@askexenow/exe-os 0.9.336 → 0.9.338

package/dist/{catchup-brief-JGRVXTBF.js → catchup-brief-S35QLMG3.js}

@@ -1,30 +1,30 @@
 import {
   lightweightSearch
-} from "./chunk-DUBZDAXS.js";
+} from "./chunk-QBTWXDFK.js";
 import "./chunk-AB4PAQYK.js";
-import "./chunk-YOZJWU2I.js";
+import "./chunk-H37HHX3E.js";
 import "./chunk-CHCA3ZM2.js";
 import "./chunk-OTVEIJUQ.js";
-import "./chunk-GOAPKDWS.js";
+import "./chunk-HHIBOU3P.js";
 import "./chunk-Y25OJWOQ.js";
 import {
   sessionScopeFilter,
   strictSessionScopeFilter
-} from "./chunk-ROAUSSJI.js";
-import "./chunk-CMZLULTW.js";
-import "./chunk-SKFA42EO.js";
-import "./chunk-RQ3EUVVT.js";
+} from "./chunk-PLRIJALF.js";
+import "./chunk-OFX5B2S7.js";
+import "./chunk-B76TSEP3.js";
+import "./chunk-RLRT2BVM.js";
+import "./chunk-4JERP7NT.js";
 import "./chunk-EIKATSE4.js";
 import "./chunk-E23LNUWJ.js";
-import "./chunk-4JERP7NT.js";
-import "./chunk-QIJEW462.js";
+import "./chunk-UIV2WPBT.js";
 import "./chunk-SSTLTIF3.js";
 import "./chunk-RMOBQ6A5.js";
 import "./chunk-54QCG45Y.js";
-import "./chunk-X7BGMYZS.js";
-import "./chunk-XUOSKPVP.js";
+import "./chunk-FUIIVSW6.js";
+import "./chunk-65SVQELL.js";
 import "./chunk-NGP6LSV2.js";
-import "./chunk-BF252PDD.js";
+import "./chunk-MW2GJJ53.js";
 import "./chunk-CVYC6DUW.js";
 import "./chunk-2233TQCA.js";
 import "./chunk-HCJCW7X4.js";
@@ -38,16 +38,16 @@ import "./chunk-GJV3WDWM.js";
 import "./chunk-MP2AFCGL.js";
 import {
   getClient
-} from "./chunk-XZHA3WO2.js";
+} from "./chunk-HEPR6QTL.js";
 import "./chunk-2I23RPSI.js";
-import "./chunk-5KCRWAWF.js";
+import "./chunk-ATOU6CYR.js";
 import "./chunk-PNQDP3OA.js";
 import "./chunk-H73TUI4Y.js";
 import "./chunk-7HLWBYH7.js";
 import "./chunk-FXU7JOXK.js";
 import "./chunk-Z42MXYWW.js";
-import "./chunk-P6OW236E.js";
-import "./chunk-DFJVHZ6Z.js";
+import "./chunk-XACL67CS.js";
+import "./chunk-5Z5NATNS.js";
 import "./chunk-7Y5UDEVM.js";
 import "./chunk-SHIICYJW.js";
 import "./chunk-MLKGABMK.js";
@@ -156,7 +156,7 @@ ${msgLines}`);
   } catch {
   }
   try {
-    const { getPendingProspective, markSurfaced } = await import("./prospective-memory-T7Z67MF7.js");
+    const { getPendingProspective, markSurfaced } = await import("./prospective-memory-W6S67LZZ.js");
     const due = await getPendingProspective(agentId, { projectName, limit: 5 });
     if (due.length > 0) {
       const now = Date.now();

