@askexenow/exe-os 0.9.231 → 0.9.233

package/dist/{chunk-X3AVWFWW.js → chunk-BRFH5X7G.js}

@@ -1,6 +1,6 @@
 import {
   EXE_AI_DIR
-} from "./chunk-TNTFEWU5.js";
+} from "./chunk-TRZ5KA2R.js";
 
 // src/lib/background-jobs.ts
 import { existsSync, mkdirSync, readFileSync, writeFileSync, unlinkSync } from "fs";

package/dist/{chunk-Q5GUJUDW.js → chunk-BWHBPDYB.js}

@@ -1,7 +1,7 @@
 import {
   getIdentity,
   loadEmployeesSync
-} from "./chunk-UJOSFVWG.js";
+} from "./chunk-VTLUUTWI.js";
 
 // src/lib/drift-probes.ts
 var DRIFT_THRESHOLD = 80;

package/dist/{chunk-ETSREHYC.js → chunk-BZWKTFEB.js}

@@ -1,10 +1,10 @@
 import {
   enqueueMemory
-} from "./chunk-AZSCW64F.js";
+} from "./chunk-UPMHG7ET.js";
 import {
   isClientConnected,
   sendDaemonRequest
-} from "./chunk-L24HYX62.js";
+} from "./chunk-VHKL4S4T.js";
 
 // src/lib/memory-queue-client.ts
 async function writeMemoryViaDaemon(entry) {

package/dist/{chunk-NXF7NZEA.js → chunk-C2D37S73.js}

@@ -1,6 +1,6 @@
 import {
   getClient
-} from "./chunk-UJOSFVWG.js";
+} from "./chunk-VTLUUTWI.js";
 
 // src/lib/pipeline-router.ts
 import crypto from "crypto";
@@ -82,7 +82,7 @@ async function sinkMemory(msg, agentResponse, agentName) {
 }
 async function sinkCRM(msg, agentResponse, agentName) {
   try {
-    const { isCRMBridgeEnabled, pushConversationToCRM, pushInboundMessageToCRM } = await import("./crm-bridge-NG5WJMGF.js");
+    const { isCRMBridgeEnabled, pushConversationToCRM, pushInboundMessageToCRM } = await import("./crm-bridge-BVTB6LZK.js");
     if (!isCRMBridgeEnabled()) return false;
     if (agentResponse) {
       await pushConversationToCRM({
@@ -116,12 +116,12 @@ async function sinkCRM(msg, agentResponse, agentName) {
 }
 async function sinkWiki(msg, agentResponse) {
   try {
-    const { createWikiClient } = await import("./wiki-client-KE622HKY.js");
+    const { createWikiClient } = await import("./wiki-client-MAFYBXCQ.js");
     const client = await createWikiClient();
     if (!client) return false;
     const content = msg.text ?? "";
     if (content.length < 50) return false;
-    const { chatInWorkspace } = await import("./wiki-client-KE622HKY.js");
+    const { chatInWorkspace } = await import("./wiki-client-MAFYBXCQ.js");
     const ingestText = [
       `[${msg.platform}] Message from ${msg.senderName ?? msg.senderId} (${msg.timestamp}):`,
       content,
@@ -140,8 +140,8 @@ Agent response: ${agentResponse}` : ""
 }
 async function sinkEntityExtraction(msg, agentResponse, agentName) {
   try {
-    const { extractFromConversation } = await import("./conversation-entity-extractor-TW4W57K4.js");
-    const { storeExtraction } = await import("./graph-rag-S5SBJW5J.js");
+    const { extractFromConversation } = await import("./conversation-entity-extractor-EYSI4DKM.js");
+    const { storeExtraction } = await import("./graph-rag-G3EG5Q6L.js");
     if ((msg.text?.length ?? 0) < 20) return false;
     if (msg.isHistorical) return false;
     const extraction = await extractFromConversation(msg, agentResponse, agentName);
@@ -149,7 +149,7 @@ async function sinkEntityExtraction(msg, agentResponse, agentName) {
     const client = getClient();
     const memoryId = `conv:${msg.messageId}`;
     await storeExtraction(client, extraction, memoryId, msg.timestamp);
-    import("./conversation-wiki-populator-GNFRTS7X.js").then(
+    import("./conversation-wiki-populator-YU35LNRK.js").then(
       ({ populateWikiFromExtraction }) => populateWikiFromExtraction(extraction, msg, agentResponse, agentName)
     ).catch((err) => {
       process.stderr.write(

