@askexenow/exe-os 0.9.255 → 0.9.259

package/dist/bin/install.js

@@ -6,21 +6,24 @@ import {
   setupGhostty,
   setupTmux,
   setupWezterm
-} from "../chunk-VRWOLLKN.js";
+} from "../chunk-T4NFOOPB.js";
 import "../chunk-GNHN5HRQ.js";
-import "../chunk-MRZE5IOP.js";
+import "../chunk-CXOX7TRG.js";
 import {
   generateSessionWrappers
 } from "../chunk-GBCZXOWU.js";
 import "../chunk-L3TB7CC3.js";
+import {
+  computeDaemonHeapCapMb
+} from "../chunk-3XX3CDKF.js";
 import {
   requestDeployRestart,
   updateMcpVersionMarker
 } from "../chunk-PWMMIGVQ.js";
-import "../chunk-R7FBOZT5.js";
+import "../chunk-ISL3NSVX.js";
 import "../chunk-HYZV25LY.js";
-import "../chunk-5U7WB4YG.js";
-import "../chunk-ITPIBVSG.js";
+import "../chunk-WVBZ3QBR.js";
+import "../chunk-WMZTSHNX.js";
 import "../chunk-FXU7JOXK.js";
 import "../chunk-VXIMSRTO.js";
 import "../chunk-LYH5HE24.js";
@@ -49,7 +52,7 @@ async function spawnDaemonInline(pkgRoot) {
     stderrFd = openSync(logPath, "a");
   } catch {
   }
-  const heapCapMB = Math.max(2048, Math.round(totalGB * 0.33 * 1024));
+  const heapCapMB = computeDaemonHeapCapMb(totalGB);
   const child = spawn(process.execPath, [`--max-old-space-size=${heapCapMB}`, daemonPath], {
     detached: true,
     stdio: ["ignore", "ignore", stderrFd],
@@ -117,7 +120,7 @@ function setupDaemonKeepalive() {
   const daemonPath = path.join(pkgRoot, "dist", "lib", "exe-daemon.js");
   const nodePath = process.execPath;
   const home = os.homedir();
-  const heapCapMB = totalGB <= 8 ? 256 : totalGB <= 16 ? 2048 : Math.min(Math.round(totalGB * 0.25 * 1024), 6144);
+  const heapCapMB = computeDaemonHeapCapMb(totalGB);
   const plistContent = `<?xml version="1.0" encoding="UTF-8"?>
 <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
 <plist version="1.0">
@@ -243,7 +246,7 @@ function setupLinuxSystemdService() {
   const nodePath = process.execPath;
   const home = os.homedir();
   const totalGB = os.totalmem() / (1024 * 1024 * 1024);
-  const heapCapMB = totalGB <= 8 ? 256 : totalGB <= 16 ? 2048 : Math.min(Math.round(totalGB * 0.25 * 1024), 6144);
+  const heapCapMB = computeDaemonHeapCapMb(totalGB);
   const serviceDir = path.join(home, ".config", "systemd", "user");
   const servicePath = path.join(serviceDir, "exe-os.service");
   const serviceContent = `[Unit]
@@ -393,7 +396,7 @@ if (args.includes("--commands-only")) {
     }
     try {
       execSync("which codex", { encoding: "utf8", timeout: 5e3 });
-      const { runCodexInstaller } = await import("../installer-GFZVC43I.js");
+      const { runCodexInstaller } = await import("../installer-TCMPFSSP.js");
       await runCodexInstaller();
     } catch {
     }

package/dist/bin/intercom-check.js

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 import {
   fastDbInit
-} from "../chunk-LY2DYTDL.js";
+} from "../chunk-RFJESVEL.js";
 import "../chunk-MLKGABMK.js";
 
