@askexenow/exe-os 0.9.336 → 0.9.338

package/dist/{worktree-sweep-O2UXISLE.js → worktree-sweep-ZAG3V24E.js}

@@ -2,12 +2,12 @@ import {
   cleanupAgentWorktree,
   discoverRepoPaths,
   sweepWorktrees
-} from "./chunk-2AWXDWUB.js";
-import "./chunk-SKFA42EO.js";
-import "./chunk-X7BGMYZS.js";
-import "./chunk-XZHA3WO2.js";
+} from "./chunk-K5WFKEXQ.js";
+import "./chunk-B76TSEP3.js";
+import "./chunk-FUIIVSW6.js";
+import "./chunk-HEPR6QTL.js";
 import "./chunk-2I23RPSI.js";
-import "./chunk-5KCRWAWF.js";
+import "./chunk-ATOU6CYR.js";
 import "./chunk-PNQDP3OA.js";
 import "./chunk-H73TUI4Y.js";
 import "./chunk-7HLWBYH7.js";

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@askexenow/exe-os",
-  "version": "0.9.336",
-  "description": "AI employee operating system \u2014 persistent memory, task management, and multi-agent coordination for Claude Code.",
+  "version": "0.9.338",
+  "description": "AI employee operating system — persistent memory, task management, and multi-agent coordination for Claude Code.",
   "license": "SEE LICENSE IN LICENSE",
   "type": "module",
   "repository": {
@@ -47,6 +47,7 @@
     "exe-stack-update": "./dist/bin/stack-update.js",
     "exe-preflight": "./dist/bin/exe-preflight.js",
     "exe-cloud": "./dist/bin/exe-cloud.js",
+    "exe-grant": "./dist/bin/exe-grant.js",
     "exe-os-bulk-sync-postgres": "./dist/bin/bulk-sync-postgres.js"
   },
   "files": [
@@ -114,7 +115,7 @@
     "deploy": "node dist/bin/pre-build-guard.js && npm run build && (node dist/bin/prune-orphan-chunks.js || true) && npm install -g . && node dist/bin/install.js --global && echo '[exe-os] Deploy complete. Run /mcp in active sessions to reconnect.'",
     "postinstall": "node dist/bin/install.js --commands-only || true",
     "prepublishOnly": "npm run typecheck && npm run build && node dist/bin/prune-orphan-chunks.js --force && npm run guard:esm-require && npm run check:schema-version && node dist/bin/customer-readiness.js && node dist/bin/pre-publish.js",
-    "test:publish": "npx vitest run --maxWorkers=4 --exclude 'tests/tui/**' --exclude 'tests/lib/tmux-routing.test.ts' --exclude 'tests/lib/intercom-routing.test.ts' --exclude 'tests/gateway/**' --exclude 'tests/mcp/ingest-document.test.ts' --exclude 'tests/lib/hybrid-search.test.ts' --exclude 'tests/lib/worker-gate.test.ts' --exclude 'tests/daemon-perf-stress.test.ts' --exclude 'tests/lib/gateway-client.test.ts' --exclude 'tests/lib/ws-client.test.ts' --exclude 'tests/lib/ws-auth.test.ts' --exclude 'tests/integration/clean-stack-projection.test.ts' --exclude 'tests/device-id-split-brain.test.ts' --exclude 'tests/orchestration/dispatch-chain.test.ts' --exclude 'tests/orchestration/e2e-flow.test.ts' --exclude 'tests/lib/reaper-deps-async.test.ts' --exclude 'tests/lib/find-free-instance.test.ts' --exclude 'tests/lib/db-backup-recovery.test.ts' && echo '::warning::clean-stack-projection quarantined (needs Docker); ws-client/ws-auth quarantined (30-120s timeouts flaky on Node 20 CI runner \u2014 passes locally). Quarantined to match build-and-test (required gate): device-id-split-brain/dispatch-chain/e2e-flow/reaper-deps-async (timing-sensitive, flaky under parallel load \u2014 bug dfb25bf1), find-free-instance (parallelism race) and db-backup-recovery (load-sensitive, feature 57a1d161) \u2014 all pass reliably in isolation (maxWorkers=1); still covered by build-and-test/extended-tests in CI. See cicd-audit-2026-06-18.md.' && npx vitest run --maxWorkers=1 tests/daemon-perf-stress.test.ts tests/lib/gateway-client.test.ts",
+    "test:publish": "npx vitest run --maxWorkers=4 --exclude 'tests/tui/**' --exclude 'tests/lib/tmux-routing.test.ts' --exclude 'tests/lib/intercom-routing.test.ts' --exclude 'tests/gateway/**' --exclude 'tests/mcp/ingest-document.test.ts' --exclude 'tests/lib/hybrid-search.test.ts' --exclude 'tests/lib/worker-gate.test.ts' --exclude 'tests/daemon-perf-stress.test.ts' --exclude 'tests/lib/gateway-client.test.ts' --exclude 'tests/lib/ws-client.test.ts' --exclude 'tests/lib/ws-auth.test.ts' --exclude 'tests/integration/clean-stack-projection.test.ts' --exclude 'tests/lib/stack-update.test.ts' --exclude 'tests/device-id-split-brain.test.ts' --exclude 'tests/orchestration/dispatch-chain.test.ts' --exclude 'tests/orchestration/e2e-flow.test.ts' --exclude 'tests/lib/reaper-deps-async.test.ts' --exclude 'tests/lib/find-free-instance.test.ts' --exclude 'tests/lib/db-backup-recovery.test.ts' && echo '::warning::clean-stack-projection and stack-update quarantined (need Docker + live DB; environmental, fail in CI runner — container unhealthy / DB not initialized); ws-client/ws-auth quarantined (30-120s timeouts flaky on Node 20 CI runner — passes locally). Quarantined to match build-and-test (required gate): device-id-split-brain/dispatch-chain/e2e-flow/reaper-deps-async (timing-sensitive, flaky under parallel load — bug dfb25bf1), find-free-instance (parallelism race) and db-backup-recovery (load-sensitive, feature 57a1d161) — all pass reliably in isolation (maxWorkers=1); still covered by build-and-test/extended-tests in CI. See cicd-audit-2026-06-18.md.' && npx vitest run --maxWorkers=1 tests/daemon-perf-stress.test.ts tests/lib/gateway-client.test.ts",
     "benchmark:longmemeval": "npx tsx tests/benchmarks/longmemeval.ts",
     "guard:esm-require": "node scripts/check-no-runtime-require.mjs",
     "check:schema-version": "node scripts/check-schema-version.mjs",

