@askexenow/exe-os 0.9.336 → 0.9.338

package/dist/chunk-JCBKARSK.js

@@ -0,0 +1,113 @@
+import {
+  getMasterKey
+} from "./chunk-Z42MXYWW.js";
+
+// src/lib/monitor-identity.ts
+import crypto from "crypto";
+var MONITOR_HKDF_INFO = "exe-os-monitor-x25519-v1";
+var ENVELOPE_WRAP_INFO = "exe-os-envelope-v1";
+var X25519_PKCS8_PREFIX = Buffer.from("302e020100300506032b656e04220420", "hex");
+var X25519_SPKI_PREFIX = Buffer.from("302a300506032b656e032100", "hex");
+var _cachedIdentity = null;
+function privateKeyFromScalar(seed) {
+  if (seed.length !== 32) {
+    throw new Error(`X25519 scalar must be 32 bytes, got ${seed.length}`);
+  }
+  return crypto.createPrivateKey({
+    key: Buffer.concat([X25519_PKCS8_PREFIX, seed]),
+    format: "der",
+    type: "pkcs8"
+  });
+}
+function publicKeyFromRaw(pub) {
+  if (pub.length !== 32) {
+    throw new Error(`X25519 public key must be 32 bytes, got ${pub.length}`);
+  }
+  return crypto.createPublicKey({
+    key: Buffer.concat([X25519_SPKI_PREFIX, pub]),
+    format: "der",
+    type: "spki"
+  });
+}
+function exportRawPublicKey(pubObj) {
+  const jwk = pubObj.export({ format: "jwk" });
+  if (!jwk.x) throw new Error("X25519 public key has no JWK 'x' component");
+  return Buffer.from(jwk.x, "base64url");
+}
+function deriveMonitorIdentityFromMaster(master) {
+  if (master.length !== 32) {
+    throw new Error(`Master key must be 32 bytes, got ${master.length}`);
+  }
+  const seed = Buffer.from(crypto.hkdfSync("sha256", master, "", MONITOR_HKDF_INFO, 32));
+  const priv = privateKeyFromScalar(seed);
+  const publicKey = exportRawPublicKey(crypto.createPublicKey(priv));
+  return { publicKey, privateKey: seed };
+}
+function pubKeyHash(publicKey) {
+  return crypto.createHash("sha256").update(publicKey).digest().subarray(0, 8);
+}
+function isValidX25519Recipient(pub) {
+  if (pub.length !== 32) return false;
+  if (pub.every((b) => b === 0)) return false;
+  try {
+    const throwaway = crypto.generateKeyPairSync("x25519");
+    const shared = crypto.diffieHellman({
+      privateKey: throwaway.privateKey,
+      publicKey: publicKeyFromRaw(pub)
+    });
+    if (shared.every((b) => b === 0)) return false;
+    return true;
+  } catch {
+    return false;
+  }
+}
+async function deriveMonitorIdentity() {
+  if (_cachedIdentity) return _cachedIdentity;
+  const master = await getMasterKey();
+  if (!master) {
+    throw new Error("Master key not available \u2014 cannot derive monitor identity");
+  }
+  _cachedIdentity = deriveMonitorIdentityFromMaster(master);
+  return _cachedIdentity;
+}
+function getCachedMonitorIdentity() {
+  return _cachedIdentity;
+}
+async function getMonitorPublicKeyB64() {
+  const id = await deriveMonitorIdentity();
+  return id.publicKey.toString("base64");
+}
+function deriveEnvelopeWrapKeyForRecipient(recipientPub) {
+  const recipientKeyObj = publicKeyFromRaw(recipientPub);
+  const eph = crypto.generateKeyPairSync("x25519");
+  const shared = crypto.diffieHellman({ privateKey: eph.privateKey, publicKey: recipientKeyObj });
+  const wrapKey = Buffer.from(crypto.hkdfSync("sha256", shared, "", ENVELOPE_WRAP_INFO, 32));
+  const ephemeralPublicKey = exportRawPublicKey(eph.publicKey);
+  return { ephemeralPublicKey, wrapKey };
+}
+function recomputeEnvelopeWrapKey(privateScalar, ephemeralPub) {
+  const priv = privateKeyFromScalar(privateScalar);
+  const ephObj = publicKeyFromRaw(ephemeralPub);
+  const shared = crypto.diffieHellman({ privateKey: priv, publicKey: ephObj });
+  return Buffer.from(crypto.hkdfSync("sha256", shared, "", ENVELOPE_WRAP_INFO, 32));
+}
+function _resetMonitorIdentityCache() {
+  _cachedIdentity = null;
+}
+
+export {
+  MONITOR_HKDF_INFO,
+  ENVELOPE_WRAP_INFO,
+  privateKeyFromScalar,
+  publicKeyFromRaw,
+  exportRawPublicKey,
+  deriveMonitorIdentityFromMaster,
+  pubKeyHash,
+  isValidX25519Recipient,
+  deriveMonitorIdentity,
+  getCachedMonitorIdentity,
+  getMonitorPublicKeyB64,
+  deriveEnvelopeWrapKeyForRecipient,
+  recomputeEnvelopeWrapKey,
+  _resetMonitorIdentityCache
+};