 // src/bin/intercom-check.ts
@@ -17,7 +17,7 @@ async function main() {
   }
   if (isCoordinator) {
     try {
-      const { listPendingReviews, cleanupOrphanedReviews, formatAge, isStale } = await import("../tasks-review-Y5F4HRAR.js");
+      const { listPendingReviews, cleanupOrphanedReviews, formatAge, isStale } = await import("../tasks-review-VMMMAK2Y.js");
       const { extractRootExe } = await import("../lib/tmux-routing.js");
       let sessionScope = process.env.EXE_SESSION ? extractRootExe(process.env.EXE_SESSION) ?? void 0 : void 0;
       if (!sessionScope) {
@@ -94,7 +94,7 @@ async function main() {
   }
   if (!isCoordinator) {
     try {
-      const { listBehaviors } = await import("../behaviors-G6QHSQBN.js");
+      const { listBehaviors } = await import("../behaviors-2TZCFJLU.js");
       const sessionStart = process.env.EXE_SESSION_START_ISO ?? "";
       if (sessionStart) {
         const behaviors = await listBehaviors(agent);
@@ -113,7 +113,7 @@ async function main() {
     }
   }
   try {
-    const { readUnreadNotifications, markAsRead } = await import("../notifications-BETWD6EK.js");
+    const { readUnreadNotifications, markAsRead } = await import("../notifications-ZKGLZVCU.js");
     const { resolveExeSession } = await import("../lib/tmux-routing.js");
     const sessionScope = resolveExeSession();
     const notifications = await readUnreadNotifications(agent, sessionScope);

package/dist/bin/mcp-sessions.js

@@ -45,10 +45,10 @@ async function collectSessions() {
   const registryMap = new Map(registry.map((r) => [r.windowName, r]));
   const taskMap = /* @__PURE__ */ new Map();
   try {
-    const { fastDbInit } = await import("../fast-db-init-QXGL2PKQ.js");
+    const { fastDbInit } = await import("../fast-db-init-GCY3F74H.js");
     await fastDbInit();
     const { getClient } = await import("../lib/database.js");
-    const { sessionScopeFilter } = await import("../task-scope-XKNAY5S7.js");
+    const { sessionScopeFilter } = await import("../task-scope-AKF3CSWO.js");
     const client = getClient();
     const scope = sessionScopeFilter();
     const result = await client.execute({

package/dist/bin/orchestration-metrics.js

@@ -1,13 +1,13 @@
 #!/usr/bin/env node
 import {
   fastDbInit
-} from "../chunk-LY2DYTDL.js";
+} from "../chunk-RFJESVEL.js";
 import {
   formatOrchestrationMetrics,
   getOrchestrationMetrics
-} from "../chunk-USLVSLQ5.js";
-import "../chunk-5U7WB4YG.js";
-import "../chunk-ITPIBVSG.js";
+} from "../chunk-VDCPKJUQ.js";
+import "../chunk-WVBZ3QBR.js";
+import "../chunk-WMZTSHNX.js";
 import "../chunk-FXU7JOXK.js";
 import "../chunk-VXIMSRTO.js";
 import "../chunk-LYH5HE24.js";

package/dist/bin/postgres-agentic-reflection-backfill.js

@@ -1,8 +1,8 @@
 #!/usr/bin/env node
 import {
   buildReflectionCheckpoint
-} from "../chunk-5B2AEXVA.js";
-import "../chunk-Y2FVN7CX.js";
+} from "../chunk-IVSRRIRG.js";
+import "../chunk-EYLQRPHF.js";
 import {
   pgSslConfig
 } from "../chunk-EQSQ4HBW.js";
@@ -21,7 +21,7 @@ function arg(name) {
   return i >= 0 ? process.argv[i + 1] : void 0;
 }
 async function ensureSchema(client) {
-  await client.query(`CREATE TABLE IF NOT EXISTS memory.agent_reflection_checkpoints (
+  await client.query(`CREATE TABLE IF NOT EXISTS graph.agent_reflection_checkpoints (
     id text PRIMARY KEY,
     project_name text,
     session_id text,
@@ -39,8 +39,8 @@ async function ensureSchema(client) {
     confidence double precision NOT NULL DEFAULT 0,
     created_at timestamp(3) NOT NULL
   )`);
-  await client.query(`CREATE INDEX IF NOT EXISTS idx_agent_reflection_project_time ON memory.agent_reflection_checkpoints (project_name, window_end_at)`);
-  await client.query(`CREATE INDEX IF NOT EXISTS idx_agent_reflection_session_time ON memory.agent_reflection_checkpoints (session_id, window_end_at)`);
+  await client.query(`CREATE INDEX IF NOT EXISTS idx_agent_reflection_project_time ON graph.agent_reflection_checkpoints (project_name, window_end_at)`);
+  await client.query(`CREATE INDEX IF NOT EXISTS idx_agent_reflection_session_time ON graph.agent_reflection_checkpoints (session_id, window_end_at)`);
 }
 async function main() {
   const job = startManagedJob({ type: "postgres-agentic-reflection-backfill", name: "Postgres reflection checkpoint backfill", lowPriority: true });
@@ -62,7 +62,7 @@ async function main() {
     const params = project ? [limit, project] : [limit];
     const result = await client.query(`SELECT id, event_type, occurred_at::text, actor_agent_id, project_name, session_id,
         intention, outcome, impact, evidence_memory_id, payload::text
-      FROM memory.agent_events ${where}
+      FROM graph.agent_events ${where}
       ORDER BY project_name, session_id, occurred_at, sequence_index
       LIMIT $1`, params);
     const groups = /* @__PURE__ */ new Map();
@@ -79,7 +79,7 @@ async function main() {
         if (window.length < minEvents) continue;
         const checkpoint = buildReflectionCheckpoint(window);
         if (!checkpoint) continue;
-        await client.query(`INSERT INTO memory.agent_reflection_checkpoints
+        await client.query(`INSERT INTO graph.agent_reflection_checkpoints
           (id, project_name, session_id, window_start_at, window_end_at, event_count, goal_count,
            success_count, failure_count, risk_count, summary, learnings, next_actions, evidence_event_ids,
            confidence, created_at)