package/dist/{chunk-EVWJQBCW.js → chunk-2HZY3ECT.js}

@@ -1,7 +1,10 @@
+import {
+  IMessageAdapter
+} from "./chunk-2SRG3B3D.js";
 import {
   createCRMWebhookHandler,
   parseTwentyWebhook
-} from "./chunk-QWWGMK4Y.js";
+} from "./chunk-6MRWJMI5.js";
 import {
   WhatsAppAdapter
 } from "./chunk-ECSNSHZ7.js";
@@ -17,9 +20,6 @@ import {
 import {
   SlackAdapter
 } from "./chunk-ORCCI2VV.js";
-import {
-  IMessageAdapter
-} from "./chunk-2SRG3B3D.js";
 import {
   BotRegistry,
   BotRuntime,
@@ -42,7 +42,7 @@ import {
   retryWithBackoff,
   routeMessage,
   validateGatewayConfig
-} from "./chunk-6ND3MBX7.js";
+} from "./chunk-7EA7LYW4.js";
 import {
   OllamaProvider
 } from "./chunk-FWFFZGSC.js";

package/dist/{chunk-5M7RPT2V.js → chunk-2SG2UGCH.js}

@@ -1,13 +1,13 @@
 import {
   deactivateBehavior
-} from "./chunk-HDALYSEP.js";
+} from "./chunk-TLYAEISW.js";
 import {
   getActiveAgent
-} from "./chunk-YBVKLDT3.js";
+} from "./chunk-DZ6OQM67.js";
 import {
   canCoordinate,
   getClient
-} from "./chunk-XZHA3WO2.js";
+} from "./chunk-HEPR6QTL.js";
 
 // src/mcp/tools/deactivate-behavior.ts
 import { z } from "zod";
@@ -24,7 +24,7 @@ function registerDeactivateBehavior(server) {
     async ({ behavior_id }) => {
       const caller = getActiveAgent();
       try {
-        const { StewardGate } = await import("./steward-gate-WGP4QWXQ.js");
+        const { StewardGate } = await import("./steward-gate-WT7WXQIE.js");
         const steward = new StewardGate();
         const gateDecision = await steward.checkAuthority(caller.agentId || "unknown", "deactivate_behavior", behavior_id);
         if (!gateDecision.allowed) {

package/dist/{chunk-6E5DEC2D.js → chunk-3OBWSCJN.js}

@@ -1,23 +1,23 @@
-import {
-  createTokenBudgetMiddleware
-} from "./chunk-XDIYCXMJ.js";
 import {
   MultiAgentOrchestrator
-} from "./chunk-7JM2LGHO.js";
+} from "./chunk-52KNOQMK.js";
+import {
+  createTokenBudgetMiddleware
+} from "./chunk-RRWDYOQS.js";
 import {
   createQuietRenderer,
   createTerminalRenderer,
   renderAgentEvents
 } from "./chunk-YZFZDJWZ.js";
+import {
+  checkDangerousPatterns,
+  hasCriticalPattern
+} from "./chunk-CMCYL2JC.js";
 import {
   checkPathSafety,
   checkReadPathSafety,
   containsPathTraversal
 } from "./chunk-NGVOA6ZQ.js";
-import {
-  checkDangerousPatterns,
-  hasCriticalPattern
-} from "./chunk-CMCYL2JC.js";
 import {
   ContextManager,
   agentLoop,
@@ -209,7 +209,7 @@ function createExeOSHooks(config) {
         );
       }
       try {
-        const { listBehaviors } = await import("./behaviors-EHEN4II7.js");
+        const { listBehaviors } = await import("./behaviors-HLZUJSMP.js");
         const behaviors = await listBehaviors(config.agentId, config.projectName, 12);
         if (behaviors.length > 0) {
           process.stderr.write(
@@ -330,7 +330,7 @@ function createExeOSHooks(config) {
     async onSubagentStop(_reason) {
       try {
         const { getClient } = await import("./lib/database.js");
-        const { sessionScopeFilter } = await import("./task-scope-VMYGYVCH.js");
+        const { sessionScopeFilter } = await import("./task-scope-CQEG5SSJ.js");
         const client = getClient();
         const ehScope = sessionScopeFilter();
         const tasks = await client.execute({
@@ -422,7 +422,7 @@ function createExeOSHooks(config) {
         try {
           const { writeMemory, flushBatch } = await import("./lib/store.js");
           const { getClient } = await import("./lib/database.js");
-          const { sessionScopeFilter: cpScopeFilter } = await import("./task-scope-VMYGYVCH.js");
+          const { sessionScopeFilter: cpScopeFilter } = await import("./task-scope-CQEG5SSJ.js");
           const client = getClient();
           const cpScope = cpScopeFilter();
           const tasks = await client.execute({

package/dist/{chunk-VVFWJU3D.js → chunk-4IYSBPX3.js}

@@ -1,6 +1,6 @@
 import {
   isCoordinatorRole
-} from "./chunk-XZHA3WO2.js";
+} from "./chunk-HEPR6QTL.js";
 
