@askexenow/exe-os 0.9.329 → 0.9.331

package/dist/{chunk-2BZ24BXH.js → chunk-O6RMSGXQ.js}

@@ -1,10 +1,10 @@
 import {
   sessionScopeFilter
-} from "./chunk-AJVH2WVF.js";
+} from "./chunk-ZSMF37M6.js";
 import {
   getClient,
   getIdentity
-} from "./chunk-LB7VU543.js";
+} from "./chunk-BIM763ML.js";
 import {
   getEmotionalBaseline
 } from "./chunk-PNQDP3OA.js";
@@ -643,7 +643,7 @@ var DreamingEngine = class {
     }
     let overdueProspective = [];
     try {
-      const { getOverdueProspective, completeProspective } = await import("./prospective-memory-VBOSSFDF.js");
+      const { getOverdueProspective, completeProspective } = await import("./prospective-memory-JPTTRFYJ.js");
       const overdue = await getOverdueProspective(agentId);
       overdueProspective = overdue.map((o) => ({
         id: o.id,

package/dist/{chunk-PO4MLC7T.js → chunk-OEEQGXCG.js}

@@ -1,6 +1,6 @@
 import {
   getGlobalProceduresBlock
-} from "./chunk-IDTF3DST.js";
+} from "./chunk-UUY3USYA.js";
 
 // src/lib/employee-templates.ts
 var BASE_OPERATING_PROCEDURES = `

package/dist/{chunk-B2ELTSP7.js → chunk-OLQYIAOQ.js}

@@ -4,32 +4,32 @@ import {
 } from "./chunk-HMP5VT6A.js";
 import {
   createTask
-} from "./chunk-C4VHNWH2.js";
+} from "./chunk-5JILQMRS.js";
 import {
   getActiveAgent
-} from "./chunk-3PKMM7QQ.js";
+} from "./chunk-EOYVD5U3.js";
 import {
   ensureEmployee,
   isValidSessionScope,
   logTaskDispatch,
   resolveExeSession
-} from "./chunk-AJVH2WVF.js";
+} from "./chunk-ZSMF37M6.js";
 import {
   recordOrchestrationEventBestEffort
-} from "./chunk-CAITCAO5.js";
+} from "./chunk-AREY6CD2.js";
 import {
   getAgentRuntime,
   validateRuntimeModel
 } from "./chunk-HDZF7FQF.js";
 import {
   getLicenseSync
-} from "./chunk-IVZK65BU.js";
+} from "./chunk-7QFR2QUD.js";
 import {
   getAgentContext
 } from "./chunk-GJV3WDWM.js";
 import {
   isCoordinatorName
-} from "./chunk-LB7VU543.js";
+} from "./chunk-BIM763ML.js";
 
 // src/mcp/tools/create-task.ts
 import { z } from "zod";
@@ -335,6 +335,24 @@ function registerCreateTask(server) {
         } catch {
         }
       }
+      if (!callerRoot && process.env.VITEST !== "true" && process.env.NODE_ENV !== "test") {
+        const message = `BLOCKED: create_task resolved no session_scope for project "${project_name}". Refusing to create an unscoped task. Ensure the MCP client sends a non-empty X-Exe-Session header or run from a coordinator session that can be resolved.`;
+        process.stderr.write(`[create_task] ${message}
+`);
+        recordOrchestrationEventBestEffort({
+          eventType: "dispatch.failed",
+          source: "create-task.mcp",
+          severity: "error",
+          agentId: assigned_to,
+          projectName: project_name,
+          errorCode: "missing_session_scope",
+          payload: { priority, callerTmux, callerSource }
+        });
+        return {
+          content: [{ type: "text", text: message }],
+          isError: true
+        };
+      }
       const effectiveRuntime = spawn_runtime ?? getAgentRuntime(assigned_to).runtime;
       let effectiveSpawnModel = spawn_model;
       if (spawn_model) {
@@ -481,7 +499,7 @@ function registerCreateTask(server) {
           session_scope: sessionScope,
           created_at: (/* @__PURE__ */ new Date()).toISOString()
         }), "utf-8");
-        const { recordOrchestrationEventBestEffort: recordOE } = await import("./orchestration-events-5PLWK6PM.js");
+        const { recordOrchestrationEventBestEffort: recordOE } = await import("./orchestration-events-2QYYCFSI.js");
         recordOE({
           eventType: "signal.created",
           source: "create-task.mcp",
@@ -514,7 +532,7 @@ function registerCreateTask(server) {
             let projectConflictOpts = {};
             try {
               const { getClient } = await import("./lib/database.js");
-              const { sessionScopeFilter } = await import("./task-scope-7GYL7HSQ.js");
+              const { sessionScopeFilter } = await import("./task-scope-J3OMPV5A.js");
               const client = getClient();
               const scope = sessionScopeFilter(task.sessionScope || callerRoot || exeSession || null);
               const existing = await client.execute({