package/dist/{chunk-2V5UDX2O.js → chunk-C36GJWKH.js}

@@ -1,6 +1,6 @@
 import {
   routeTask
-} from "./chunk-Z3TT2SVJ.js";
+} from "./chunk-OMHTKVHC.js";
 import {
   createTaskCore,
   employeeSessionName,
@@ -9,11 +9,11 @@ import {
   isEmployeeAlive,
   sessionScopeFilter,
   updateTaskStatus
-} from "./chunk-J5WI42RB.js";
+} from "./chunk-QRHVGJOB.js";
 import {
   DEFAULT_COORDINATOR_TEMPLATE_NAME,
   getCoordinatorName
-} from "./chunk-UJOSFVWG.js";
+} from "./chunk-VTLUUTWI.js";
 
 // src/runtime/orchestrator.ts
 var STALE_THRESHOLD_MS = 2 * 60 * 60 * 1e3;

package/dist/{chunk-2EHYQKJR.js → chunk-CGBH7RVU.js}

@@ -1,24 +1,24 @@
 import {
   recordSessionKill
-} from "./chunk-FIPU4BDF.js";
+} from "./chunk-5NIUTWV4.js";
 import {
   sessionScopeFilter,
   verifyPaneAtCapacity,
   writeNotification
-} from "./chunk-J5WI42RB.js";
+} from "./chunk-QRHVGJOB.js";
 import {
   listSessions
-} from "./chunk-G4LLKD4Z.js";
+} from "./chunk-J5MOKLCJ.js";
 import {
   getTransport
 } from "./chunk-MVW62NIZ.js";
 import {
   recordOrchestrationEventBestEffort
-} from "./chunk-CTFKTUYN.js";
+} from "./chunk-YXRY4LH2.js";
 import {
   getClient,
   isCoordinatorName
-} from "./chunk-UJOSFVWG.js";
+} from "./chunk-VTLUUTWI.js";
 
 // src/lib/capacity-monitor.ts
 var CAPACITY_PATTERNS = [

package/dist/{chunk-26PUEPOY.js → chunk-CKTFH5RQ.js}

@@ -1,12 +1,12 @@
 import {
   storeBehavior
-} from "./chunk-7DNX45WB.js";
+} from "./chunk-2QRT6G4V.js";
 import {
   getClient
-} from "./chunk-UJOSFVWG.js";
+} from "./chunk-VTLUUTWI.js";
 import {
   loadConfig
-} from "./chunk-TNTFEWU5.js";
+} from "./chunk-TRZ5KA2R.js";
 
 // src/lib/skill-learning.ts
 import crypto from "crypto";

package/dist/{chunk-UV4ZHXUP.js → chunk-CNCTKOX2.js}

@@ -1,6 +1,6 @@
 import {
   listReminders
-} from "./chunk-R2E4TV5V.js";
+} from "./chunk-L6LDDOYW.js";
 
 // src/mcp/tools/list-reminders.ts
 import { z } from "zod";

package/dist/{chunk-D4IVTUNN.js → chunk-D5C56WO3.js}

@@ -1,6 +1,6 @@
 import {
   EXE_AI_DIR
-} from "./chunk-TNTFEWU5.js";
+} from "./chunk-TRZ5KA2R.js";
 
 // src/lib/license.ts
 import { readFileSync, writeFileSync, existsSync, mkdirSync, statSync } from "fs";

package/dist/{chunk-I2CDSGQW.js → chunk-DIO7YUAT.js}

@@ -1,6 +1,6 @@
 import {
   recordOrchestrationEventBestEffort
-} from "./chunk-CTFKTUYN.js";
+} from "./chunk-YXRY4LH2.js";
 