 // src/lib/task-router.ts
 import { randomUUID } from "crypto";

package/dist/{chunk-7JM2LGHO.js → chunk-52KNOQMK.js}

@@ -1,6 +1,6 @@
 import {
   routeTask
-} from "./chunk-VVFWJU3D.js";
+} from "./chunk-4IYSBPX3.js";
 import {
   createTaskCore,
   employeeSessionName,
@@ -9,11 +9,11 @@ import {
   isEmployeeAlive,
   sessionScopeFilter,
   updateTaskStatus
-} from "./chunk-ROAUSSJI.js";
+} from "./chunk-PLRIJALF.js";
 import {
   DEFAULT_COORDINATOR_TEMPLATE_NAME,
   getCoordinatorName
-} from "./chunk-XZHA3WO2.js";
+} from "./chunk-HEPR6QTL.js";
 
 // src/runtime/orchestrator.ts
 var STALE_THRESHOLD_MS = 2 * 60 * 60 * 1e3;

package/dist/{chunk-NCS7UNML.js → chunk-542EWGY3.js}

@@ -2,7 +2,7 @@ import {
   dispatchTaskToEmployee,
   markTaskNotificationsRead,
   notifyTaskDone
-} from "./chunk-W33EMSZB.js";
+} from "./chunk-I7Z6KTGF.js";
 import {
   cleanupReviewFile,
   createTaskCore,
@@ -11,7 +11,7 @@ import {
   sessionScopeFilter,
   updateTaskStatus,
   writeNotification
-} from "./chunk-ROAUSSJI.js";
+} from "./chunk-PLRIJALF.js";
 import {
   orgBus
 } from "./chunk-MP2AFCGL.js";
@@ -19,7 +19,7 @@ import {
   getClient,
   getCoordinatorName,
   isCoordinatorName
-} from "./chunk-XZHA3WO2.js";
+} from "./chunk-HEPR6QTL.js";
 import {
   EXE_AI_DIR
 } from "./chunk-7Y5UDEVM.js";
@@ -61,7 +61,7 @@ async function cascadeUnblock(taskId, baseDir, now) {
   }
   if (unblockedRows.rows.length > 0 && !process.env.VITEST) {
     try {
-      const { dispatchTaskToEmployee: dispatchTaskToEmployee2 } = await import("./tasks-notify-R6KGKW5R.js");
+      const { dispatchTaskToEmployee: dispatchTaskToEmployee2 } = await import("./tasks-notify-SMLDFBWM.js");
       const dispatched = /* @__PURE__ */ new Set();
       for (const ur of unblockedRows.rows) {
         const assignee = String(ur.assigned_to);
@@ -86,7 +86,7 @@ async function cascadeUnblock(taskId, baseDir, now) {
       }
     } catch {
       try {
-        const { queueIntercom } = await import("./intercom-queue-NQFQZXQP.js");
+        const { queueIntercom } = await import("./intercom-queue-VU2G6F5R.js");
         const dispatched = /* @__PURE__ */ new Set();
         for (const ur of unblockedRows.rows) {
           const assignee = String(ur.assigned_to);
@@ -289,7 +289,7 @@ async function updateTask(input) {
         try {
           process.stderr.write(`[tasks] EVENT: tmux delivery failed for reviewer="${reviewer}". Queueing for daemon delivery.
 `);
-          const { queueIntercom } = await import("./intercom-queue-NQFQZXQP.js");
+          const { queueIntercom } = await import("./intercom-queue-VU2G6F5R.js");
           const { resolveExeSession } = await import("./lib/tmux-routing.js");
           const exeSession = row.session_scope ? String(row.session_scope) : resolveExeSession();
           if (exeSession) {
@@ -333,7 +333,7 @@ async function updateTask(input) {
     await markTaskNotificationsRead(taskFile);
     if (isCompletionReviewTransition && !isCoordinator && row.reviewer) {
       try {
-        const { writeNotification: writeNotification2 } = await import("./notifications-A43CXO7Q.js");
+        const { writeNotification: writeNotification2 } = await import("./notifications-KONB3C62.js");
         const reviewer = String(row.reviewer);
         await writeNotification2({
           agentId: reviewer,