package/dist/bin/postgres-agentic-semantic-backfill.js

@@ -2,7 +2,7 @@
 import {
   inferSemanticLabel,
   stableId
-} from "../chunk-Y2FVN7CX.js";
+} from "../chunk-EYLQRPHF.js";
 import {
   pgSslConfig
 } from "../chunk-EQSQ4HBW.js";
@@ -21,7 +21,7 @@ function arg(name) {
   return i >= 0 ? process.argv[i + 1] : void 0;
 }
 async function ensureSchema(client) {
-  await client.query(`CREATE TABLE IF NOT EXISTS memory.agent_semantic_labels (
+  await client.query(`CREATE TABLE IF NOT EXISTS graph.agent_semantic_labels (
     id text PRIMARY KEY,
     source_memory_id text NOT NULL,
     event_id text,
@@ -32,8 +32,8 @@ async function ensureSchema(client) {
     created_at timestamp(3) NOT NULL,
     updated_at timestamp(3) NOT NULL
   )`);
-  await client.query(`CREATE INDEX IF NOT EXISTS idx_agent_semantic_labels_memory ON memory.agent_semantic_labels (source_memory_id, labeler)`);
-  await client.query(`CREATE INDEX IF NOT EXISTS idx_agent_semantic_labels_event ON memory.agent_semantic_labels (event_id)`);
+  await client.query(`CREATE INDEX IF NOT EXISTS idx_agent_semantic_labels_memory ON graph.agent_semantic_labels (source_memory_id, labeler)`);
+  await client.query(`CREATE INDEX IF NOT EXISTS idx_agent_semantic_labels_event ON graph.agent_semantic_labels (event_id)`);
 }
 function scrubJson(value) {
   return JSON.stringify(value).replace(/\u0000/g, "").replace(/\\u0000/gi, "").replace(/\\\\u0000/gi, "").replace(/\\u00[0-1][0-9a-f]/gi, " ");
@@ -56,7 +56,7 @@ async function main() {
     const where = project ? "WHERE project_name = $2" : "";
     const result = await client.query(`SELECT id, agent_id, agent_role, session_id, timestamp::text, tool_name,
         project_name, has_error, raw_text, version, task_id, intent, null::text as outcome, domain, null::text as trajectory
-      FROM memory.memory_records ${where}
+      FROM graph.memory_records ${where}
       ORDER BY timestamp DESC LIMIT $1`, params);
     let count = 0;
     for (const row of result.rows) {
@@ -64,7 +64,7 @@ async function main() {
       const eventId = stableId(`event:${row.id}`);
       const labelJson = scrubJson(label);
       try {
-        await client.query(`INSERT INTO memory.agent_semantic_labels
+        await client.query(`INSERT INTO graph.agent_semantic_labels
           (id, source_memory_id, event_id, labeler, schema_version, confidence, labels, created_at, updated_at)
           VALUES ($1,$2,$3,$4,$5,$6,to_jsonb($7::text),now(),now())
           ON CONFLICT (id) DO UPDATE SET confidence = excluded.confidence, labels = excluded.labels,
@@ -90,7 +90,7 @@ async function main() {
           summary: label.summary,
           sanitized: true
         });
-        await client.query(`INSERT INTO memory.agent_semantic_labels
+        await client.query(`INSERT INTO graph.agent_semantic_labels
           (id, source_memory_id, event_id, labeler, schema_version, confidence, labels, created_at, updated_at)
           VALUES ($1,$2,$3,$4,$5,$6,$7::jsonb,now(),now())
           ON CONFLICT (id) DO UPDATE SET confidence = excluded.confidence, labels = excluded.labels,

