@askexenow/exe-os 0.9.312 → 0.9.313

package/dist/{chunk-2NGPZCWX.js → chunk-JB7QUK3D.js}

@@ -1,9 +1,9 @@
 import {
   loadPreferences
-} from "./chunk-VDYUKTNS.js";
+} from "./chunk-CLAYNAXC.js";
 import {
   buildClaudeHttpMcpEntry
-} from "./chunk-JZW5AOWI.js";
+} from "./chunk-BSPALHIR.js";
 import {
   EXE_HOOKS,
   isLegacyHomeDirHookCommand,
@@ -11,7 +11,7 @@ import {
 } from "./chunk-L3TB7CC3.js";
 import {
   ensureAllAgentSymlinks
-} from "./chunk-NIZQ3CIS.js";
+} from "./chunk-3AMGSCRH.js";
 import {
   MCP_LEGACY_KEY,
   MCP_PRIMARY_KEY

package/dist/{chunk-VT2B5BHM.js → chunk-JBSCL2XT.js}

@@ -40,7 +40,8 @@ function extractSemanticText(toolName, toolInput, toolResponse) {
         extracted = extractDefault(toolName, toolInput, toolResponse);
       }
   }
-  return redactSecrets(extracted).text;
+  const sanitized = redactSecrets(extracted).text;
+  return sanitized.replace(/[\uD800-\uDBFF](?![\uDC00-\uDFFF])/g, "\uFFFD").replace(/(?<![\uD800-\uDBFF])[\uDC00-\uDFFF]/g, "\uFFFD");
 }
 function findContainingChunk(filePath, snippet) {
   try {

package/dist/{chunk-MPX3TRMQ.js → chunk-JD5S5AAV.js}

@@ -1,6 +1,6 @@
 import {
   extractSemanticText
-} from "./chunk-VT2B5BHM.js";
+} from "./chunk-JBSCL2XT.js";
 import {
   detectError
 } from "./chunk-AHMUF6RO.js";

package/dist/{chunk-XYG722JW.js → chunk-JIJKUZIO.js}

@@ -3,15 +3,15 @@ import {
   getClient,
   isInitialized,
   loadEmployees
-} from "./chunk-SCYWCWKY.js";
+} from "./chunk-VG4ZH2Z3.js";
 import {
   PLAN_LIMITS,
   checkLicense,
   isFeatureAllowed
-} from "./chunk-JV225JBX.js";
+} from "./chunk-I6RHLHVW.js";
 import {
   EXE_AI_DIR
-} from "./chunk-DFIOOK5R.js";
+} from "./chunk-WCES22KG.js";
 
 // src/lib/plan-limits.ts
 import { readFileSync, existsSync } from "fs";

package/dist/{chunk-KMIAYKIH.js → chunk-K5C6LC2G.js}

@@ -1,6 +1,6 @@
 import {
   loadLicense
-} from "./chunk-JV225JBX.js";
+} from "./chunk-I6RHLHVW.js";
 