 // src/lib/worktree.ts
 import { execSync } from "child_process";

package/dist/{chunk-A2G6WCUO.js → chunk-EMOIEQ4A.js}

@@ -8,7 +8,7 @@ async function fastDbInit() {
   if (!forceDirect) {
     try {
       const { connectEmbedDaemon, sendDaemonRequest, isClientConnected, disconnectClient } = await import("./lib/exe-daemon-client.js");
-      const { deserializeResultSet } = await import("./daemon-protocol-4FUHT5NH.js");
+      const { deserializeResultSet } = await import("./daemon-protocol-XW2OLNBS.js");
       await Promise.race([
         connectEmbedDaemon(),
         new Promise((_, reject) => setTimeout(() => reject(new Error("Daemon socket timeout (2s)")), 2e3))

package/dist/{chunk-HQMEOIUJ.js → chunk-EPWDTS2Q.js}

@@ -2,7 +2,7 @@ import {
   connectEmbedDaemon,
   disconnectClient,
   embedViaClient
-} from "./chunk-L24HYX62.js";
+} from "./chunk-VHKL4S4T.js";
 import {
   EMBEDDING_DIM
 } from "./chunk-FXU7JOXK.js";

package/dist/{chunk-6MP5NOOR.js → chunk-ESKBZN4Q.js}

@@ -1,6 +1,6 @@
 import {
   loadConfigSync
-} from "./chunk-TNTFEWU5.js";
+} from "./chunk-TRZ5KA2R.js";
 
 // src/lib/push-notifications.ts
 import { execSync } from "child_process";

package/dist/{chunk-3CLQFRM6.js → chunk-F4CQKTVZ.js}

@@ -1,22 +1,23 @@
 import {
   extractMemoryGraph
-} from "./chunk-36DAY227.js";
+} from "./chunk-Y2PQS2GI.js";
 import {
   flushBatch,
   writeMemory
-} from "./chunk-5HF7X4WH.js";
+} from "./chunk-LEK3ANCA.js";
 import {
   extractKeywords
 } from "./chunk-CHCA3ZM2.js";
 import {
   getActiveAgent
-} from "./chunk-DLXTKVBO.js";
+} from "./chunk-ZOPLM7G3.js";
 
 // src/mcp/tools/import-conversations.ts
 import { z } from "zod";
 import crypto from "crypto";
 import { readdir, readFile, stat } from "fs/promises";
-import path from "path";
+import path, { resolve, normalize } from "path";
+import os from "os";
 
 // src/lib/conversation-parser.ts
 function detectFormat(content, filePath) {
@@ -231,6 +232,27 @@ function registerImportConversations(server) {
       const { agentId: currentAgentId, agentRole } = getActiveAgent();
       const agentId = overrideAgentId ?? currentAgentId;
       const projectName = project_name ?? "imported";
+      const resolvedPath = resolve(normalize(inputPath));
+      const home = process.env.HOME || os.homedir();
+      const blocked = ["/etc", "/root", "/var", "/usr", "/sys", "/proc"];
+      const sensitiveHome = [".ssh", ".gnupg", ".aws", ".config/gcloud"];
+      for (const dir of blocked) {
+        if (resolvedPath.startsWith(dir + "/") || resolvedPath === dir) {
+          return {
+            content: [{ type: "text", text: `Access denied: cannot read files from ${dir}` }],
+            isError: true
+          };
+        }
+      }
+      for (const rel of sensitiveHome) {
+        const full = resolve(home, rel);
+        if (resolvedPath.startsWith(full + "/") || resolvedPath === full) {
+          return {
+            content: [{ type: "text", text: `Access denied: cannot read files from ~/${rel}` }],
+            isError: true
+          };
+        }
+      }
       let files;
       try {
         files = await readInputFiles(inputPath);

package/dist/{chunk-GFCQJZTO.js → chunk-F4TCKCKK.js}

@@ -1,6 +1,6 @@
 import {
   loadLicense
-} from "./chunk-D4IVTUNN.js";
+} from "./chunk-D5C56WO3.js";
 