package/dist/{chunk-2AWXDWUB.js → chunk-K5WFKEXQ.js}

@@ -1,28 +1,30 @@
 import {
   getGitRoot,
   isWorktreeDirty
-} from "./chunk-SKFA42EO.js";
+} from "./chunk-B76TSEP3.js";
 
 // src/lib/worktree-sweep.ts
-import { execFileSync } from "child_process";
+import { execFile } from "child_process";
+import { promisify } from "util";
 import { existsSync, readdirSync, readFileSync, statSync } from "fs";
 import path from "path";
+var execFileAsync = promisify(execFile);
 var GIT_TIMEOUT_MS = 1e4;
 var DIRTY_ORPHAN_MAX_AGE_MS = 7 * 24 * 60 * 60 * 1e3;
-function isWorktreeUnpushed(wtPath, branch) {
+async function isWorktreeUnpushed(wtPath, branch) {
   if (!branch) return false;
   try {
-    const remote = execFileSync("git", ["-C", wtPath, "rev-parse", "--abbrev-ref", `${branch}@{upstream}`], { encoding: "utf-8", timeout: GIT_TIMEOUT_MS, stdio: ["pipe", "pipe", "ignore"] }).trim();
+    const remote = (await execFileAsync("git", ["-C", wtPath, "rev-parse", "--abbrev-ref", `${branch}@{upstream}`], { encoding: "utf-8", timeout: GIT_TIMEOUT_MS })).stdout.trim();
     if (!remote) return true;
-    const ahead = execFileSync("git", ["-C", wtPath, "rev-list", `${remote}..${branch}`, "--count"], { encoding: "utf-8", timeout: GIT_TIMEOUT_MS, stdio: ["pipe", "pipe", "ignore"] }).trim();
+    const ahead = (await execFileAsync("git", ["-C", wtPath, "rev-list", `${remote}..${branch}`, "--count"], { encoding: "utf-8", timeout: GIT_TIMEOUT_MS })).stdout.trim();
     return parseInt(ahead, 10) > 0;
   } catch {
     try {
       let ahead = "";
       try {
-        ahead = execFileSync("git", ["-C", wtPath, "rev-list", `main..${branch}`, "--count"], { encoding: "utf-8", timeout: GIT_TIMEOUT_MS, stdio: ["pipe", "pipe", "ignore"] }).trim();
+        ahead = (await execFileAsync("git", ["-C", wtPath, "rev-list", `main..${branch}`, "--count"], { encoding: "utf-8", timeout: GIT_TIMEOUT_MS })).stdout.trim();
       } catch {
-        ahead = execFileSync("git", ["-C", wtPath, "rev-list", `master..${branch}`, "--count"], { encoding: "utf-8", timeout: GIT_TIMEOUT_MS, stdio: ["pipe", "pipe", "ignore"] }).trim();
+        ahead = (await execFileAsync("git", ["-C", wtPath, "rev-list", `master..${branch}`, "--count"], { encoding: "utf-8", timeout: GIT_TIMEOUT_MS })).stdout.trim();
       }
       return parseInt(ahead, 10) > 0;
     } catch {
@@ -83,13 +85,12 @@ function discoverRepoPaths() {
   }
   return roots;
 }
-function listWorktrees(repoRoot) {
+async function listWorktrees(repoRoot) {
   try {
-    const output = execFileSync("git", ["worktree", "list", "--porcelain"], {
+    const { stdout: output } = await execFileAsync("git", ["worktree", "list", "--porcelain"], {
       cwd: repoRoot,
       encoding: "utf8",
-      timeout: GIT_TIMEOUT_MS,
-      stdio: ["pipe", "pipe", "pipe"]
+      timeout: GIT_TIMEOUT_MS
     });
     const worktrees = [];
     let currentPath = "";
@@ -107,14 +108,13 @@ function listWorktrees(repoRoot) {
     return [];
   }
 }
-function detectMainBranch(repoRoot) {
+async function detectMainBranch(repoRoot) {
   for (const candidate of ["main", "master"]) {
     try {
-      execFileSync("git", ["rev-parse", "--verify", `refs/heads/${candidate}`], {
+      await execFileAsync("git", ["rev-parse", "--verify", `refs/heads/${candidate}`], {
         cwd: repoRoot,
         encoding: "utf8",
-        timeout: GIT_TIMEOUT_MS,
-        stdio: ["pipe", "pipe", "pipe"]
+        timeout: GIT_TIMEOUT_MS
       });
       return candidate;
     } catch {
@@ -122,26 +122,24 @@ function detectMainBranch(repoRoot) {
   }
   return null;