 // src/lib/stack-update.ts
 import { execFileSync, spawnSync } from "child_process";
@@ -93,6 +93,37 @@ function parseComposeDependsOn(composeRaw) {
   }
   return deps;
 }
+function parseComposeServiceNames(composeRaw) {
+  const names = /* @__PURE__ */ new Set();
+  for (const line of composeRaw.split(/\r?\n/)) {
+    if (!line.trim() || line.trim().startsWith("#")) continue;
+    const indent = line.length - line.trimStart().length;
+    const trimmed = line.trim();
+    if (indent === 2 && /^[a-zA-Z0-9_-]+:\s*$/.test(trimmed)) {
+      names.add(trimmed.replace(/:.*$/, ""));
+    }
+  }
+  return names;
+}
+function isUsableTunnelToken(value) {
+  const v = (value ?? "").trim();
+  if (v === "") return false;
+  if (/CHANGEME/i.test(v)) return false;
+  return true;
+}
+function isCloudflaredTunnelMisconfigured(composeFile, envFile) {
+  if (!existsSync(composeFile)) return false;
+  const composeRaw = readFileSync(composeFile, "utf8");
+  if (!parseComposeServiceNames(composeRaw).has("cloudflared")) return false;
+  const token = existsSync(envFile) ? parseEnv(readFileSync(envFile, "utf8")).get("CLOUDFLARE_TUNNEL_TOKEN") : void 0;
+  if (isUsableTunnelToken(token)) return false;
+  const configYml = path.join(path.dirname(composeFile), "cloudflared", "config.yml");
+  if (existsSync(configYml)) {
+    const cfg = readFileSync(configYml, "utf8");
+    if (/\btunnel\s*:/i.test(cfg) || /credentials[-_]file\s*:/i.test(cfg)) return false;
+  }
+  return true;
+}
 function resolveTransitiveDeps(selected, depsMap) {
   const resolved = new Set(selected);
   const queue = [...selected];
@@ -287,10 +318,9 @@ async function rollbackStackUpdate(options) {
   const rollbackEnvRaw = readFileSync(rollbackEnv, "utf8");
   if (scopedServiceNames.length > 0 && lockData?.services) {
     const rollbackEnvMap = parseEnv(rollbackEnvRaw);
-    const scopedUpdates = Object.fromEntries(scopedServiceNames.map((serviceName) => {
-      const key = lockData.services[serviceName].env;
-      return [key, rollbackEnvMap.get(key) ?? ""];
-    }));
+    const scopedUpdates = Object.fromEntries(
+      scopedServiceNames.map((serviceName) => lockData.services[serviceName].env).filter((key) => Boolean(key)).map((key) => [key, rollbackEnvMap.get(key) ?? ""])
+    );
     console.log(`[stack-update] Restoring env keys for service ${scopedServiceNames.join(", ")} from ${rollbackEnv}`);
     writeSecretFile(options.envFile, patchEnv(readFileSync(options.envFile, "utf8"), scopedUpdates));
   } else {
@@ -442,7 +472,7 @@ function buildInitialServiceStatus(plan, envRaw, now, activeServices) {
       service: serviceName,
       image: service.image,
       env: service.env,
-      before: env.get(service.env),
+      before: service.env ? env.get(service.env) : void 0,
       after: service.image,
       status: activeServices && !activeServices.has(serviceName) ? "skipped" : "pending",
       error: activeServices && !activeServices.has(serviceName) ? "not selected for this service-scoped update" : void 0,
@@ -468,6 +498,11 @@ function incompleteServicesFromLock(lockFile) {
   const serviceStatus = lock?.serviceStatus ?? {};
   return Object.entries(serviceStatus).filter(([, status]) => status.status !== "completed" && status.status !== "skipped").map(([service]) => service);
 }
+function sanitizeImageRef(image) {
+  let ref = image.trim().replace(/^['"]|['"]$/g, "");
+  ref = ref.replace(/:([^:@/]+):(v\d)/, ":$2");
+  return ref;
+}
 function parseStackManifest(raw, publicKey) {
   const parsedRaw = JSON.parse(raw);
   const parsed = isSignedEnvelope(parsedRaw) ? { ...parsedRaw.manifest, signature: parsedRaw.signature } : parsedRaw;
@@ -482,9 +517,10 @@ function parseStackManifest(raw, publicKey) {
       throw new Error(`Invalid stack manifest: release ${version} has no services`);
     }
     for (const [serviceName, service] of Object.entries(release.services)) {
-      if (!service.image || !service.env) {
-        throw new Error(`Invalid stack manifest: ${version}.${serviceName} requires image and env`);
+      if (!service.image) {
+        throw new Error(`Invalid stack manifest: ${version}.${serviceName} requires image`);
       }
+      service.image = sanitizeImageRef(service.image);
     }
   }
   return parsed;
@@ -629,6 +665,7 @@ function createStackUpdatePlan(manifest, envRaw, targetVersion, serviceNames, se
   const env = parseEnv(envRaw);
   const changes = [];
   for (const [serviceName, service] of Object.entries(release.services)) {
+    if (!service.env) continue;
     const before = env.get(service.env);
     if (before !== service.image) {
       changes.push({ key: service.env, before, after: service.image, service: serviceName });
@@ -684,6 +721,39 @@ function classifyAskExeImage(image, label, strictDigest) {
