@askexenow/exe-os 0.9.339 → 0.9.341

package/dist/{chunk-DEPZOCYD.js → chunk-LEJ25726.js}

@@ -1,14 +1,24 @@
-import {
-  runDriftProbes
-} from "./chunk-XJI7Z6LZ.js";
 import {
   exportOrchestration,
   importOrchestration,
   validatePackage
-} from "./chunk-QZLIZAS7.js";
+} from "./chunk-DPFQ2WQX.js";
 import {
-  StewardGate
-} from "./chunk-AOO77BDE.js";
+  runDriftProbes
+} from "./chunk-T2PYVVZ5.js";
+import {
+  registerAddBugReportComment,
+  registerGetBugReport,
+  registerGetBugReportComments,
+  registerGetFeatureRequest,
+  registerGetReview,
+  registerListBugReports,
+  registerListFeatureRequests,
+  registerListReviews,
+  registerTriageBugReport,
+  registerTriageFeatureRequest,
+  registerTriageReview
+} from "./chunk-6QW6JHRE.js";
 import {
   DEFAULT_LIST_LIMIT,
   MAX_IMPORTANCE,
@@ -17,11 +27,26 @@ import {
   ingestDocument,
   listDocumentsByWorkspace,
   updateChunksImportance
-} from "./chunk-6M36JFFD.js";
+} from "./chunk-LOBCQXV5.js";
+import {
+  analyzeBlastRadius,
+  buildCodeContextIndex,
+  buildCodeContextIndexWithEmbeddings,
+  getCodeContextStats,
+  searchCodeContext,
+  searchCodeContextSemantic,
+  traceCodeSymbol
+} from "./chunk-U2MREVXQ.js";
+import {
+  StewardGate
+} from "./chunk-YHUNDGVV.js";
+import {
+  DreamingEngine
+} from "./chunk-L2YGXJGF.js";
 import {
   isRerankerAvailable,
   rerankWithScores
-} from "./chunk-C2UO2I6K.js";
+} from "./chunk-WNKVKNOM.js";
 import {
   getEntityByName,
   getEntityNeighbors,
@@ -31,39 +56,27 @@ import {
   searchEntities
 } from "./chunk-CRCB5S7I.js";
 import {
-  analyzeBlastRadius,
-  buildCodeContextIndex,
-  buildCodeContextIndexWithEmbeddings,
-  getCodeContextStats,
-  searchCodeContext,
-  searchCodeContextSemantic,
-  traceCodeSymbol
-} from "./chunk-W7DHFGCB.js";
+  listRecentSessionEvents
+} from "./chunk-YLQXP7T7.js";
 import {
   DEFAULT_EXPLORE_DURATION_MS,
   getPlayMode,
   listExploreSessions,
   setPlayMode
 } from "./chunk-PVYR4FCQ.js";
-import {
-  DreamingEngine
-} from "./chunk-VJHUVFIW.js";
 import {
   AUTO_WAKE_MAX_RETRIES
-} from "./chunk-XCTGRD4S.js";
-import {
-  listRecentSessionEvents
-} from "./chunk-QFPTDSY2.js";
+} from "./chunk-BMHQPIJ2.js";
 import {
   getCachedLicenseGate,
   refreshLicenseGate
-} from "./chunk-DADMPMYX.js";
+} from "./chunk-NDSNM5OH.js";
 import {
   getToolUsageStats
-} from "./chunk-NQBRGXYR.js";
+} from "./chunk-MC6VPZKS.js";
 import {
   getToolCapabilityIndex
-} from "./chunk-WHRTDN5J.js";
+} from "./chunk-3NCZKWPO.js";
 import {
   isToolAllowed,
   isToolAllowedForPlan
@@ -74,55 +87,55 @@ import {
 } from "./chunk-32SXNM3G.js";
 import {
   createOrRefreshResumeTask
-} from "./chunk-LMZISHSJ.js";
+} from "./chunk-MC4ATFJV.js";
+import {
+  registerCreateTask
+} from "./chunk-GOGSWXNZ.js";
 import {
   registerListTasks
-} from "./chunk-MQRFKSLI.js";
+} from "./chunk-CYA5S5OD.js";
 import {
   registerUpdateTask
-} from "./chunk-LTVCRHHD.js";
+} from "./chunk-HUSVERE6.js";
 import {
   registerCreateReminder
-} from "./chunk-6IRVGOUL.js";