 }
-function isBranchMerged(repoRoot, branch, into) {
+async function isBranchMerged(repoRoot, branch, into) {
   try {
-    const merged = execFileSync("git", ["branch", "--merged", into], {
+    const { stdout: merged } = await execFileAsync("git", ["branch", "--merged", into], {
       cwd: repoRoot,
       encoding: "utf8",
-      timeout: GIT_TIMEOUT_MS,
-      stdio: ["pipe", "pipe", "pipe"]
+      timeout: GIT_TIMEOUT_MS
     });
     return merged.split("\n").map((l) => l.replace(/^[*+]?\s+/, "").trim()).includes(branch);
   } catch {
     return false;
   }
 }
-function hasLiveTmuxSession(agentName) {
+async function hasLiveTmuxSession(agentName) {
   try {
-    const sessions = execFileSync("tmux", ["list-sessions", "-F", "#S"], {
+    const sessions = (await execFileAsync("tmux", ["list-sessions", "-F", "#S"], {
       encoding: "utf8",
-      timeout: 5e3,
-      stdio: ["pipe", "pipe", "ignore"]
-    }).trim();
+      timeout: 5e3
+    })).stdout.trim();
     if (!sessions) return false;
     for (const session of sessions.split("\n")) {
       const agentPart = session.split("-")[0];
@@ -154,71 +152,65 @@ function hasLiveTmuxSession(agentName) {
     return false;
   }
 }
-function removeWorktree(repoRoot, wtPath) {
+async function removeWorktree(repoRoot, wtPath) {
   try {
-    execFileSync("git", ["worktree", "remove", wtPath, "--force"], {
+    await execFileAsync("git", ["worktree", "remove", wtPath, "--force"], {
       cwd: repoRoot,
       encoding: "utf8",
-      timeout: GIT_TIMEOUT_MS,
-      stdio: ["pipe", "pipe", "pipe"]
+      timeout: GIT_TIMEOUT_MS
     });
     return true;
   } catch {
     return false;
   }
 }
-function deleteBranch(repoRoot, branch) {
+async function deleteBranch(repoRoot, branch) {
   try {
-    execFileSync("git", ["branch", "-D", branch], {
+    await execFileAsync("git", ["branch", "-D", branch], {
       cwd: repoRoot,
       encoding: "utf8",
-      timeout: GIT_TIMEOUT_MS,
-      stdio: ["pipe", "pipe", "pipe"]
+      timeout: GIT_TIMEOUT_MS
     });
     return true;
   } catch {
     return false;
   }
 }
-function deleteRemoteBranch(repoRoot, branch) {
+async function deleteRemoteBranch(repoRoot, branch) {
   try {
-    execFileSync("git", ["push", "origin", "--delete", branch], {
+    await execFileAsync("git", ["push", "origin", "--delete", branch], {
       cwd: repoRoot,
       encoding: "utf8",
-      timeout: 15e3,
-      stdio: ["pipe", "pipe", "pipe"]
+      timeout: 15e3
     });
     return true;
   } catch {
     return false;
   }
 }
-function pruneWorktreeRegistry(repoRoot) {
+async function pruneWorktreeRegistry(repoRoot) {
   try {
-    execFileSync("git", ["worktree", "prune"], {
+    await execFileAsync("git", ["worktree", "prune"], {
       cwd: repoRoot,
       encoding: "utf8",
-      timeout: GIT_TIMEOUT_MS,
-      stdio: ["pipe", "pipe", "pipe"]
+      timeout: GIT_TIMEOUT_MS
     });
   } catch {
   }
 }
-function clearStashes(repoRoot) {
+async function clearStashes(repoRoot) {
   try {
-    const stashList = execFileSync("git", ["stash", "list"], {
+    const stashList = (await execFileAsync("git", ["stash", "list"], {
       cwd: repoRoot,
       encoding: "utf8",
-      timeout: GIT_TIMEOUT_MS,
-      stdio: ["pipe", "pipe", "pipe"]
-    }).trim();
+      timeout: GIT_TIMEOUT_MS
+    })).stdout.trim();
     if (!stashList) return 0;
     const count = stashList.split("\n").length;
-    execFileSync("git", ["stash", "clear"], {
+    await execFileAsync("git", ["stash", "clear"], {
       cwd: repoRoot,
       encoding: "utf8",
-      timeout: GIT_TIMEOUT_MS,