   }
   return null;
 }
+function classifyManifestImage(image, label, strictDigest, serviceCategory) {
+  const trimmed = image.trim().replace(/^['"]|['"]$/g, "");
+  if (!trimmed) return { kind: "manifest-image", message: `${label} is empty`, severity: "error" };
+  if (trimmed.includes("${")) return null;
+  if (trimmed.startsWith("ghcr.io/askexe/") || trimmed.startsWith("update.askexe.com/askexe/")) {
+    return classifyAskExeImage(trimmed, label, strictDigest);
+  }
+  if (OFFICIAL_COMPOSE_IMAGE.test(trimmed)) {
+    if (isMutableTag(imageTag(trimmed)) && !IMAGE_DIGEST.test(trimmed)) {
+      return {
+        kind: "manifest-image",
+        message: `${label} uses a mutable tag (${trimmed}); pin a version tag or @sha256: digest for the infra image`,
+        severity: strictDigest ? "error" : "warn"
+      };
+    }
+    return null;
+  }
+  if (serviceCategory === "infra") {
+    if (isMutableTag(imageTag(trimmed)) && !IMAGE_DIGEST.test(trimmed)) {
+      return {
+        kind: "manifest-image",
+        message: `${label} uses a mutable tag (${trimmed}); pin a version tag or @sha256: digest for the infra image`,
+        severity: "warn"
+      };
+    }
+    return null;
+  }
+  return {
+    kind: "manifest-image",
+    message: `${label} uses unsupported image ${trimmed}; AskExe app images must come from ghcr.io/askexe or update.askexe.com/askexe, and third-party infra must be a recognised official image`,
+    severity: "error"
+  };
+}
 function validateComposeImageLiteral(image, label, strictDigest = false) {
   const trimmed = image.trim().replace(/^['"]|['"]$/g, "");
   if (!trimmed) return { kind: "compose-image", message: `${label} is empty`, severity: "error" };
@@ -724,11 +794,11 @@ function collectProductionDeployGateIssues(plan, envRaw, composeRaw, options = {
   const issues = [];
   const env = parseEnv(envRaw);
   for (const [serviceName, service] of Object.entries(plan.release.services)) {
-    const manifestIssue = classifyAskExeImage(service.image, `manifest ${plan.targetVersion}.${serviceName}.image`, strictDigest);
+    const manifestIssue = classifyManifestImage(service.image, `manifest ${plan.targetVersion}.${serviceName}.image`, strictDigest, service.category);
     if (manifestIssue) issues.push({ ...manifestIssue, kind: "manifest-image" });
-    const envImage = env.get(service.env);
+    const envImage = service.env ? env.get(service.env) : void 0;
     if (envImage) {
-      const envIssue = classifyAskExeImage(envImage, `env ${service.env}`, strictDigest);
+      const envIssue = classifyManifestImage(envImage, `env ${service.env}`, strictDigest, service.category);
       if (envIssue) issues.push({ ...envIssue, kind: "env-image" });
     }
   }
@@ -761,38 +831,59 @@ function collectImageAvailabilityIssues(plan) {
     const image = service.image;
     if (checked.has(image)) continue;
     checked.add(image);
-    try {
-      const result = spawnSync("docker", ["manifest", "inspect", image, "--verbose"], {
-        stdio: ["ignore", "pipe", "pipe"],
-        timeout: 3e4
-      });
-      if (result.status !== 0) {
-        const stderr = result.stderr?.toString().trim() ?? "";
-        issues.push({
-          kind: "image-not-pullable",
-          message: `${serviceName} image ${image} not found on registry. ${stderr.slice(0, 200)}`
-        });
-        continue;
-      }
-      const output = result.stdout?.toString() ?? "";
+    const isProxyImage = image.startsWith("update.askexe.com/");
+    const maxAttempts = isProxyImage ? 3 : 1;
+    const baseDelayMs = 2e3;
+    let lastStderr = "";
+    let inspected = false;
+    let inspectOutput = "";
+    for (let attempt = 1; attempt <= maxAttempts; attempt++) {
       try {
-        const parsed = JSON.parse(output);
-        const manifests = Array.isArray(parsed) ? parsed : [parsed];
-        const hasAmd64 = manifests.some((m) => {
-          const platform = m.platform;
-          return platform?.architecture === "amd64" && platform?.os === "linux";
+        const result = spawnSync("docker", ["manifest", "inspect", image, "--verbose"], {
+          stdio: ["ignore", "pipe", "pipe"],
+          timeout: 3e4
         });
-        if (!hasAmd64 && manifests.length > 0 && manifests[0]?.platform) {
-          const platforms = manifests.map((m) => {
-            const p = m.platform;
-            return `${p?.os ?? "?"}/${p?.architecture ?? "?"}`;
-          }).join(", ");
-          issues.push({
-            kind: "platform-mismatch",
-            message: `${serviceName} image ${image} has no linux/amd64 manifest (available: ${platforms}). Rebuild with: docker buildx build --platform linux/amd64 --push`
-          });
+        if (result.status === 0) {
