19 @@ async function flushBatch() {
     }
     _nextVersion = baseVersion;
     try {
-      const { insertMemoryCardsForBatch } = await import("./memory-cards-XHZEOX7Q.js");
+      const { insertMemoryCardsForBatch } = await import("./memory-cards-P4ELKIBQ.js");
       await insertMemoryCardsForBatch(batch);
     } catch (e) {
       logStoreWarn("catch", e);
     }
     try {
-      const { insertOntologyForBatch } = await import("./agentic-ontology-ASORFII6.js");
+      const { insertOntologyForBatch } = await import("./agentic-ontology-GBRFTYFS.js");
       await insertOntologyForBatch(batch);
     } catch (e) {
       logStoreWarn("catch", e);
     }
     try {
-      const { extractGraphForBatch } = await import("./memory-graph-extractor-J3K7B4GC.js");
+      const { extractGraphForBatch } = await import("./memory-graph-extractor-LTOZ7QRR.js");
       await extractGraphForBatch(batch);
     } catch (e) {
       logStoreWarn("catch", e);
@@ -498,7 +498,7 @@ async function flushBatch() {
     schedulePostWriteMemoryHygiene(batch.map((row) => row.id));
     _pendingRecords.splice(0, batch.length);
     try {
-      const { isShardingEnabled, getReadyShardClient } = await import("./shard-manager-ON2WWCRM.js");
+      const { isShardingEnabled, getReadyShardClient } = await import("./shard-manager-PWSOXHZ4.js");
       if (process.env.EXE_DISABLE_SHARDING !== "1" && isShardingEnabled()) {
         const byProject = /* @__PURE__ */ new Map();
         let skippedUnknown = 0;
@@ -575,7 +575,7 @@ function buildRawVisibilityFilter(options, columnPrefix) {
 async function searchMemories(queryVector, agentId, options) {
   let client;
   try {
-    const { isShardingEnabled, shardExists, getReadyShardClient } = await import("./shard-manager-ON2WWCRM.js");
+    const { isShardingEnabled, shardExists, getReadyShardClient } = await import("./shard-manager-PWSOXHZ4.js");
     if (isShardingEnabled() && options?.projectName && shardExists(options.projectName)) {
       client = await getReadyShardClient(options.projectName);
     } else {
@@ -603,7 +603,7 @@ async function searchMemories(queryVector, agentId, options) {
                AND COALESCE(confidence, 0.7) >= 0.3`;
   const args = [agentId];
   try {
-    const { founderScopeFilter } = await import("./founder-context-3N6BMG7B.js");
+    const { founderScopeFilter } = await import("./founder-context-ZNGQ5NGW.js");
     const founderFilter = founderScopeFilter(options?.founderId);
     sql += founderFilter.sql;
     args.push(...founderFilter.args.filter((a) => a !== null));

package/dist/{chunk-QHIGMP2M.js → chunk-QDDPNZBG.js}

@@ -1,6 +1,6 @@
 import {
   EXE_AI_DIR
-} from "./chunk-TNTFEWU5.js";
+} from "./chunk-XBXKLACW.js";
 
 // src/lib/db-backup.ts
 import { copyFileSync, existsSync, mkdirSync, readdirSync, unlinkSync, statSync } from "fs";