package/release-notes.json

@@ -1,11 +1,35 @@
 {
-  "current": "0.9.336",
+  "current": "0.9.338",
   "notes": {
-    "0.9.336": {
-      "version": "0.9.336",
-      "date": "2026-07-04",
+    "0.9.338": {
+      "version": "0.9.338",
+      "date": "2026-07-05",
       "features": [],
       "fixes": [
+        "de-block event-loop timers + starvation-aware self-heal (ddbfc3f6) (#341)"
+      ],
+      "security": [],
+      "other": [
+        "bump v0.9.338 (#343)"
+      ],
+      "migration_notes": []
+    },
+    "0.9.337": {
+      "version": "0.9.337",
+      "date": "2026-07-05",
+      "features": [
+        "monitoring-grant envelope MVP (Model B, default-OFF) (#340)",
+        "add xAI/Grok models to opencode whitelist (feature 6e59b416) (#315)",
+        "escalate + auto-cancel tasks blocked >48h (feature 638f8611) (#321)",
+        "load persistent ~/.exe-os/daemon.env at boot as env fallback (feature ed0e3449) (#316)",
+        "auto-clone missing stack repos on build VPS (feature 77a7792d) (#320)"
+      ],
+      "fixes": [
+        "harden daemon recovery and task routing (#339)",
+        "codex review — bypass broken bwrap sandbox, gate on [P0]/[P1], skip drafts",
+        "codex review --base cannot take a custom prompt (mutually exclusive) — use --base alone",
+        "quarantine Docker-dependent stack-update.test.ts out of required gate (unblocks merges) (#331)",
+        "repair codex-review workflow YAML — move prompt to file, fix multi-line body (startup failure)",
         "make Claude 1M context opt-in",
         "bound prompt hook and setup daemon health",
         "resolve worktrees from main repo root",
@@ -116,22 +140,6 @@
         "add merge_group trigger to enable GitHub Merge Queue (batches PRs, ends per-push runner storms; runs on self-hosted build-my, zero hosted minutes)"
       ],
       "migration_notes": []
-    },
-    "0.9.327": {
-      "version": "0.9.327",
-      "date": "2026-07-04",
-      "features": [],
-      "fixes": [
-        "Consolidation/dreaming and CLaRa query routing now work on metered customer hosts using API_ROUTER_URL/API_ROUTER_KEY, not only raw Anthropic credentials (bug d1837f47)",
-        "Agent worktree reuse now verifies the checked-out branch and repairs clean stale/wrong-branch worktrees instead of reusing by path alone (Round 3 Report 2)",
-        "Hook latency and safety hardening: MCP stdio calls timeout, non-tmux prompts skip tmux exec, SubagentStop fails closed for real employees, and hook/MCP settings tamper attempts are blocked (Round 3 Report 4)",
-        "Setup wizard/install hardening: recovery phrase ceremony reruns when backup confirmation is missing, setup state honors EXE_AI_DIR, headless logs redact secrets, user license keys survive transient validation failures, postinstall refreshes MCP/hooks, and daemon spawn reports unverified early exits (Round 3 Report 5)"
-      ],
-      "security": [
-        "Non-coordinator agents are guarded from writing Claude/exe-os hook and MCP settings via common tool-write paths."
-      ],
-      "other": [],
-      "migration_notes": []
     }
   }
 }