+          inspected = true;
+          inspectOutput = result.stdout?.toString() ?? "";
+          break;
+        }
+        lastStderr = result.stderr?.toString().trim() ?? "";
+        if (attempt < maxAttempts) {
+          const delayMs = baseDelayMs * Math.pow(2, attempt - 1);
+          console.log(
+            `[stack-update] Image ${image} not yet available on proxy (attempt ${attempt}/${maxAttempts}), retrying in ${delayMs / 1e3}s\u2026 (bug d11c9809)`
+          );
+          spawnSync("sleep", [String(delayMs / 1e3)], { stdio: "ignore" });
         }
       } catch {
+        inspected = true;
+        break;
+      }
+    }
+    if (!inspected) {
+      issues.push({
+        kind: "image-not-pullable",
+        message: `${serviceName} image ${image} not found on registry after ${maxAttempts} attempt(s). ${lastStderr.slice(0, 200)}`
+      });
+      continue;
+    }
+    try {
+      const parsed = JSON.parse(inspectOutput);
+      const manifests = Array.isArray(parsed) ? parsed : [parsed];
+      const hasAmd64 = manifests.some((m) => {
+        const platform = m.platform;
+        return platform?.architecture === "amd64" && platform?.os === "linux";
+      });
+      if (!hasAmd64 && manifests.length > 0 && manifests[0]?.platform) {
+        const platforms = manifests.map((m) => {
+          const p = m.platform;
+          return `${p?.os ?? "?"}/${p?.architecture ?? "?"}`;
+        }).join(", ");
+        issues.push({
+          kind: "platform-mismatch",
+          message: `${serviceName} image ${image} has no linux/amd64 manifest (available: ${platforms}). Rebuild with: docker buildx build --platform linux/amd64 --push`
+        });
       }
     } catch {
     }
@@ -1249,6 +1340,10 @@ function bootstrapStackHost(options) {
     envHadPlaceholders,
     envRemainingPlaceholders,
     licensePresent: !!(options.licenseKey || process.env.EXE_LICENSE_KEY || loadLicense()),
+    // bug 820c6473: evaluated AFTER hydration (which deliberately skips the
+    // tunnel token) so a missing/placeholder CLOUDFLARE_TUNNEL_TOKEN with the
+    // cloudflared service present is caught as a hard blocker downstream.
+    cloudflaredTunnelMisconfigured: isCloudflaredTunnelMisconfigured(options.composeFile, options.envFile),
     createdFiles,
     actions
   };
@@ -1262,6 +1357,11 @@ function assertHostReadyForApply(report) {
   if (!report.licensePresent) blockers.push("Exe OS license key is missing. Run `exe-os setup`, `exe-os --activate <key>`, or pass --license-key.");
   const hardPlaceholders = report.envRemainingPlaceholders.filter((p) => !/WHATSAPP|API_ROUTER|MONITOR_AGENT|MONITOR_HUB_ADMIN|CLOUDFLARE_TUNNEL_TOKEN/.test(p));
   if (hardPlaceholders.length > 0) blockers.push(`Required .env placeholders remain: ${hardPlaceholders.join(", ")}`);
+  if (report.cloudflaredTunnelMisconfigured) {
+    blockers.push(
+      "Cloudflare tunnel is required (cloudflared service is in docker-compose) but CLOUDFLARE_TUNNEL_TOKEN is missing/empty/placeholder. Create a tunnel in the Cloudflare dashboard, copy the token, and set CLOUDFLARE_TUNNEL_TOKEN in .env (or use advanced config-file mode: leave the token empty and populate cloudflared/config.yml)."
+    );
+  }
   if (blockers.length > 0) throw new Error(`Stack host is not ready:
 - ${blockers.join("\n- ")}`);
 }
@@ -1863,6 +1963,23 @@ ${lines.join("\n")}`
       (options.dockerLogin ?? defaultDockerLogin)(creds);
       registryForLogout = creds.registry;
     }
+    const runImageAvailabilityCheck = !options.skipImageAvailabilityCheck && !options.exec;
+    if (runImageAvailabilityCheck) {
+      const availabilityIssues = collectImageAvailabilityIssues(plan);
+      if (availabilityIssues.length > 0) {
+        const details = availabilityIssues.map((i) => `- [${i.kind}] ${i.message}`).join("\n");
+        if (options.breakGlassReason?.trim()) {
+          console.warn(`[stack-update] BREAK-GLASS: proceeding past image availability issues:
+${details}`);
+        } else {
+          throw new Error(
+            `Pre-deploy image availability check failed \u2014 aborting before any container swap.
+${details}
+Push the missing image(s) to the registry, or re-run with --break-glass <reason> to override.`
+          );
+        }
+      }
+    }
     const imagesToPull = manifestImagesForPull(plan.release);
     const allServiceNames = Object.keys(plan.release.services);
     const progress = new ProgressReporter(allServiceNames);
@@ -2601,6 +2718,9 @@ export {
   loadServiceSelection,
   saveServiceSelection,
   parseComposeDependsOn,
+  parseComposeServiceNames,
+  isUsableTunnelToken,
+  isCloudflaredTunnelMisconfigured,
   resolveTransitiveDeps,
   filterServicesBySelection,
   buildDefaultServiceSelection,