-      stdio: ["pipe", "pipe", "pipe"]
+      timeout: GIT_TIMEOUT_MS
     });
     return count;
   } catch {
@@ -237,21 +229,19 @@ function getDirMtimeMs(dirPath) {
     return null;
   }
 }
-function archiveDirtyWorktree(wtPath, agentName) {
+async function archiveDirtyWorktree(wtPath, agentName) {
   const timestamp = (/* @__PURE__ */ new Date()).toISOString().replace(/[:.]/g, "-").slice(0, 19);
   const quarantineBranch = `quarantine/${agentName}-${timestamp}`;
   try {
-    execFileSync("git", ["-C", wtPath, "checkout", "-b", quarantineBranch], {
+    await execFileAsync("git", ["-C", wtPath, "checkout", "-b", quarantineBranch], {
       encoding: "utf8",
-      timeout: GIT_TIMEOUT_MS,
-      stdio: ["pipe", "pipe", "pipe"]
+      timeout: GIT_TIMEOUT_MS
     });
-    execFileSync("git", ["-C", wtPath, "add", "-A"], {
+    await execFileAsync("git", ["-C", wtPath, "add", "-A"], {
       encoding: "utf8",
-      timeout: GIT_TIMEOUT_MS,
-      stdio: ["pipe", "pipe", "pipe"]
+      timeout: GIT_TIMEOUT_MS
     });
-    execFileSync("git", [
+    await execFileAsync("git", [
       "-C",
       wtPath,
       "commit",
@@ -264,7 +254,6 @@ Archived by worktree-sweep after ${DIRTY_ORPHAN_MAX_AGE_MS / 864e5}-day dirty or
     ], {
       encoding: "utf8",
       timeout: GIT_TIMEOUT_MS,
-      stdio: ["pipe", "pipe", "pipe"],
       env: {
         ...process.env,
         GIT_AUTHOR_NAME: "exe-os daemon",
@@ -296,16 +285,16 @@ async function sweepWorktrees(options = {}) {
     if (!repoRoot) continue;
     result.reposScanned++;
     const repoName = path.basename(repoRoot);
-    const mainBranch = detectMainBranch(repoRoot);
+    const mainBranch = await detectMainBranch(repoRoot);
     if (!dryRun) {
-      pruneWorktreeRegistry(repoRoot);
+      await pruneWorktreeRegistry(repoRoot);
     }
-    const worktrees = listWorktrees(repoRoot);
+    const worktrees = await listWorktrees(repoRoot);
     for (const wt of worktrees) {
       if (!wt.path.includes("/.worktrees/")) continue;
       const agentName = parseAgentName(wt.path);
       const wtName = path.basename(wt.path);
-      if (agentName && hasLiveTmuxSession(agentName)) {
+      if (agentName && await hasLiveTmuxSession(agentName)) {
         result.skipped.push({
           repo: repoName,
           worktree: wtName,
@@ -323,7 +312,7 @@ async function sweepWorktrees(options = {}) {
             `[worktree-sweep] Dirty orphan aged out (${ageD}d), archiving: ${repoName}/.worktrees/${wtName}
 `
           );
-          const archived = archiveDirtyWorktree(wt.path, agentName);
+          const archived = await archiveDirtyWorktree(wt.path, agentName);
           if (archived) {
           } else {
             result.skipped.push({
@@ -352,7 +341,7 @@ async function sweepWorktrees(options = {}) {
           continue;
         }
       }
-      if (existsSync(wt.path) && isWorktreeUnpushed(wt.path, wt.branch)) {
+      if (existsSync(wt.path) && await isWorktreeUnpushed(wt.path, wt.branch)) {
         result.skipped.push({
           repo: repoName,
           worktree: wtName,
@@ -361,7 +350,7 @@ async function sweepWorktrees(options = {}) {
         });
         continue;
       }
-      const isMerged = mainBranch ? isBranchMerged(repoRoot, wt.branch, mainBranch) : false;
+      const isMerged = mainBranch ? await isBranchMerged(repoRoot, wt.branch, mainBranch) : false;
       if (dryRun) {
         result.removed.push({ repo: repoName, worktree: wtName, branch: wt.branch });
         if (isMerged || !mainBranch) {
@@ -371,7 +360,7 @@ async function sweepWorktrees(options = {}) {