package/dist/{chunk-XUOSKPVP.js → chunk-65SVQELL.js}

@@ -17,7 +17,7 @@ var AGENT_CONFIG_PATH = path.join(EXE_AI_DIR, "agent-config.json");
 var KNOWN_RUNTIMES = {
   claude: ["claude-opus-4.8", "claude-opus-4.8-1m", "claude-opus-4.6", "claude-sonnet-4.8", "claude-sonnet-4.6", "claude-haiku-4.5", "claude-fable-5"],
   codex: ["gpt-5.4", "gpt-5.5", "gpt-5.3-codex-spark", "o3", "o4-mini"],
-  opencode: ["anthropic/claude-opus-4-8", "anthropic/claude-sonnet-4-8", "anthropic/claude-sonnet-4-6", "openai/gpt-5.4", "google/gemini-2.5-pro", "deepseek/deepseek-r3", "minimax/minimax-m2.5"]
+  opencode: ["anthropic/claude-opus-4-8", "anthropic/claude-sonnet-4-8", "anthropic/claude-sonnet-4-6", "openai/gpt-5.4", "google/gemini-2.5-pro", "deepseek/deepseek-r3", "minimax/minimax-m2.5", "xai/grok-4", "xai/grok-3", "xai/grok-2-latest", "xai/grok-2-1212", "xai/grok-beta"]
 };
 var RETIRED_MODELS = {
   "claude-sonnet-4": "claude-sonnet-4.6",

package/dist/{chunk-S7LMZ6VM.js → chunk-6HBURYON.js}

@@ -8,7 +8,7 @@ import {
 import {
   loadLicense,
   readCachedLicenseToken
-} from "./chunk-P6OW236E.js";
+} from "./chunk-XACL67CS.js";
 import {
   EXE_AI_DIR,
   loadConfig

package/dist/{chunk-UPH5EY5F.js → chunk-6IRVGOUL.js}

@@ -1,6 +1,6 @@
 import {
   createReminder
-} from "./chunk-EGCYJ4LJ.js";
+} from "./chunk-KMBEL7VB.js";
 
 // src/mcp/tools/create-reminder.ts
 import { z } from "zod";

package/dist/{chunk-2DJTSJWW.js → chunk-6M36JFFD.js}

@@ -4,10 +4,10 @@ import {
 import {
   reserveVersions,
   vectorToBlob
-} from "./chunk-YOZJWU2I.js";
+} from "./chunk-H37HHX3E.js";
 import {
   getClient
-} from "./chunk-XZHA3WO2.js";
+} from "./chunk-HEPR6QTL.js";
 
 // src/lib/documents.ts
 import crypto from "crypto";
@@ -270,7 +270,7 @@ async function ingestDocument(input) {
   await client.batch([documentStmt, ...chunkStmts], "write");
   const embedded = vectors.filter((v) => v !== null).length;
   const originalTexts = input.chunks.map((c) => c.text);
-  import("./doc-graph-extractor-SDH4QDWF.js").then(
+  import("./doc-graph-extractor-3TRLGD7M.js").then(
     ({ extractAndStoreDocumentGraph }) => extractAndStoreDocumentGraph(documentId, originalTexts)
   ).catch((err) => {
     process.stderr.write(

package/dist/{chunk-QWWGMK4Y.js → chunk-6MRWJMI5.js}

@@ -1,6 +1,6 @@
 import {
   processCRMEvent
-} from "./chunk-XETUG5DN.js";
+} from "./chunk-KTPG4XKI.js";
 