package/dist/{chunk-DAOHCXM2.js → chunk-KH6BCYLC.js}

@@ -1,7 +1,7 @@
 import {
   loadConfig,
   saveConfig
-} from "./chunk-DFIOOK5R.js";
+} from "./chunk-WCES22KG.js";
 
 // src/lib/orchestration-phase.ts
 var ORCHESTRATION_PHASES = [

package/dist/{chunk-4L4R6AQJ.js → chunk-KMI4TUTW.js}

@@ -1,6 +1,6 @@
 import {
   isCoordinatorRole
-} from "./chunk-SCYWCWKY.js";
+} from "./chunk-VG4ZH2Z3.js";
 
 // src/lib/task-router.ts
 import { randomUUID } from "crypto";

package/dist/{chunk-PHFPIUWU.js → chunk-KWOAM7TA.js}

@@ -54,8 +54,11 @@ function resolveHookSearchEnabled(env, config, sentinelPath = EMBEDDINGS_SENTINE
 }
 
 export {
+  EXE_AI_DIR,
   EMBEDDINGS_SENTINEL_PATH,
+  parseEmbeddingsEnv,
   readSentinel,
+  deriveFromLegacyConfig,
   resolveEmbeddingsEnabled,
   setEmbeddingsEnabled,
   resolveHookSearchEnabled

package/dist/{chunk-RZJ6DXVE.js → chunk-L6QI2NNG.js}

@@ -1,6 +1,6 @@
 import {
   recordOrchestrationEventBestEffort
-} from "./chunk-OR3TAZL3.js";
+} from "./chunk-P4ULFI2N.js";
 