         }
         continue;
       }
-      const removed = removeWorktree(repoRoot, wt.path);
+      const removed = await removeWorktree(repoRoot, wt.path);
       if (!removed) {
         result.errors.push(`${repoName}: failed to remove worktree ${wtName}`);
         continue;
@@ -379,17 +368,17 @@ async function sweepWorktrees(options = {}) {
       result.removed.push({ repo: repoName, worktree: wtName, branch: wt.branch });
       process.stderr.write(`[worktree-sweep] Removed ${repoName}/.worktrees/${wtName} (branch: ${wt.branch})
 `);
-      const localDeleted = deleteBranch(repoRoot, wt.branch);
+      const localDeleted = await deleteBranch(repoRoot, wt.branch);
       let remoteDeleted = false;
       if (localDeleted) {
-        remoteDeleted = deleteRemoteBranch(repoRoot, wt.branch);
+        remoteDeleted = await deleteRemoteBranch(repoRoot, wt.branch);
       }
       if (localDeleted) {
         result.branchesDeleted.push({ repo: repoName, branch: wt.branch, remote: remoteDeleted });
       }
     }
     if (!dryRun) {
-      const cleared = clearStashes(repoRoot);
+      const cleared = await clearStashes(repoRoot);
       if (cleared > 0) {
         result.stashesCleared += cleared;
         process.stderr.write(`[worktree-sweep] Cleared ${cleared} stash(es) in ${repoName}
@@ -397,12 +386,12 @@ async function sweepWorktrees(options = {}) {
       }
     }
     if (!dryRun) {
-      pruneWorktreeRegistry(repoRoot);
+      await pruneWorktreeRegistry(repoRoot);
     }
   }
   return result;
 }
-function cleanupAgentWorktree(repoRoot, agentName) {
+async function cleanupAgentWorktree(repoRoot, agentName) {
   const worktreesDir = path.join(repoRoot, ".worktrees");
   if (!existsSync(worktreesDir)) return "";
   const notes = [];
@@ -413,20 +402,20 @@ function cleanupAgentWorktree(repoRoot, agentName) {
       const agentBase = agentName.replace(/\d+$/, "") || agentName;
       if (baseName !== agentBase) continue;
       const wtPath = path.join(worktreesDir, entry);
-      const branch = getWorktreeBranch(repoRoot, wtPath);
+      const branch = await getWorktreeBranch(repoRoot, wtPath);
       if (isWorktreeDirty(wtPath)) {
         notes.push(`Worktree .worktrees/${entry} has uncommitted changes \u2014 preserved`);
         continue;
       }
-      if (isWorktreeUnpushed(wtPath, branch)) {
+      if (await isWorktreeUnpushed(wtPath, branch)) {
         notes.push(`Worktree .worktrees/${entry} has unpushed commits \u2014 preserved`);
         continue;
       }
-      if (removeWorktree(repoRoot, wtPath)) {
+      if (await removeWorktree(repoRoot, wtPath)) {
         notes.push(`Removed worktree .worktrees/${entry}`);
-        if (branch && deleteBranch(repoRoot, branch)) {
+        if (branch && await deleteBranch(repoRoot, branch)) {
           notes.push(`Deleted branch ${branch}`);
-          if (deleteRemoteBranch(repoRoot, branch)) {
+          if (await deleteRemoteBranch(repoRoot, branch)) {
             notes.push(`Deleted remote branch ${branch}`);
           }
         }
@@ -434,12 +423,12 @@ function cleanupAgentWorktree(repoRoot, agentName) {
     }
   } catch {
   }
-  pruneWorktreeRegistry(repoRoot);
+  await pruneWorktreeRegistry(repoRoot);
   return notes.join("\n");
 }
-function getWorktreeBranch(repoRoot, wtPath) {
+async function getWorktreeBranch(repoRoot, wtPath) {
   try {
-    const worktrees = listWorktrees(repoRoot);
+    const worktrees = await listWorktrees(repoRoot);
     for (const wt of worktrees) {
       if (wt.path === wtPath) return wt.branch;
     }