 // src/gateway/adapters/crm-webhook.ts
 function parseTwentyWebhook(payload) {

package/dist/{chunk-6ND3MBX7.js → chunk-7EA7LYW4.js}

@@ -2,10 +2,10 @@ import {
   listWorkflowDefinitions,
   runWorkflow,
   startWorkflow
-} from "./chunk-4ZH65EXT.js";
+} from "./chunk-QXSBB26A.js";
 import {
   ingest
-} from "./chunk-5OM6Z22T.js";
+} from "./chunk-7WDXEKUL.js";
 import {
   initCRMBridge
 } from "./chunk-ML4S5SHZ.js";

package/dist/{chunk-5OM6Z22T.js → chunk-7WDXEKUL.js}

@@ -1,6 +1,6 @@
 import {
   getClient
-} from "./chunk-XZHA3WO2.js";
+} from "./chunk-HEPR6QTL.js";
 
 // src/lib/pipeline-router.ts
 import crypto from "crypto";
@@ -140,8 +140,8 @@ Agent response: ${agentResponse}` : ""
 }
 async function sinkEntityExtraction(msg, agentResponse, agentName) {
   try {
-    const { extractFromConversation } = await import("./conversation-entity-extractor-FPAMTL3C.js");
-    const { storeExtraction } = await import("./graph-rag-WAK2BRJH.js");
+    const { extractFromConversation } = await import("./conversation-entity-extractor-D3EFTLT4.js");
+    const { storeExtraction } = await import("./graph-rag-JZZAB7PC.js");
     if ((msg.text?.length ?? 0) < 20) return false;
     if (msg.isHistorical) return false;
     const extraction = await extractFromConversation(msg, agentResponse, agentName);

package/dist/{chunk-OMU7HDKI.js → chunk-AOO77BDE.js}

@@ -2,7 +2,7 @@ import {
   getClient,
   isCoordinatorName,
   loadEmployeesSync
-} from "./chunk-XZHA3WO2.js";
+} from "./chunk-HEPR6QTL.js";
 
 // src/lib/steward-gate.ts
 import crypto from "crypto";

package/dist/{chunk-O2RF5NGI.js → chunk-AVKXCSBI.js}

@@ -3,7 +3,7 @@ import {
 } from "./chunk-X2FHTDIU.js";
 import {
   loadEmployeesSync
-} from "./chunk-XZHA3WO2.js";
+} from "./chunk-HEPR6QTL.js";
 
 // src/adapters/mcp-http-config.ts
 import { chmodSync, existsSync, mkdirSync, readFileSync, writeFileSync } from "fs";

package/dist/{chunk-JGHVEDZG.js → chunk-B2GLEEGY.js}

@@ -3,7 +3,7 @@ import {
 } from "./chunk-WCGNCH3Q.js";
 import {
   registerAllTools
-} from "./chunk-AMBCXARR.js";
+} from "./chunk-ISD7ZD45.js";
 