 // src/lib/stack-update.ts
 import { execFileSync, spawnSync } from "child_process";
@@ -565,7 +565,7 @@ async function runStackUpdate(options) {
   warnLegacyDaemonVolume();
   if (!options.dryRun) {
     try {
-      const { runPreflight } = await import("./preflight-TZOGLBZU.js");
+      const { runPreflight } = await import("./preflight-EAH2MI76.js");
       const preflightReport = runPreflight({
         composeFile: options.composeFile,
         envFile: options.envFile

package/dist/{chunk-I32QME33.js → chunk-FOP5EAJZ.js}

@@ -1,9 +1,9 @@
 import {
   recordSessionKill
-} from "./chunk-FIPU4BDF.js";
+} from "./chunk-5NIUTWV4.js";
 import {
   updateTask
-} from "./chunk-5X3ISBHJ.js";
+} from "./chunk-GQHV2QYL.js";
 import {
   ensureEmployee,
   extractRootExe,
@@ -14,13 +14,13 @@ import {
   sessionScopeFilter,
   strictSessionScopeFilter,
   writeNotification
-} from "./chunk-J5WI42RB.js";
+} from "./chunk-QRHVGJOB.js";
 import {
   queueIntercom
 } from "./chunk-QI4IXJN7.js";
 import {
   listSessions
-} from "./chunk-G4LLKD4Z.js";
+} from "./chunk-J5MOKLCJ.js";
 import {
   getTransport
 } from "./chunk-MVW62NIZ.js";
@@ -30,18 +30,18 @@ import {
 } from "./chunk-CX6GL3ZJ.js";
 import {
   recordOrchestrationEventBestEffort
-} from "./chunk-CTFKTUYN.js";
+} from "./chunk-YXRY4LH2.js";
 import {
   getAgentRuntime
-} from "./chunk-GVP5U4WL.js";
+} from "./chunk-6OJJF4WP.js";
 import {
   baseAgentName,
   isCoordinatorName,
   shouldAutoInstance
-} from "./chunk-UJOSFVWG.js";
+} from "./chunk-VTLUUTWI.js";
 import {
   loadConfigSync
-} from "./chunk-TNTFEWU5.js";
+} from "./chunk-TRZ5KA2R.js";
 
 // src/lib/daemon-orchestration.ts
 import { execSync } from "child_process";
@@ -1655,7 +1655,7 @@ async function reapOrphanedWorktrees(deps, nowMs = Date.now()) {
 }
 async function createWorktreeReaperRealDeps() {
   const { getPaneCwdAsync } = await import("./lib/tmux-status.js");
-  const { getGitRoot, isWorktreeDirty: isDirty } = await import("./worktree-BO7QQ32T.js");
+  const { getGitRoot, isWorktreeDirty: isDirty } = await import("./worktree-Q6Y5IHSI.js");
   const { statSync: statSync2 } = await import("fs");
   const { basename } = await import("path");
   const { promisify } = await import("util");
@@ -1796,7 +1796,7 @@ async function gcStaleCheckpoints() {
 }
 async function pollTaskGroupBarriers() {
   try {
-    const { checkAndFireBarriers } = await import("./tasks-crud-2FX6NTL2.js");
+    const { checkAndFireBarriers } = await import("./tasks-crud-CHPEFXSN.js");
     const firedGroupIds = await checkAndFireBarriers();
     if (firedGroupIds.length === 0) return 0;
     const { getClient } = await import("./lib/database.js");

package/dist/{chunk-N4C2RMEO.js → chunk-G5WLNJSC.js}

@@ -1,6 +1,6 @@
 import {
   EXE_AI_DIR
-} from "./chunk-TNTFEWU5.js";
+} from "./chunk-TRZ5KA2R.js";
 