package/dist/{chunk-BE7NKEGL.js → chunk-KCC5A7YL.js}

@@ -1,7 +1,7 @@
 import {
   formatDegradations,
   getRetrievalHealth
-} from "./chunk-F6VD2OWU.js";
+} from "./chunk-IYB2NIW3.js";
 import {
   buildRestartReport,
   formatRestartReport
@@ -16,7 +16,7 @@ import {
 } from "./chunk-OTVEIJUQ.js";
 import {
   offloadReadIfMain
-} from "./chunk-XZHA3WO2.js";
+} from "./chunk-HEPR6QTL.js";
 import {
   isMainModule
 } from "./chunk-6Y4B3QF6.js";
@@ -959,7 +959,7 @@ function formatReport(report, flags) {
   return lines.join("\n");
 }
 async function fixNullVectors() {
-  const { tryAcquireWorkerSlot, registerWorkerPid } = await import("./worker-gate-QENGURPJ.js");
+  const { tryAcquireWorkerSlot, registerWorkerPid } = await import("./worker-gate-MXUQUG4M.js");
   if (!tryAcquireWorkerSlot()) {
     process.stderr.write("[exe-doctor] Worker gate full \u2014 waiting for existing backfill workers to finish\n");
     await new Promise((r) => setTimeout(r, 5e3));
@@ -1144,7 +1144,7 @@ async function main(argv = process.argv.slice(2)) {
     console.log(formatRestartReport(restartReport));
     return emptyAuditReport();
   }
-  const { fastDbInit } = await import("./fast-db-init-YDAY7TVI.js");
+  const { fastDbInit } = await import("./fast-db-init-QQB6IVWV.js");
   const client = await fastDbInit();
   const report = await runAudit(client, flags);
   console.log(formatReport(report, flags));
@@ -1155,7 +1155,7 @@ ${mode} Applying repairs...
 `);
     if (!flags.dryRun) {
       try {
-        const { createBackup } = await import("./db-backup-CXNB2ZAG.js");
+        const { createBackup } = await import("./db-backup-DLD4QZBO.js");
         const backupPath = await createBackup("pre-fix");
         if (backupPath) {
           console.log(`  Backup created: ${backupPath.split("/").pop()}`);

package/dist/{chunk-EGCYJ4LJ.js → chunk-KMBEL7VB.js}

@@ -1,6 +1,6 @@
 import {
   getClient
-} from "./chunk-XZHA3WO2.js";
+} from "./chunk-HEPR6QTL.js";
 import {
   loadConfig
 } from "./chunk-7Y5UDEVM.js";

package/dist/{chunk-FYPSGPYS.js → chunk-KTY7I7UH.js}

@@ -1,7 +1,7 @@
 import {
   clean,
   stableId
-} from "./chunk-KK64O2G4.js";
+} from "./chunk-D3QASX2W.js";
 
 // src/lib/reflection-checkpoints.ts
 function parsePayload(payload) {

package/dist/{chunk-U5QPEYCA.js → chunk-LMZISHSJ.js}

@@ -1,24 +1,24 @@
 import {
   recordSessionKill
-} from "./chunk-MZ222PUT.js";
+} from "./chunk-T4KZ2Z2N.js";
 import {
   sessionScopeFilter,
   verifyPaneAtCapacity,
   writeNotification
-} from "./chunk-ROAUSSJI.js";
+} from "./chunk-PLRIJALF.js";
 import {
   listSessions
-} from "./chunk-QIJEW462.js";
+} from "./chunk-UIV2WPBT.js";
 import {
   getTransport
 } from "./chunk-RMOBQ6A5.js";
 import {
   recordOrchestrationEventBestEffort
-} from "./chunk-X7BGMYZS.js";
+} from "./chunk-FUIIVSW6.js";
 import {
   getClient,
   isCoordinatorName
-} from "./chunk-XZHA3WO2.js";
+} from "./chunk-HEPR6QTL.js";
 