 // src/mcp/mcp-surface-hash.ts
 function computeMcpSurfaceHash() {

package/dist/chunk-B75BOKEI.js

@@ -0,0 +1,193 @@
+import {
+  isValidX25519Recipient,
+  pubKeyHash
+} from "./chunk-JCBKARSK.js";
+import {
+  EXE_AI_DIR
+} from "./chunk-7Y5UDEVM.js";
+
+// src/lib/monitor-grants.ts
+import crypto from "crypto";
+import { existsSync, mkdirSync, readFileSync, writeFileSync, renameSync } from "fs";
+import path from "path";
+var GRANTS_MAC_HKDF_INFO = "exe-os-monitor-grants-mac-v1";
+var _macKey = null;
+var _warnedUnverified = false;
+var _warnedActiveMonitoring = false;
+function primeGrantsMacKey(masterKey) {
+  if (masterKey.length !== 32) {
+    throw new Error(`Master key must be 32 bytes, got ${masterKey.length}`);
+  }
+  _macKey = Buffer.from(crypto.hkdfSync("sha256", masterKey, "", GRANTS_MAC_HKDF_INFO, 32));
+}
+function isGrantsMacPrimed() {
+  return _macKey !== null;
+}
+function dataDir() {
+  return process.env.EXE_OS_DIR ?? process.env.EXE_MEM_DIR ?? EXE_AI_DIR;
+}
+function grantsPath() {
+  return path.join(dataDir(), "monitor-grants.json");
+}
+function macMessage(grants) {
+  return Buffer.from(JSON.stringify(grants), "utf8");
+}
+function computeMac(grants) {
+  if (!_macKey) throw new Error("Grants MAC key not primed");
+  return crypto.createHmac("sha256", _macKey).update(macMessage(grants)).digest("hex");
+}
+function warnUnverifiedOnce(reason) {
+  if (_warnedUnverified) return;
+  _warnedUnverified = true;
+  process.stderr.write(
+    `[exe-os] \u26A0 monitor-grants.json ${reason} \u2014 refusing to honor it. Monitoring is treated as OFF. If you did not expect this, your grants file may have been tampered with; re-add trusted grants with \`exe-os grant add\`.
+`
+  );
+}
+function isWellFormedGrant(g) {
+  if (typeof g !== "object" || g === null) return false;
+  const r = g;
+  if (typeof r.owner_pub_b64 !== "string") return false;
+  if (typeof r.grant_id !== "string") return false;
+  if (typeof r.added_at !== "string") return false;
+  if (!(r.revoked_at === null || typeof r.revoked_at === "string")) return false;
+  if (!(r.label === void 0 || typeof r.label === "string")) return false;
+  return true;
+}
+function loadFile() {
+  const p = grantsPath();
+  if (!existsSync(p)) return { version: 1, grants: [] };
+  let raw;
+  try {
+    raw = JSON.parse(readFileSync(p, "utf8"));
+  } catch {
+    warnUnverifiedOnce("is unreadable/corrupt");
+    return { version: 1, grants: [] };
+  }
+  if (!raw || !Array.isArray(raw.grants)) return { version: 1, grants: [] };
+  if (!raw.grants.every(isWellFormedGrant)) {
+    warnUnverifiedOnce("contains a malformed grant entry");
+    return { version: 1, grants: [] };
+  }
+  const grants = raw.grants;
+  if (!_macKey) {
+    warnUnverifiedOnce("cannot be integrity-verified (encryption key unavailable)");
+    return { version: 1, grants: [] };
+  }
+  if (typeof raw.mac !== "string") {
+    warnUnverifiedOnce("is missing its integrity MAC");
+    return { version: 1, grants: [] };
+  }
+  const expected = computeMac(grants);
+  const got = raw.mac;
+  const a = Buffer.from(expected, "hex");
+  const b = Buffer.from(got, "hex");
+  if (a.length !== b.length || !crypto.timingSafeEqual(a, b)) {
+    warnUnverifiedOnce("has an invalid integrity MAC");
+    return { version: 1, grants: [] };
+  }
+  return { version: 1, grants };
+}
+function saveFile(grants) {
+  if (!_macKey) {
+    throw new Error(
+      "Cannot write monitoring grants: encryption key not available to sign the grants file. Run this from a device where `exe-os` can read the master key."
+    );
+  }
+  const dir = dataDir();
+  if (!existsSync(dir)) mkdirSync(dir, { recursive: true, mode: 448 });
+  const p = grantsPath();
+  const tmp = `${p}.tmp`;
+  const file = { version: 1, grants, mac: computeMac(grants) };
+  writeFileSync(tmp, JSON.stringify(file, null, 2) + "\n", { mode: 384 });
+  renameSync(tmp, p);
+}
+function assertValidPub(ownerPubB64) {
+  let buf;
+  try {
+    buf = Buffer.from(ownerPubB64, "base64");
+  } catch {
+    throw new Error("owner public key is not valid base64");
+  }
+  if (buf.length !== 32) {
+    throw new Error(`owner public key must decode to 32 bytes, got ${buf.length}`);
+  }
+  if (!isValidX25519Recipient(buf)) {
+    throw new Error("owner public key is not a valid X25519 point (rejected low-order/degenerate key)");
+  }
+  return buf;
+}
+function listGrants() {
+  return loadFile().grants.slice().sort((a, b) => b.added_at.localeCompare(a.added_at));
+}
+function addGrant(ownerPubB64, label) {
+  const pub = assertValidPub(ownerPubB64);
+  const canonical = pub.toString("base64");
+  const grants = loadFile().grants;
+  const existing = grants.find(
+    (g) => g.revoked_at === null && Buffer.from(g.owner_pub_b64, "base64").toString("base64") === canonical
+  );
+  if (existing) return { grant_id: existing.grant_id, created: false };
+  const grant = {
+    grant_id: crypto.randomBytes(8).toString("hex"),
+    owner_pub_b64: canonical,
+    added_at: (/* @__PURE__ */ new Date()).toISOString(),
+    revoked_at: null,
+    ...label ? { label } : {}
+  };
+  grants.push(grant);
+  saveFile(grants);
+  return { grant_id: grant.grant_id, created: true };
+}
+function revokeGrant(grantIdOrOwnerPub) {
+  const grants = loadFile().grants;
+  let canonical = null;
+  try {
+    const buf = Buffer.from(grantIdOrOwnerPub, "base64");
+    if (buf.length === 32) canonical = buf.toString("base64");
+  } catch {
+  }
+  let revoked = 0;
+  const now = (/* @__PURE__ */ new Date()).toISOString();
+  for (const g of grants) {
+    if (g.revoked_at !== null) continue;
+    const matchesId = g.grant_id === grantIdOrOwnerPub;
+    const matchesPub = canonical !== null && g.owner_pub_b64 === canonical;
+    if (matchesId || matchesPub) {
+      g.revoked_at = now;
+      revoked++;
+    }
+  }
+  if (revoked > 0) saveFile(grants);
+  return revoked;
+}
+function activeRecipientPubKeys() {
+  return loadFile().grants.filter((g) => g.revoked_at === null).map((g) => Buffer.from(g.owner_pub_b64, "base64")).filter((buf) => buf.length === 32);
+}
+function warnActiveMonitoringOnce(recipientPubKeys) {
+  if (_warnedActiveMonitoring || recipientPubKeys.length === 0) return;
+  _warnedActiveMonitoring = true;
+  const hashes = recipientPubKeys.map((p) => pubKeyHash(p).toString("hex")).join(", ");
+  process.stderr.write(
+    `[exe-os] \u26A0 ${recipientPubKeys.length} active monitoring recipient(s) \u2014 your memories are being encrypted to external key(s): ${hashes}
+[exe-os]   Review or revoke with: exe-os grant list
+`
+  );
+}
+function _resetGrantsStateForTest() {
+  _macKey = null;
+  _warnedUnverified = false;
+  _warnedActiveMonitoring = false;
+}
+
+export {
+  primeGrantsMacKey,
+  isGrantsMacPrimed,
+  grantsPath,
+  listGrants,
+  addGrant,
+  revokeGrant,
+  activeRecipientPubKeys,
+  warnActiveMonitoringOnce,
+  _resetGrantsStateForTest
+};