 // src/lib/worker-gate.ts
 import { readdirSync, writeFileSync, unlinkSync, mkdirSync, existsSync, readFileSync } from "fs";
@@ -111,7 +111,7 @@ function releaseBackfillLock() {
 }
 async function getTaskAwareCapacity() {
   const { getClient } = await import("./lib/database.js");
-  const { sessionScopeFilter } = await import("./task-scope-N6GNTTVY.js");
+  const { sessionScopeFilter } = await import("./task-scope-7TDJLRUR.js");
   const client = getClient();
   const scope = sessionScopeFilter();
   const result = await client.execute({

package/dist/{chunk-2VZ6SY2R.js → chunk-GBCZXOWU.js}

@@ -98,18 +98,22 @@ function ensurePath(home, binDir) {
   if (process.env.PATH?.split(path.delimiter).includes(binDir)) {
     return false;
   }
-  const exportLine = `
+  const shell = process.env.SHELL ?? "/bin/bash";
+  const isFish = shell.includes("fish");
+  const exportLine = isFish ? `
+# exe-os session commands
+set -gx PATH ${binDir} $PATH
+` : `
 # exe-os session commands
 export PATH="${binDir}:$PATH"
 `;
-  const shell = process.env.SHELL ?? "/bin/bash";
   const profilePaths = [];
   if (shell.includes("zsh")) {
     profilePaths.push(path.join(home, ".zshrc"));
   } else if (shell.includes("bash")) {
     profilePaths.push(path.join(home, ".bashrc"));
     profilePaths.push(path.join(home, ".bash_profile"));
-  } else if (shell.includes("fish")) {
+  } else if (isFish) {
     profilePaths.push(path.join(home, ".config", "fish", "config.fish"));
   } else {
     profilePaths.push(path.join(home, ".profile"));

package/dist/{chunk-5X3ISBHJ.js → chunk-GQHV2QYL.js}

@@ -11,16 +11,16 @@ import {
   sessionScopeFilter,
   updateTaskStatus,
   writeNotification
-} from "./chunk-J5WI42RB.js";
+} from "./chunk-QRHVGJOB.js";
 import {
   getTransport
 } from "./chunk-MVW62NIZ.js";
 import {
   recordOrchestrationEventBestEffort
-} from "./chunk-CTFKTUYN.js";
+} from "./chunk-YXRY4LH2.js";
 import {
   getAgentRuntime
-} from "./chunk-GVP5U4WL.js";
+} from "./chunk-6OJJF4WP.js";
 import {
   getSessionKey
 } from "./chunk-CVYC6DUW.js";
@@ -33,10 +33,10 @@ import {
   isCoordinatorName,
   isMultiInstance,
   shouldAutoInstance
-} from "./chunk-UJOSFVWG.js";
+} from "./chunk-VTLUUTWI.js";
 import {
   EXE_AI_DIR
-} from "./chunk-TNTFEWU5.js";
+} from "./chunk-TRZ5KA2R.js";
 
 // src/lib/tasks.ts
 import path2 from "path";
@@ -75,7 +75,7 @@ async function cascadeUnblock(taskId, baseDir, now) {
   }
   if (unblockedRows.rows.length > 0 && !process.env.VITEST) {
     try {
-      const { queueIntercom } = await import("./intercom-queue-USIXVVJQ.js");
+      const { queueIntercom } = await import("./intercom-queue-RNM6EPGA.js");
       const dispatched = /* @__PURE__ */ new Set();
       for (const ur of unblockedRows.rows) {
         const assignee = String(ur.assigned_to);
@@ -159,7 +159,7 @@ async function dispatchTaskToEmployee(input) {
   let crossProject = false;
   if (input.projectName) {
     try {
-      const { assertSessionScope } = await import("./session-scope-CUDNSN62.js");
+      const { assertSessionScope } = await import("./session-scope-EHSZJLAT.js");
       const check = assertSessionScope("dispatch_task", input.projectName);
       if (check.reason === "cross_session_denied") {
         crossProject = true;
@@ -460,7 +460,7 @@ async function updateTask(input) {
         try {
           process.stderr.write(`[tasks] EVENT: tmux delivery failed for reviewer="${reviewer}". Queueing for daemon delivery.
 `);
-          const { queueIntercom } = await import("./intercom-queue-USIXVVJQ.js");
+          const { queueIntercom } = await import("./intercom-queue-RNM6EPGA.js");
           const { resolveExeSession: resolveExeSession2 } = await import("./lib/tmux-routing.js");
           const exeSession = row.session_scope ? String(row.session_scope) : resolveExeSession2();
           if (exeSession) {
@@ -473,7 +473,7 @@ async function updateTask(input) {
         }
       }
       try {
-        const { pushNotifyAsync } = await import("./push-notifications-3GNJ5SZS.js");
+        const { pushNotifyAsync } = await import("./push-notifications-E2XXEWJZ.js");
         pushNotifyAsync({
           event: "review_ready",
           title: `Review ready: ${taskTitle.slice(0, 50)}`,
@@ -485,7 +485,7 @@ async function updateTask(input) {
     }
     if (!isCoordinator) {
       try {
-        const { pushNotifyAsync } = await import("./push-notifications-3GNJ5SZS.js");
+        const { pushNotifyAsync } = await import("./push-notifications-E2XXEWJZ.js");
         const event = input.status === "needs_review" ? "review_ready" : "task_complete";
         pushNotifyAsync({
           event,
@@ -500,7 +500,7 @@ async function updateTask(input) {
     await markTaskNotificationsRead(taskFile);
     if (input.status === "needs_review" && !isCoordinator) {
       try {
-        const { writeNotification: writeNotification2 } = await import("./notifications-MEW6QY57.js");
+        const { writeNotification: writeNotification2 } = await import("./notifications-A3OLWT3R.js");
         await writeNotification2({
           agentId: String(row.assigned_to),
           agentRole: String(row.assigned_to),