package/dist/bin/scan-tasks.js

@@ -1,28 +1,28 @@
 #!/usr/bin/env node
 import {
   queryTaskRows
-} from "../chunk-CS267UMH.js";
-import "../chunk-6LFFIEDM.js";
+} from "../chunk-5LDTCWYX.js";
+import "../chunk-DU64OESH.js";
 import "../chunk-5CHYEKMH.js";
 import "../chunk-4JERP7NT.js";
-import "../chunk-SD2R3SEA.js";
+import "../chunk-J3YNCJ4A.js";
 import "../chunk-MVW62NIZ.js";
 import "../chunk-OYNKIAVW.js";
 import "../chunk-CX6GL3ZJ.js";
-import "../chunk-USLVSLQ5.js";
+import "../chunk-VDCPKJUQ.js";
 import "../chunk-XJUUWHVN.js";
 import "../chunk-NGP6LSV2.js";
-import "../chunk-VFATLVRX.js";
+import "../chunk-L5VPUOB6.js";
 import {
   getSessionRuntime
 } from "../chunk-CVYC6DUW.js";
 import "../chunk-OPU3NYOO.js";
 import "../chunk-GJV3WDWM.js";
 import "../chunk-MP2AFCGL.js";
-import "../chunk-R7FBOZT5.js";
+import "../chunk-ISL3NSVX.js";
 import "../chunk-HYZV25LY.js";
-import "../chunk-5U7WB4YG.js";
-import "../chunk-ITPIBVSG.js";
+import "../chunk-WVBZ3QBR.js";
+import "../chunk-WMZTSHNX.js";
 import "../chunk-FXU7JOXK.js";
 import "../chunk-MOZ2YQ54.js";
 import "../chunk-VXIMSRTO.js";
@@ -73,7 +73,7 @@ function checkMcpHealth() {
   }
 }
 async function scanFromDb(agentId, tmuxSession, projectName) {
-  const { fastDbInit } = await import("../fast-db-init-QXGL2PKQ.js");
+  const { fastDbInit } = await import("../fast-db-init-GCY3F74H.js");
   try {
     await fastDbInit();
   } catch (err) {

package/dist/bin/setup.js

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 import {
   runSetupWizard
-} from "../chunk-GBHQ5TXO.js";
+} from "../chunk-UOOCGJUE.js";
 import "../chunk-K333WOW4.js";
 import "../chunk-VXIMSRTO.js";
 import "../chunk-LYH5HE24.js";

package/dist/bin/shard-migrate.js

@@ -8,15 +8,15 @@ import {
 import {
   disposeStore,
   initStore
-} from "../chunk-PSQNT5DS.js";
+} from "../chunk-AQS2B3HC.js";
 import "../chunk-CHCA3ZM2.js";
-import "../chunk-AWVDA2FL.js";
+import "../chunk-2H3FVAN3.js";
 import "../chunk-Y25OJWOQ.js";
 import "../chunk-MP2AFCGL.js";
 import {
   getClient
-} from "../chunk-5U7WB4YG.js";
-import "../chunk-ITPIBVSG.js";
+} from "../chunk-WVBZ3QBR.js";
+import "../chunk-WMZTSHNX.js";
 import "../chunk-FXU7JOXK.js";
 import {
   getMasterKey