package/dist/chunk-LO6L5ADL.js

@@ -1,76 +0,0 @@
-// src/lib/crypto.ts
-import crypto from "crypto";
-var ALGORITHM = "aes-256-gcm";
-var IV_LENGTH = 12;
-var TAG_LENGTH = 16;
-var SYNC_HKDF_INFO = "exe-mem-sync-v2";
-var SYNC_BLOB_VERSION = 1;
-var CURRENT_KEY_ID = 0;
-var VERSIONED_HEADER_LENGTH = 2;
-var _syncKey = null;
-function initSyncCrypto(masterKey) {
-  if (masterKey.length !== 32) {
-    throw new Error(`Master key must be 32 bytes, got ${masterKey.length}`);
-  }
-  _syncKey = Buffer.from(
-    crypto.hkdfSync("sha256", masterKey, "", SYNC_HKDF_INFO, 32)
-  );
-}
-function isSyncCryptoInitialized() {
-  return _syncKey !== null;
-}
-function requireSyncKey() {
-  if (!_syncKey) {
-    throw new Error("Sync crypto not initialized. Call initSyncCrypto(masterKey) first.");
-  }
-  return _syncKey;
-}
-function encryptSyncBlob(data) {
-  const key = requireSyncKey();
-  const iv = crypto.randomBytes(IV_LENGTH);
-  const cipher = crypto.createCipheriv(ALGORITHM, key, iv);
-  const encrypted = Buffer.concat([cipher.update(data), cipher.final()]);
-  const tag = cipher.getAuthTag();
-  return Buffer.concat([Buffer.from([SYNC_BLOB_VERSION, CURRENT_KEY_ID]), iv, encrypted, tag]).toString("base64");
-}
-function decryptSyncBlob(ciphertext) {
-  const key = requireSyncKey();
-  const combined = Buffer.from(ciphertext, "base64");
-  if (combined.length < IV_LENGTH + TAG_LENGTH) {
-    throw new Error("Sync blob too short to contain IV + tag");
-  }
-  if (combined[0] === SYNC_BLOB_VERSION && combined.length >= VERSIONED_HEADER_LENGTH + IV_LENGTH + TAG_LENGTH) {
-    try {
-      const keyId = combined[1];
-      if (keyId !== CURRENT_KEY_ID) {
-        throw new Error(`Unsupported sync blob key id: ${keyId}`);
-      }
-      return decryptAesGcm(combined.subarray(VERSIONED_HEADER_LENGTH), key);
-    } catch (err) {
-      try {
-        return decryptAesGcm(combined, key);
-      } catch {
-        throw err;
-      }
-    }
-  }
-  return decryptAesGcm(combined, key);
-}
-function decryptAesGcm(combined, key) {
-  if (combined.length < IV_LENGTH + TAG_LENGTH) {
-    throw new Error("Sync blob too short to contain IV + tag");
-  }
-  const iv = combined.subarray(0, IV_LENGTH);
-  const tag = combined.subarray(combined.length - TAG_LENGTH);
-  const encrypted = combined.subarray(IV_LENGTH, combined.length - TAG_LENGTH);
-  const decipher = crypto.createDecipheriv(ALGORITHM, key, iv);
-  decipher.setAuthTag(tag);
-  return Buffer.concat([decipher.update(encrypted), decipher.final()]);
-}
-
-export {
-  initSyncCrypto,
-  isSyncCryptoInitialized,
-  encryptSyncBlob,
-  decryptSyncBlob
-};

package/dist/{chunk-7UMCQQWS.js → chunk-A4DVMPYB.js}

@@ -1,10 +1,10 @@
+import {
+  resolveType
+} from "./chunk-GUMRIUI5.js";
 import {
   chunkSourceFile,
   languageForFile
 } from "./chunk-Z6BZQHP5.js";
-import {
-  resolveType
-} from "./chunk-GUMRIUI5.js";
 
 // src/lib/graph-rag.ts
 import crypto from "crypto";