 // src/lib/worktree.ts
 import { execSync } from "child_process";

package/dist/{chunk-HED6D5KR.js → chunk-MMNMQNLD.js}

@@ -2,7 +2,7 @@ import {
   ensureWorktree,
   getGitRoot,
   isWorktreeDirty
-} from "./chunk-RZJ6DXVE.js";
+} from "./chunk-L6QI2NNG.js";
 import {
   buildTaskResult,
   serializeMessage
@@ -16,7 +16,7 @@ import {
 } from "./chunk-E23LNUWJ.js";
 import {
   registerSession
-} from "./chunk-WJ2PZGRV.js";
+} from "./chunk-ZAA344BL.js";
 import {
   listTmuxSessions
 } from "./chunk-SSTLTIF3.js";
@@ -25,18 +25,18 @@ import {
 } from "./chunk-KOO3J5PV.js";
 import {
   recordOrchestrationEventBestEffort
-} from "./chunk-OR3TAZL3.js";
+} from "./chunk-P4ULFI2N.js";
 import {
   getAgentRuntime,
   normalizeCcModelName
-} from "./chunk-QB5JOGPK.js";
+} from "./chunk-2PI6JBJL.js";
 import {
   RUNTIME_TABLE
 } from "./chunk-NGP6LSV2.js";
 import {
   PlanLimitError,
   assertEmployeeLimitSync
-} from "./chunk-XYG722JW.js";
+} from "./chunk-JIJKUZIO.js";
 import {
   getSessionKey
 } from "./chunk-CVYC6DUW.js";
@@ -51,7 +51,7 @@ import {
 } from "./chunk-MP2AFCGL.js";
 import {
   ensureAgentSymlink
-} from "./chunk-NIZQ3CIS.js";
+} from "./chunk-3AMGSCRH.js";
 import {
   expandDualPrefixTools
 } from "./chunk-HYZV25LY.js";
@@ -62,18 +62,19 @@ import {
   getEmployee,
   isCoordinatorName,
   loadEmployees,
-  loadEmployeesSync
-} from "./chunk-SCYWCWKY.js";
+  loadEmployeesSync,
+  offloadReadIfMain
+} from "./chunk-VG4ZH2Z3.js";
 import {
   loadDeviceId
-} from "./chunk-JV225JBX.js";
+} from "./chunk-I6RHLHVW.js";
 import {
   EXE_AI_DIR
-} from "./chunk-DFIOOK5R.js";
+} from "./chunk-WCES22KG.js";
 import {
   atomicWriteJsonSync,
   atomicWriteSync
-} from "./chunk-65DBIEM2.js";
+} from "./chunk-SHIICYJW.js";
 