package/dist/bin/stack-update.js

@@ -10,7 +10,7 @@ import {
   loadStackManifest,
   patchEnv,
   runStackUpdate
-} from "../chunk-KOCQAMAM.js";
+} from "../chunk-ANYOAZCZ.js";
 import {
   runVerifyStack
 } from "../chunk-IRHNV4GY.js";
@@ -20,7 +20,7 @@ import {
 import {
   logResult,
   runHealthGate
-} from "../chunk-JFVITKXI.js";
+} from "../chunk-A2UPDE3J.js";
 import "../chunk-MOZ2YQ54.js";
 import "../chunk-VXIMSRTO.js";
 import "../chunk-LYH5HE24.js";
@@ -197,6 +197,19 @@ function checkEnvContract(envContent) {
   }
   return { check: "env_contract", status: "pass", message: `All ${REQUIRED_ENV_VARS.length} required env vars present` };
 }
+function checkGoTrueSecurity(envContent) {
+  const env = parseEnvFile(envContent);
+  const signupDisabled = env.get("GOTRUE_DISABLE_SIGNUP");
+  const autoconfirm = env.get("GOTRUE_MAILER_AUTOCONFIRM");
+  if (signupDisabled === "false" && autoconfirm === "true") {
+    return {
+      check: "gotrue_security",
+      status: "fail",
+      message: "GOTRUE_DISABLE_SIGNUP=false + GOTRUE_MAILER_AUTOCONFIRM=true \u2014 anyone can create a verified account. Set GOTRUE_DISABLE_SIGNUP=true or GOTRUE_MAILER_AUTOCONFIRM=false."
+    };
+  }
+  return { check: "gotrue_security", status: "pass", message: "GoTrue auth settings are secure" };
+}
 function checkSmoke(composeFile, envFile) {
   const ps = spawnSync("docker", [
     "compose",
@@ -276,6 +289,7 @@ function runPreflight(options) {
   if (existsSync(options.envFile)) {
     const envContent = readFileSync(options.envFile, "utf8");
     results.push(checkEnvContract(envContent));
+    results.push(checkGoTrueSecurity(envContent));
   } else {
     results.push({ check: "env_contract", status: "fail", message: ".env file not found" });
   }
@@ -346,7 +360,8 @@ function parseArgs(args) {
     deploymentPersona: process.env.EXE_STACK_DEPLOYMENT_PERSONA === "askexe-control-plane" ? "askexe-control-plane" : "customer",
     yes: false,
     allowedBreakingChangeIds: [],
-    noBootstrap: false
+    noBootstrap: false,
+    skipHardening: false
   };
   for (let i = 0; i < args.length; i++) {
     const arg = args[i];
@@ -393,6 +408,7 @@ function parseArgs(args) {
     else if (arg === "--domain") opts.domain = next();
     else if (arg.startsWith("--domain=")) opts.domain = arg.split("=").slice(1).join("=");
     else if (arg === "--no-bootstrap") opts.noBootstrap = true;
+    else if (arg === "--skip-hardening") opts.skipHardening = true;
     else if (arg === "--dry-run") opts.dryRun = true;
     else if (arg === "--check") opts.check = true;
     else if (arg === "--yes" || arg === "-y") opts.yes = true;
@@ -447,6 +463,7 @@ Options:
   --allow-breaking <ids>     Confirm breaking changes, comma-separated
   --health-timeout <secs>    Per-service Docker healthcheck wait timeout in seconds (default: 180)
                              Increase for slow-starting services (daemon: 90-120s, CRM: 60-90s)
+  --skip-hardening           Skip post-deploy host hardening (UFW firewall + SSH config)
   -y, --yes                  Non-interactive confirmation
 `);
 }

package/dist/bin/vps-health-gate.js

@@ -8,7 +8,7 @@ import {
   logResult,
   main,
   runHealthGate
-} from "../chunk-JFVITKXI.js";
+} from "../chunk-A2UPDE3J.js";
 import "../chunk-MLKGABMK.js";
 export {
   checkCRM,