package/dist/{chunk-5H3CJPKV.js → chunk-ORU5LDIT.js}

@@ -2,7 +2,7 @@ import {
   getClient,
   isCoordinatorName,
   loadEmployeesSync
-} from "./chunk-LB7VU543.js";
+} from "./chunk-BIM763ML.js";
 
 // src/lib/steward-gate.ts
 import crypto from "crypto";

package/dist/{chunk-ZHARKQVQ.js → chunk-OV7OFYIR.js}

@@ -1,6 +1,6 @@
 import {
   listBehaviors
-} from "./chunk-MXMYZFHO.js";
+} from "./chunk-KCHIJUYX.js";
 import {
   loadConfigSync
 } from "./chunk-7Y5UDEVM.js";

package/dist/{chunk-GBUXYGXK.js → chunk-P3PGU2OC.js}

@@ -263,7 +263,7 @@ async function runRegistryProxy(options = registryProxyOptionsFromEnv()) {
   await new Promise((resolve) => server.listen(options.port, options.host, resolve));
   console.log(`exe-registry-proxy listening on ${options.host ?? "0.0.0.0"}:${options.port}`);
   console.log(`proxying /v2/${options.allowedNamespace ?? "askexe"}/* -> ${options.upstream ?? "https://ghcr.io"}`);
-  const { licenseSyncConfigFromEnv, startLicenseSyncScheduler } = await import("./license-sync-KFAHAPJE.js");
+  const { licenseSyncConfigFromEnv, startLicenseSyncScheduler } = await import("./license-sync-LSKU2X6F.js");
   const syncConfig = licenseSyncConfigFromEnv();
   if (syncConfig) {
     startLicenseSyncScheduler(syncConfig);

package/dist/{chunk-CDBWONNT.js → chunk-QAYGX7KA.js}

@@ -3,11 +3,11 @@ import {
 } from "./chunk-75H4R62K.js";
 import {
   initStore
-} from "./chunk-7S3GUMYM.js";
+} from "./chunk-KKZPF6YI.js";
 import {
   getClient,
   isInitialized
-} from "./chunk-LB7VU543.js";
+} from "./chunk-BIM763ML.js";
 
 // src/lib/schedules.ts
 import crypto from "crypto";

package/dist/{chunk-EMYWFV4D.js → chunk-QOMCLPQI.js}

@@ -1,7 +1,7 @@
 import {
   createCRMWebhookHandler,
   parseTwentyWebhook
-} from "./chunk-CNBHDIED.js";
+} from "./chunk-4NGPNH3F.js";
 import {
   WhatsAppAdapter
 } from "./chunk-ECSNSHZ7.js";
@@ -42,7 +42,7 @@ import {
   retryWithBackoff,
   routeMessage,
   validateGatewayConfig
-} from "./chunk-TCACWXYB.js";
+} from "./chunk-DSL5D3TH.js";
 import {
   OllamaProvider
 } from "./chunk-FWFFZGSC.js";

package/dist/{chunk-4TTJQCQ6.js → chunk-QQCZLNUC.js}

@@ -1,7 +1,7 @@
 import {
   getIdentity,
   loadEmployeesSync
-} from "./chunk-LB7VU543.js";
+} from "./chunk-BIM763ML.js";
 