 // src/lib/tmux-routing.ts
 import { execFile, execFileSync as execFileSync2 } from "child_process";
@@ -673,7 +674,7 @@ async function createTaskCore(input) {
         if (isCoordinatorSession) {
           earlySessionScope = resolved;
         } else {
-          const { getSessionProject } = await import("./session-scope-JGDYAMJO.js");
+          const { getSessionProject } = await import("./session-scope-JTPHECAU.js");
           const sessionProject = getSessionProject(resolved);
           if (sessionProject && sessionProject !== input.projectName) {
             scopeMismatchWarning = `session/project mismatch: session "${resolved}" owns "${sessionProject}" but task targets "${input.projectName}". Routed to default scope.`;
@@ -922,7 +923,7 @@ async function queryTaskRows(opts) {
   }
   if (opts.founderId !== null) {
     try {
-      const { founderScopeFilter } = await import("./founder-context-QCTMEK66.js");
+      const { founderScopeFilter } = await import("./founder-context-A4VUEKDH.js");
       const founderFilter = founderScopeFilter(opts.founderId);
       const cleaned = founderFilter.sql.replace(/^\s*AND\s+/, "");
       conditions.push(cleaned);
@@ -940,10 +941,12 @@ async function queryTaskRows(opts) {
   const cols = opts.columns ?? "*";
   const order = opts.orderBy ?? "priority ASC, created_at DESC";
   const limit = opts.limit ?? 100;
-  const result = await client.execute({
-    sql: `SELECT ${cols} FROM tasks ${where} ORDER BY ${order} LIMIT ?`,
-    args: [...args, limit]
-  });
+  const result = await offloadReadIfMain(
+    client,
+    `SELECT ${cols} FROM tasks ${where} ORDER BY ${order} LIMIT ?`,
+    [...args, limit],
+    true
+  );
   return result.rows;
 }
 function getProjectNameSafe() {
@@ -1104,9 +1107,10 @@ async function updateTaskStatus(input) {
   if (input.status === "done") {
     input.status = "needs_review";
   }
-  const isReviewTransition = requestedStatus === "done" && input.status === "needs_review" && (previousStatus === "open" || previousStatus === "in_progress");
-  if (isReviewTransition && row.reviewer) {
-    const reviewer = String(row.reviewer);
+  const isReviewTransition = input.status === "needs_review" && previousStatus !== "needs_review" && (previousStatus === "open" || previousStatus === "in_progress");
+  const effectiveReviewer = row.reviewer ? String(row.reviewer) : row.assigned_by ? String(row.assigned_by) : "";
+  if (isReviewTransition && effectiveReviewer) {
+    const reviewer = effectiveReviewer;
     try {
       const { sendIntercom: sendIntercom2, employeeSessionName: employeeSessionName2, resolveExeSession: resolveExeSession2, isExeSession: isExeSession2 } = await import("./lib/tmux-routing.js");
       const exeSession = row.session_scope ? String(row.session_scope) : resolveExeSession2();
@@ -1154,7 +1158,7 @@ async function updateTaskStatus(input) {
     } catch {
     }
     try {
-      const { writeNotification: writeNotification2 } = await import("./notifications-UP7WQGG4.js");
+      const { writeNotification: writeNotification2 } = await import("./notifications-Q5NEAP6K.js");
       await writeNotification2({
         agentId: reviewer,
         agentRole: isCoordinatorName(reviewer) ? "COO" : "manager",
@@ -1574,7 +1578,7 @@ ${input.result ?? ""}`;
   }
   if (shouldWriteCompletionMemory && input.result) {
     try {
-      const { writeMemoryViaDaemon } = await import("./memory-queue-client-HLURQEV6.js");
+      const { writeMemoryViaDaemon } = await import("./memory-queue-client-YP2QKX6J.js");
       await writeMemoryViaDaemon({
         raw_text: input.result,
         agent_id: String(row.assigned_to),
@@ -1677,7 +1681,7 @@ ${input.result ?? ""}`;
   }
   if (input.status === "done" || input.status === "needs_review") {
     try {
-      const { incrementSkillSuccess } = await import("./skill-refinement-DUOO6B7V.js");
+      const { incrementSkillSuccess } = await import("./skill-refinement-VTYL4OMJ.js");
       await incrementSkillSuccess(
         String(row.assigned_to),
         row.project_name ? String(row.project_name) : null
@@ -2836,7 +2840,7 @@ function formatIntercomPrompt(reason = "nudge") {
     case "completion":
       return "An employee completed work. Run task(action='list', status='needs_review') to review it.";
     case "message":
-      return "You have a new message. Run message(action='acknowledge') after reading it, and check task(action='list') only if the message references work.";
+      return "Check your inbox for new messages. Run message(action='read') to check, and message(action='acknowledge') after reading. Only check task(action='list') if a message references work.";
     case "notification":
       return "You have pending notifications. Run task(action='list', status='needs_review') and task(action='list', status='open') to check actionable work.";
     case "signal":
@@ -3014,6 +3018,7 @@ function isRootSession(name) {
 }
 var VALID_SESSION_NAME = /^[a-z]+\d*-[a-zA-Z0-9_]+$/;
 function employeeSessionName(employee, exeSession, instance) {
+  employee = employee.toLowerCase();
   if (!isRootSession(exeSession)) {
     const root = extractRootExe(exeSession);
     if (root) {
@@ -3315,7 +3320,7 @@ async function verifyPaneAtCapacity(sessionName) {
       reason: `capture-pane failed: ${err instanceof Error ? err.message : String(err)}`
     };
   }
-  const { isAtCapacity } = await import("./capacity-monitor-BUKYPSWR.js");
+  const { isAtCapacity } = await import("./capacity-monitor-ZRLW7TVL.js");
   if (!isAtCapacity(pane)) {
     return {
       atCapacity: false,
@@ -3780,6 +3785,7 @@ async function ensureWorktreeAsync(projectDir, employeeName, instance) {
   }
 }
 function ensureEmployee(employeeName, exeSession, projectDir, opts) {
+  employeeName = employeeName.toLowerCase();
   if (isCoordinatorName(employeeName)) {
     return { status: "failed", sessionName: "", error: "The coordinator is not a dispatchable employee" };
   }
@@ -3874,7 +3880,7 @@ function ensureEmployee(employeeName, exeSession, projectDir, opts) {
     return { status: "failed", sessionName, error: "intercom delivery failed" };
   }
   const spawnOpts = { ...opts, instance: effectiveInstance };
-  if (!spawnOpts.cwd && process.env.EXE_IS_DAEMON !== "1") {
+  if (!spawnOpts.cwd) {
     const COORDINATOR_ROLES = /* @__PURE__ */ new Set(["COO", "CTO", "CMO"]);
     try {
       const roster = loadEmployeesSync();
@@ -3965,13 +3971,21 @@ async function ensureEmployeeAsync(employeeName, exeSession, projectDir, opts) {
         const wtPath = await ensureWorktreeAsync(projectDir, employeeName, asyncOpts.instance);
         if (wtPath) asyncOpts.cwd = wtPath;
       }
-    } catch {
+    } catch (err) {
+      process.stderr.write(
+        `[ensureEmployeeAsync] worktree setup failed for ${employeeName}: ${err instanceof Error ? err.message : String(err)}
+`
+      );
     }
   }
   try {
     const sessionName = employeeSessionName(employeeName, exeSession, asyncOpts.instance);
     await exportBehaviorsAsync(employeeName, path7.basename(asyncOpts.cwd ?? projectDir), sessionName);
-  } catch {
+  } catch (err) {
+    process.stderr.write(
+      `[ensureEmployeeAsync] behavior export failed for ${employeeName}: ${err instanceof Error ? err.message : String(err)}
+`
+    );
   }
   const result = ensureEmployee(employeeName, exeSession, projectDir, asyncOpts);
   if (asyncOpts.spawnLockHeld && result.status === "failed" && result.sessionName) {
@@ -4075,7 +4089,7 @@ function spawnEmployee(employeeName, exeSession, projectDir, opts) {
       );
       const isCodeRole = emp != null && !COORDINATOR_ROLES.has(emp.role);
       if (isCodeRole) {
-        const reason = opts?.cwd != null ? "preset_cwd" : process.env.EXE_IS_DAEMON === "1" ? "daemon_env" : "git_timeout";
+        const reason = opts?.cwd != null ? "preset_cwd" : "git_timeout";
         process.stderr.write(
           `[tmux-routing] WORKTREE BYPASSED: code-role ${employeeName} (role=${emp.role}) spawning in MAIN checkout ${spawnCwd} (reason=${reason}) \u2014 commits will land on main
 `