package/dist/{capacity-monitor-QMKII67L.js → capacity-monitor-CTFWWTCR.js}

@@ -8,28 +8,28 @@ import {
   isAtCapacity,
   isWithinRelaunchCooldown,
   pollCapacityDead
-} from "./chunk-X7I6NLIA.js";
-import "./chunk-6QMXKKFD.js";
-import "./chunk-CS267UMH.js";
-import "./chunk-6LFFIEDM.js";
+} from "./chunk-T2EUNNUX.js";
+import "./chunk-N27CTUFU.js";
+import "./chunk-5LDTCWYX.js";
+import "./chunk-DU64OESH.js";
 import "./chunk-5CHYEKMH.js";
 import "./chunk-4JERP7NT.js";
-import "./chunk-SD2R3SEA.js";
+import "./chunk-J3YNCJ4A.js";
 import "./chunk-MVW62NIZ.js";
 import "./chunk-OYNKIAVW.js";
 import "./chunk-CX6GL3ZJ.js";
-import "./chunk-USLVSLQ5.js";
+import "./chunk-VDCPKJUQ.js";
 import "./chunk-XJUUWHVN.js";
 import "./chunk-NGP6LSV2.js";
-import "./chunk-VFATLVRX.js";
+import "./chunk-L5VPUOB6.js";
 import "./chunk-CVYC6DUW.js";
 import "./chunk-OPU3NYOO.js";
 import "./chunk-GJV3WDWM.js";
 import "./chunk-MP2AFCGL.js";
-import "./chunk-R7FBOZT5.js";
+import "./chunk-ISL3NSVX.js";
 import "./chunk-HYZV25LY.js";
-import "./chunk-5U7WB4YG.js";
-import "./chunk-ITPIBVSG.js";
+import "./chunk-WVBZ3QBR.js";
+import "./chunk-WMZTSHNX.js";
 import "./chunk-FXU7JOXK.js";
 import "./chunk-MOZ2YQ54.js";
 import "./chunk-VXIMSRTO.js";

package/dist/{catchup-brief-CNISNLV7.js → catchup-brief-UML47LXI.js}

@@ -1,35 +1,35 @@
 import {
   lightweightSearch
-} from "./chunk-LYIUESG2.js";
-import "./chunk-PSQNT5DS.js";
+} from "./chunk-DYURFBPS.js";
+import "./chunk-AQS2B3HC.js";
 import "./chunk-CHCA3ZM2.js";
-import "./chunk-AWVDA2FL.js";
+import "./chunk-2H3FVAN3.js";
 import "./chunk-Y25OJWOQ.js";
 import {
   sessionScopeFilter,
   strictSessionScopeFilter
-} from "./chunk-CS267UMH.js";
-import "./chunk-6LFFIEDM.js";
+} from "./chunk-5LDTCWYX.js";
+import "./chunk-DU64OESH.js";
 import "./chunk-5CHYEKMH.js";
 import "./chunk-4JERP7NT.js";
-import "./chunk-SD2R3SEA.js";
+import "./chunk-J3YNCJ4A.js";
 import "./chunk-MVW62NIZ.js";
 import "./chunk-OYNKIAVW.js";
 import "./chunk-CX6GL3ZJ.js";
-import "./chunk-USLVSLQ5.js";
+import "./chunk-VDCPKJUQ.js";
 import "./chunk-XJUUWHVN.js";
 import "./chunk-NGP6LSV2.js";
-import "./chunk-VFATLVRX.js";
+import "./chunk-L5VPUOB6.js";
 import "./chunk-CVYC6DUW.js";
 import "./chunk-OPU3NYOO.js";
 import "./chunk-GJV3WDWM.js";
 import "./chunk-MP2AFCGL.js";
-import "./chunk-R7FBOZT5.js";
+import "./chunk-ISL3NSVX.js";
 import "./chunk-HYZV25LY.js";
 import {
   getClient
-} from "./chunk-5U7WB4YG.js";
-import "./chunk-ITPIBVSG.js";
+} from "./chunk-WVBZ3QBR.js";
+import "./chunk-WMZTSHNX.js";
 import "./chunk-FXU7JOXK.js";
 import "./chunk-K333WOW4.js";
 import "./chunk-MOZ2YQ54.js";