package/dist/{chunk-SKFA42EO.js → chunk-B76TSEP3.js}

@@ -1,6 +1,6 @@
 import {
   recordOrchestrationEventBestEffort
-} from "./chunk-X7BGMYZS.js";
+} from "./chunk-FUIIVSW6.js";
 
 // src/lib/worktree.ts
 import { execSync } from "child_process";

package/dist/{chunk-ELOJZIVD.js → chunk-BPC5LZ6Y.js}

@@ -1,6 +1,6 @@
 import {
   getClient
-} from "./chunk-XZHA3WO2.js";
+} from "./chunk-HEPR6QTL.js";
 import {
   loadConfigSync
 } from "./chunk-7Y5UDEVM.js";

package/dist/{chunk-DUSZ2ZQE.js → chunk-BU2QQWBQ.js}

@@ -1,6 +1,6 @@
 import {
   listReminders
-} from "./chunk-EGCYJ4LJ.js";
+} from "./chunk-KMBEL7VB.js";
 
 // src/mcp/tools/list-reminders.ts
 import { z } from "zod";

package/dist/{chunk-B6QRDKL3.js → chunk-DADMPMYX.js}

@@ -1,7 +1,7 @@
 import {
   checkLicense,
   loadLicense
-} from "./chunk-P6OW236E.js";
+} from "./chunk-XACL67CS.js";
 
 // src/lib/license-gate.ts
 var _cachedLicense = null;