package/dist/{chunk-KAVUTP5G.js → chunk-N3CRJ2VW.js}

@@ -1,12 +1,12 @@
 import {
   storeBehavior
-} from "./chunk-PMEOSD6S.js";
+} from "./chunk-24BUDF3J.js";
 import {
   getClient
-} from "./chunk-SCYWCWKY.js";
+} from "./chunk-VG4ZH2Z3.js";
 import {
   loadConfig
-} from "./chunk-DFIOOK5R.js";
+} from "./chunk-WCES22KG.js";
 
 // src/lib/skill-learning.ts
 import crypto from "crypto";

package/dist/{chunk-OBJXZII2.js → chunk-N7LBAQGK.js}

@@ -3,16 +3,16 @@ import {
 } from "./chunk-VUH67PT4.js";
 import {
   isGhostBehaviorRow
-} from "./chunk-PMEOSD6S.js";
+} from "./chunk-24BUDF3J.js";
 import {
   getClient,
   getIdentity,
   listIdentities,
   updateIdentity
-} from "./chunk-SCYWCWKY.js";
+} from "./chunk-VG4ZH2Z3.js";
 import {
   atomicWriteJsonSync
-} from "./chunk-65DBIEM2.js";
+} from "./chunk-SHIICYJW.js";
 
 // src/lib/orchestration-package.ts
 import { randomUUID } from "crypto";