package/dist/{chunk-QYUWMF3P.js → chunk-HBJZ5QZI.js}

@@ -1,6 +1,6 @@
 import {
   MODELS_DIR
-} from "./chunk-TNTFEWU5.js";
+} from "./chunk-TRZ5KA2R.js";
 
 // src/lib/reranker.ts
 import path from "path";

package/dist/{chunk-WUFPA6LR.js → chunk-HIWXAE6E.js}

@@ -1,10 +1,10 @@
 import {
   initStore
-} from "./chunk-5HF7X4WH.js";
+} from "./chunk-LEK3ANCA.js";
 import {
   getClient,
   isInitialized
-} from "./chunk-UJOSFVWG.js";
+} from "./chunk-VTLUUTWI.js";
 
 // src/lib/schedules.ts
 import crypto from "crypto";

package/dist/{chunk-CHT3THVG.js → chunk-J2QQMTCD.js}

@@ -2,7 +2,7 @@ import {
   getClient,
   isCoordinatorName,
   loadEmployeesSync
-} from "./chunk-UJOSFVWG.js";
+} from "./chunk-VTLUUTWI.js";
 
 // src/lib/steward-gate.ts
 import crypto from "crypto";

package/dist/{chunk-G4LLKD4Z.js → chunk-J5MOKLCJ.js}

@@ -1,6 +1,6 @@
 import {
   recordOrchestrationEventBestEffort
-} from "./chunk-CTFKTUYN.js";
+} from "./chunk-YXRY4LH2.js";
 
 // src/lib/session-registry.ts
 import { readFileSync, writeFileSync, mkdirSync, existsSync } from "fs";

package/dist/{chunk-B5AEHLZQ.js → chunk-JFUVMMBE.js}

@@ -4,17 +4,17 @@ import {
   resolveExeSession,
   sendIntercom,
   strictSessionScopeFilter
-} from "./chunk-J5WI42RB.js";
+} from "./chunk-QRHVGJOB.js";
 import {
   parseMessage,
   serializeMessage
 } from "./chunk-4JERP7NT.js";
 import {
   recordOrchestrationEventBestEffort
-} from "./chunk-CTFKTUYN.js";
+} from "./chunk-YXRY4LH2.js";
 import {
   getClient
-} from "./chunk-UJOSFVWG.js";
+} from "./chunk-VTLUUTWI.js";
 
 // src/lib/messaging.ts
 import crypto from "crypto";

package/dist/{chunk-YADYM2DE.js → chunk-JL3K5OTS.js}

@@ -1,6 +1,6 @@
 import {
   EXE_AI_DIR
-} from "./chunk-TNTFEWU5.js";
+} from "./chunk-TRZ5KA2R.js";
 import {
   enforcePrivateFileSync,
   ensurePrivateDirSync

package/dist/{chunk-GGV3PFUW.js → chunk-JZMVLAZ2.js}

@@ -1,7 +1,7 @@
 import {
   checkLicense,
   loadLicense
-} from "./chunk-D4IVTUNN.js";
+} from "./chunk-D5C56WO3.js";
 