 // src/lib/capacity-monitor.ts
 var CAPACITY_PATTERNS = [
@@ -297,12 +297,6 @@ async function pollCapacityDead() {
       continue;
     }
     try {
-      transport.kill(windowName);
-      void recordSessionKill({
-        sessionName: windowName,
-        agentId,
-        reason: "capacity"
-      });
       const client = getClient();
       const dashIdx = windowName.indexOf("-");
       const derivedScope = dashIdx >= 0 ? windowName.slice(dashIdx + 1) : null;
@@ -330,6 +324,14 @@ async function pollCapacityDead() {
         openTasks.rows,
         derivedScope
       );
+      const cacheKey = derivedScope ? `${agentId}::${derivedScope}` : agentId;
+      _lastRelaunch.set(cacheKey, Date.now());
+      transport.kill(windowName);
+      void recordSessionKill({
+        sessionName: windowName,
+        agentId,
+        reason: "capacity"
+      });
       if (created) {
         await writeNotification({
           agentId: "system",
@@ -339,8 +341,6 @@ async function pollCapacityDead() {
           summary: `${agentId} hit context capacity. Auto-relaunched with ${openTasks.rows.length} open task(s).`
         });
       }
-      const cacheKey = derivedScope ? `${agentId}::${derivedScope}` : agentId;
-      _lastRelaunch.set(cacheKey, Date.now());
       if (created) relaunched.push(agentId);
     } catch (err) {
       process.stderr.write(

package/dist/{chunk-AVOP32R7.js → chunk-LTVCRHHD.js}

@@ -1,15 +1,15 @@
 import {
   updateTask
-} from "./chunk-NCS7UNML.js";
+} from "./chunk-542EWGY3.js";
 import {
   TASK_ALREADY_CLAIMED_PREFIX
-} from "./chunk-ROAUSSJI.js";
+} from "./chunk-PLRIJALF.js";
 import {
   getAgentContext
 } from "./chunk-GJV3WDWM.js";
 import {
   isCoordinatorName
-} from "./chunk-XZHA3WO2.js";
+} from "./chunk-HEPR6QTL.js";
 
 // src/mcp/tools/update-task.ts
 import { z } from "zod";
@@ -63,7 +63,7 @@ function registerUpdateTask(server) {
       let callerAgentId;
       let callerSession;
       try {
-        const { getActiveAgent: getAgent } = await import("./active-agent-IM37G7MO.js");
+        const { getActiveAgent: getAgent } = await import("./active-agent-EC6M7KTX.js");
         callerAgentId = getAgent().agentId;
         callerSession = resolveCallerSessionForUpdate();
       } catch {

package/dist/{chunk-6F2DZQQS.js → chunk-MQRFKSLI.js}

@@ -1,15 +1,15 @@
 import {
   getActiveAgent
-} from "./chunk-YBVKLDT3.js";
+} from "./chunk-DZ6OQM67.js";
 import {
   listTasks
-} from "./chunk-ROAUSSJI.js";
+} from "./chunk-PLRIJALF.js";
 import {
   getAgentContext
 } from "./chunk-GJV3WDWM.js";
 import {
   isCoordinatorName
-} from "./chunk-XZHA3WO2.js";
+} from "./chunk-HEPR6QTL.js";
 
 // src/mcp/tools/list-tasks.ts
 import { z } from "zod";

package/dist/{chunk-BF252PDD.js → chunk-MW2GJJ53.js}

@@ -3,12 +3,12 @@ import {
   getClient,
   isInitialized,
   loadEmployees
-} from "./chunk-XZHA3WO2.js";
+} from "./chunk-HEPR6QTL.js";
 import {
   PLAN_LIMITS,
   checkLicense,
   isFeatureAllowed
-} from "./chunk-P6OW236E.js";
+} from "./chunk-XACL67CS.js";
 import {
   EXE_AI_DIR
 } from "./chunk-7Y5UDEVM.js";