 // src/lib/drift-probes.ts
 var DRIFT_THRESHOLD = 80;

package/dist/{chunk-2ANCDQ5H.js → chunk-QVM5KATG.js}

@@ -3,7 +3,7 @@ import {
 } from "./chunk-CLAYNAXC.js";
 import {
   buildClaudeHttpMcpEntry
-} from "./chunk-CQ6WS6UH.js";
+} from "./chunk-67547XFJ.js";
 import {
   EXE_HOOKS,
   isLegacyHomeDirHookCommand,
@@ -11,7 +11,7 @@ import {
 } from "./chunk-L3TB7CC3.js";
 import {
   ensureAllAgentSymlinks
-} from "./chunk-OEBEFJVD.js";
+} from "./chunk-YYKY45TM.js";
 import {
   MCP_LEGACY_KEY,
   MCP_PRIMARY_KEY

package/dist/{chunk-WSF6R6IS.js → chunk-QXXG2MCZ.js}

@@ -1,15 +1,15 @@
 import {
   getActiveAgent
-} from "./chunk-3PKMM7QQ.js";
+} from "./chunk-EOYVD5U3.js";
 import {
   listTasks
-} from "./chunk-AJVH2WVF.js";
+} from "./chunk-ZSMF37M6.js";
 import {
   getAgentContext
 } from "./chunk-GJV3WDWM.js";
 import {
   isCoordinatorName
-} from "./chunk-LB7VU543.js";
+} from "./chunk-BIM763ML.js";
 
 // src/mcp/tools/list-tasks.ts
 import { z } from "zod";

package/dist/{chunk-UAIC5L4H.js → chunk-RKBVTCPY.js}

@@ -1,6 +1,6 @@
 import {
   isCoordinatorRole
-} from "./chunk-LB7VU543.js";
+} from "./chunk-BIM763ML.js";
 
 // src/lib/task-router.ts
 import { randomUUID } from "crypto";

package/dist/{chunk-TECS4WT3.js → chunk-RY7UV6CU.js}

@@ -1,7 +1,7 @@
 import {
   getCurrentSessionScope,
   strictSessionScopeFilter
-} from "./chunk-AJVH2WVF.js";
+} from "./chunk-ZSMF37M6.js";
 import {
   getProjectName
 } from "./chunk-OPU3NYOO.js";

package/dist/{chunk-7N7H23WJ.js → chunk-SNJEQPPA.js}

@@ -1,6 +1,6 @@
 import {
   recordOrchestrationEventBestEffort
-} from "./chunk-CAITCAO5.js";
+} from "./chunk-AREY6CD2.js";
 
 // src/lib/worktree.ts
 import { execSync } from "child_process";

package/dist/{chunk-QAUXAILJ.js → chunk-SPCO7SNH.js}

@@ -6,7 +6,7 @@ import {
 } from "./chunk-7UMCQQWS.js";
 import {
   getClient
-} from "./chunk-LB7VU543.js";
+} from "./chunk-BIM763ML.js";
 
 // src/lib/memory-graph-extractor.ts
 function relationshipId(sourceId, targetId, relType) {
@@ -374,7 +374,7 @@ async function upsertMemoryGraph(result, memoryId) {
     });
   }
   try {
-    const { createCoOccurrenceEdges } = await import("./co-occurrence-CZ6PSVPI.js");
+    const { createCoOccurrenceEdges } = await import("./co-occurrence-FEU6RXQI.js");
     await createCoOccurrenceEdges(result.entities, memoryId);
   } catch {
   }

package/dist/{chunk-O5MMHBU5.js → chunk-TXUSQZLH.js}

@@ -50,6 +50,8 @@ async function getRetrievalHealth() {
     actualSearchMode = "fts+graph";
   } else if (embedDaemon === "running") {
     actualSearchMode = "hybrid (vector+fts+graph)";
+  } else if (embedDaemon === "disabled") {
+    actualSearchMode = "fts+graph (embeddings disabled by choice)";
   } else {
     actualSearchMode = "fts+graph (degraded from hybrid)";
   }
@@ -117,8 +119,16 @@ async function getRetrievalHealth() {
 }
 function computeDegradations(h) {
   const out = [];
+  const isEmbeddingsDisabledByChoice = h.embedDaemon === "disabled" || h.searchMode.actual.includes("disabled by choice");
   const isRuntimeDowngrade = h.searchMode.actual.includes("degraded");
-  if (isRuntimeDowngrade) {
+  if (isEmbeddingsDisabledByChoice) {
+    out.push({
+      code: "embeddings_disabled_by_choice",
+      severity: "info",
+      message: `Vector embeddings are disabled by choice; retrieval is running as "${h.searchMode.actual}"`,
+      remediation: "Enable embeddings/searchMode=hybrid only if you want vector retrieval; keyword + graph retrieval remains available."
+    });
+  } else if (isRuntimeDowngrade) {
     out.push({
       code: "retrieval_downgraded",
       severity: "warn",