 // src/lib/license-gate.ts
 var _cachedLicense = null;

package/dist/{chunk-7NNXBDOO.js → chunk-KDJRFJDL.js}

@@ -1,7 +1,7 @@
 // src/lib/keychain.ts
 import { readFile, writeFile, unlink, mkdir, chmod, rename, copyFile } from "fs/promises";
 import { existsSync, statSync, writeFileSync, readFileSync } from "fs";
-import { execSync } from "child_process";
+import { execSync, execFileSync, spawnSync } from "child_process";
 import crypto from "crypto";
 import path from "path";
 import os from "os";
@@ -108,17 +108,18 @@ function macKeychainSet(value, service = SERVICE) {
   if (!nativeKeychainAllowed()) return false;
   if (process.platform !== "darwin") return false;
   try {
+    process.stderr.write("[exe-os] Storing encryption key in macOS Keychain. You may see a system prompt \u2014 please allow it.\n");
     try {
-      execSync(
-        `security delete-generic-password -s "${service}" -a "${ACCOUNT}" 2>/dev/null`,
-        { timeout: 5e3 }
-      );
+      execFileSync("security", ["delete-generic-password", "-s", service, "-a", ACCOUNT], {
+        timeout: 5e3,
+        stdio: ["pipe", "pipe", "pipe"]
+      });
     } catch {
     }
-    execSync(
-      `security add-generic-password -s "${service}" -a "${ACCOUNT}" -w "${value}"`,
-      { timeout: 5e3 }
-    );
+    execFileSync("security", ["add-generic-password", "-s", service, "-a", ACCOUNT, "-w", value], {
+      timeout: 5e3,
+      stdio: ["pipe", "pipe", "pipe"]
+    });
     return true;
   } catch {
     return false;
@@ -151,11 +152,20 @@ function linuxSecretGet(service = SERVICE) {
 function linuxSecretSet(value, service = SERVICE) {
   if (!linuxSecretAvailable()) return false;
   try {
-    execSync(
-      `echo -n "${value}" | secret-tool store --label="exe-os master key" service "${service}" account "${ACCOUNT}" 2>/dev/null`,
-      { timeout: 5e3 }
-    );
-    return true;
+    const result = spawnSync("secret-tool", [
+      "store",
+      "--label",
+      "exe-os master key",
+      "service",
+      service,
+      "account",
+      ACCOUNT
+    ], {
+      input: value,
+      stdio: ["pipe", "pipe", "pipe"],
+      timeout: 5e3
+    });
+    return result.status === 0;
   } catch {
     return false;
   }
@@ -310,7 +320,7 @@ async function getMasterKey() {
       const decrypted = decryptWithMachineKey(content, machineKey);
       if (!decrypted) {
         process.stderr.write(
-          "[keychain] Key decryption failed \u2014 machine may have changed.\n  Use your 24-word recovery phrase during setup: exe-os setup\n"
+          "[keychain] Your computer's hostname or username appears to have changed.\n  Use your 24-word recovery phrase to restore: exe-os setup (option 2)\n"
         );
         return null;
       }
@@ -506,7 +516,7 @@ async function loadBip39() {
     return await import("bip39");
   } catch {
     throw new Error(
-      "bip39 package not found. Run: npm install -g bip39\nOr reinstall exe-os: npm install -g @askexenow/exe-os"
+      "bip39 package not found. Reinstall exe-os: npm install -g @askexenow/exe-os@latest"
     );
   }
 }

package/dist/{chunk-R2E4TV5V.js → chunk-L6LDDOYW.js}

@@ -1,6 +1,6 @@
 import {
   getClient
-} from "./chunk-UJOSFVWG.js";
+} from "./chunk-VTLUUTWI.js";
 
 // src/lib/reminders.ts
 import crypto from "crypto";