package/dist/{chunk-QP4FHME2.js → chunk-235ZCOYB.js}

@@ -1,3 +1,10 @@
+import {
+  resolveSupportAdminToken,
+  supportAdminHeaders
+} from "./chunk-2XZ6X3PJ.js";
+import {
+  markSupportReportSentSync
+} from "./chunk-MMRUBN3I.js";
 import {
   loadLicense,
   readCachedLicenseToken
@@ -91,6 +98,7 @@ async function runHealth() {
 async function runTest(project) {
   const checks = await runHealth();
   const endpoints = await resolveEndpoints();
+  const config = await loadConfig();
   const licenseKey = loadLicense();
   const licenseToken = readCachedLicenseToken();
   const id = randomUUID();
@@ -124,7 +132,10 @@ async function runTest(project) {
     markdown: readFileSync(reportPath, "utf8")
   };
   try {
-    const headers = { "content-type": "application/json" };
+    const headers = {
+      "content-type": "application/json",
+      ...supportAdminHeaders(config)
+    };
     if (licenseKey) headers["x-exe-license-key"] = licenseKey;
     if (licenseToken) headers["x-exe-license-token"] = licenseToken;
     const res = await fetch(endpoints.bugEndpoint, {
@@ -141,7 +152,8 @@ async function runTest(project) {
       next: res.ok ? void 0 : nextForPostFailure(res.status)
     });
     if (res.ok) {
-      checks.push(await maybeCloseAdmin(String(data?.id ?? id), endpoints.adminEndpoint, version));
+      markSupportReportSentSync(reportPath);
+      checks.push(await maybeCloseAdmin(String(data?.id ?? id), endpoints.adminEndpoint, version, config));
     }
   } catch (err) {
     checks.push({
@@ -191,8 +203,8 @@ Synthetic smoke test from \`exe-os support test\`. Safe to close.
 `, { mode: 384 });
   return filePath;
 }
-async function maybeCloseAdmin(id, adminEndpoint, version) {
-  const token = process.env.ASKEXE_SUPPORT_ADMIN_TOKEN ?? process.env.EXE_SUPPORT_ADMIN_TOKEN;
+async function maybeCloseAdmin(id, adminEndpoint, version, config) {
+  const token = resolveSupportAdminToken(config);
   if (!token) {
     return { check: "askexe_admin_autoclose", level: "warn", detail: "skipped; admin token is AskExe-only" };
   }
@@ -263,7 +275,7 @@ function nextForPostFailure(status) {
   return "Run `exe-os support health`; if it passes, send this output to AskExe.";
 }
 async function runFlush(json) {
-  const { flushSupportOutbox } = await import("./support-outbox-KEJ73I3F.js");
+  const { flushSupportOutbox } = await import("./support-outbox-SZVLHHZG.js");
   const result = await flushSupportOutbox({ maxPerFlush: 10 });
   if (json) {
     console.log(JSON.stringify(result, null, 2));
@@ -286,7 +298,7 @@ async function runFlush(json) {
   console.log("");
 }
 async function runStatus(json) {
-  const { getOutboxStatus } = await import("./support-outbox-KEJ73I3F.js");
+  const { getOutboxStatus } = await import("./support-outbox-SZVLHHZG.js");
   const status = await getOutboxStatus();
   if (json) {
     console.log(JSON.stringify(status, null, 2));

package/dist/{chunk-2NEQQCRC.js → chunk-25JAXHON.js}

@@ -1,6 +1,6 @@
 import {
   getClient
-} from "./chunk-5U7WB4YG.js";
+} from "./chunk-WVBZ3QBR.js";
 
 // src/lib/behaviors.ts
 import crypto from "crypto";

package/dist/{chunk-MU6ESLYL.js → chunk-2PFNATXD.js}

@@ -1,7 +1,7 @@
 import {
   executeAction,
   substituteTemplate
-} from "./chunk-VPHOOQLR.js";
+} from "./chunk-3GHTBVZO.js";
 
 // src/automation/workflow-engine.ts
 import { randomUUID } from "crypto";

package/dist/chunk-2XZ6X3PJ.js

@@ -0,0 +1,13 @@
+// src/lib/support-admin-token.ts
+function resolveSupportAdminToken(config) {
+  return process.env.ASKEXE_SUPPORT_ADMIN_TOKEN || process.env.EXE_SUPPORT_ADMIN_TOKEN || config?.support?.adminToken || config?.support?.admin_token;
+}
+function supportAdminHeaders(config) {
+  const token = resolveSupportAdminToken(config);
+  return token ? { "x-askexe-admin-token": token } : {};
+}
+
+export {
+  resolveSupportAdminToken,
+  supportAdminHeaders
+};

package/dist/chunk-3XX3CDKF.js

@@ -0,0 +1,9 @@
+// src/lib/daemon-heap.ts
+function computeDaemonHeapCapMb(totalGb) {
+  if (!Number.isFinite(totalGb) || totalGb <= 0) return 2048;
+  return Math.min(Math.max(2048, Math.round(totalGb * 0.25 * 1024)), 6144);
+}
+
+export {
+  computeDaemonHeapCapMb
+};

package/dist/{chunk-ZTB6E2ZL.js → chunk-4FGTT26Q.js}

@@ -6,7 +6,7 @@ import {
   getIdentity,
   listIdentities,
   updateIdentity
-} from "./chunk-5U7WB4YG.js";
+} from "./chunk-WVBZ3QBR.js";
 import {
   atomicWriteJsonSync
 } from "./chunk-LYH5HE24.js";