package/dist/{chunk-47PIQRBR.js → chunk-UCQITDLM.js}

@@ -36,7 +36,8 @@ var TRANSIENT_TRANSPORT_ERRORS = [
   "Request timeout",
   "DB not initialized",
   "Server shutting down",
-  "Daemon transport error"
+  "Daemon transport error",
+  "Unauthorized daemon request"
 ];
 function isTransientDaemonTransportError(err) {
   const msg = err instanceof Error ? err.message : String(err);
@@ -61,7 +62,11 @@ async function retryOnDaemonTransportError(fn, opts = {}) {
 function createDaemonDbClient(fallbackClient) {
   let _useDaemon = false;
   const isMcpProcess = () => process.env.EXE_MCP_MODE === "1";
-  const isTransportError = (errMsg) => errMsg === "Not connected" || errMsg === "Request timeout" || errMsg === "Write failed" || errMsg === "DB not initialized" || errMsg === "Connection closed" || errMsg === "Server shutting down";
+  const isTransportError = (errMsg) => errMsg === "Not connected" || errMsg === "Request timeout" || errMsg === "Write failed" || errMsg === "DB not initialized" || errMsg === "Connection closed" || errMsg === "Server shutting down" || // A daemon can reject a stale client token after a restart/key rotation.
+  // For non-MCP read-only callers this is equivalent to a dropped transport:
+  // re-handshake once, then fall back to the direct read path. MCP callers
+  // still refuse direct SQLite fallback below to preserve the single-writer gate.
+  errMsg === "Unauthorized daemon request";
   async function ensureDaemonRoute() {
     if (_useDaemon && isClientConnected()) return true;
     const connected = await connectEmbedDaemon().catch(() => false);

package/dist/{chunk-K7FFR7XO.js → chunk-UJRZD77V.js}

@@ -1,9 +1,9 @@
 import {
   sendMessage
-} from "./chunk-P52DLOLU.js";
+} from "./chunk-N5ACQ7C2.js";
 import {
   getActiveAgent
-} from "./chunk-3PKMM7QQ.js";
+} from "./chunk-EOYVD5U3.js";
 
 // src/mcp/tools/send-message.ts
 import { z } from "zod";

package/dist/{chunk-IDTF3DST.js → chunk-UUY3USYA.js}

@@ -4,7 +4,7 @@ import {
 } from "./chunk-A47MXY2I.js";
 import {
   getClient
-} from "./chunk-LB7VU543.js";
+} from "./chunk-BIM763ML.js";
 
 // src/lib/global-procedures.ts
 import { randomUUID } from "crypto";

package/dist/{chunk-BQ4ZCKOM.js → chunk-UX5YA6ZY.js}

@@ -1,24 +1,24 @@
 import {
   recordSessionKill
-} from "./chunk-U4KIMDH5.js";
+} from "./chunk-MNLSPTWM.js";
 import {
   sessionScopeFilter,
   verifyPaneAtCapacity,
   writeNotification
-} from "./chunk-AJVH2WVF.js";
+} from "./chunk-ZSMF37M6.js";
 import {
   listSessions
-} from "./chunk-JRNXYANV.js";
+} from "./chunk-3HMHSTHQ.js";
 import {
   getTransport
 } from "./chunk-RMOBQ6A5.js";
 import {
   recordOrchestrationEventBestEffort
-} from "./chunk-CAITCAO5.js";
+} from "./chunk-AREY6CD2.js";
 import {
   getClient,
   isCoordinatorName
-} from "./chunk-LB7VU543.js";
+} from "./chunk-BIM763ML.js";
 
 // src/lib/capacity-monitor.ts
 var CAPACITY_PATTERNS = [

package/dist/{chunk-6JDUBDS3.js → chunk-VAZHL55P.js}

@@ -1,7 +1,7 @@
 import {
   clean,
   stableId
-} from "./chunk-DFYM2FT5.js";
+} from "./chunk-O4522BYB.js";
 
 // src/lib/reflection-checkpoints.ts
 function parsePayload(payload) {