+} from "./chunk-CCPHEPLU.js";
 import {
   registerListReminders
-} from "./chunk-BU2QQWBQ.js";
+} from "./chunk-2YCFNBC4.js";
 import {
   registerCompleteReminder
-} from "./chunk-PAEXYFMY.js";
+} from "./chunk-N7A5D25S.js";
 import {
   registerDeactivateBehavior
-} from "./chunk-2SG2UGCH.js";
+} from "./chunk-ZNE6H2JO.js";
 import {
   completeReminder,
   createReminder,
   listReminders
-} from "./chunk-KMBEL7VB.js";
+} from "./chunk-PVIH3ZGV.js";
 import {
   registerImportConversations
-} from "./chunk-WYLV4S6A.js";
+} from "./chunk-TIXTHUVJ.js";
 import {
   registerSendMessage
-} from "./chunk-Q7L6G6KV.js";
-import {
-  registerCreateTask
-} from "./chunk-DILD54TU.js";
+} from "./chunk-WWNQFOSP.js";
 import {
   TOKENS_PER_IDLE_MINUTE,
   countKillsSince,
   sumTokensSavedSince
-} from "./chunk-T4KZ2Z2N.js";
+} from "./chunk-IELUDZAA.js";
 import {
   createSchedule,
   parseHumanCron
-} from "./chunk-GN45PBWI.js";
+} from "./chunk-J6SEDDOR.js";
 import {
   status
-} from "./chunk-OJTJYEMX.js";
+} from "./chunk-KP4PY2Z2.js";
 import {
   evaluateGlobalSpendCap,
   getAgentSpend
-} from "./chunk-BPC5LZ6Y.js";
+} from "./chunk-2WMTTIAZ.js";
 import {
   exportGraphHTML,
   generateGraphReport
@@ -135,14 +148,14 @@ import {
   formatReport,
   runAudit,
   shouldFixShards
-} from "./chunk-KCC5A7YL.js";
+} from "./chunk-IXBIVKWZ.js";
 import {
   formatDegradations,
   getRetrievalHealth
-} from "./chunk-IYB2NIW3.js";
+} from "./chunk-6MVI4QH2.js";
 import {
   runHealthCheck
-} from "./chunk-EIF2LQHZ.js";
+} from "./chunk-MJB5ZFQM.js";
 import {
   checkCpuStealSync
 } from "./chunk-SSC7EKY2.js";
@@ -150,7 +163,7 @@ import {
   hasFailures,
   runHealth,
   runTest
-} from "./chunk-6HBURYON.js";
+} from "./chunk-UIU2DGRV.js";
 import {
   isSupportReportSentStatus,
   markSupportReportSent
@@ -161,12 +174,12 @@ import {
 } from "./chunk-2XZ6X3PJ.js";
 import {
   renderClientCOOTemplate
-} from "./chunk-UXBD22CD.js";
+} from "./chunk-K6KRBXQP.js";
 import {
   deactivateGlobalProcedure,
   loadGlobalProcedures,
   storeGlobalProcedure
-} from "./chunk-I3XKO3KQ.js";
+} from "./chunk-6BQG7EKO.js";
 import {
   PLATFORM_PROCEDURES
 } from "./chunk-A47MXY2I.js";
@@ -175,14 +188,14 @@ import {
   cloudSync,
   getCloudReuploadRequired,
   markCloudReuploadRequired
-} from "./chunk-RDTZTLVQ.js";
+} from "./chunk-YWQMWFYR.js";
 import {
   createARecord
 } from "./chunk-X2Z5GT3V.js";
 import {
   findSimilarTrajectories,
   hashSignature
-} from "./chunk-UPWE5NOG.js";
+} from "./chunk-GPW32HVB.js";
 import {
   GHOST_BEHAVIOR_SQL,
   deactivateBehavior,
@@ -191,20 +204,20 @@ import {
   reactivateBehavior,
   storeBehavior,
   storeReflexBehavior
-} from "./chunk-TLYAEISW.js";
+} from "./chunk-OUEFW4RK.js";
 import {
   countUnconsolidated,
   groupMemories,
   runConsolidation,
   selectUnconsolidated
-} from "./chunk-R44Z32O2.js";
+} from "./chunk-WD55PEBM.js";
 import {
   entityId,
   mergeEntities
-} from "./chunk-A4DVMPYB.js";
+} from "./chunk-7UMCQQWS.js";
 import {
   embed
-} from "./chunk-3QDSCJ3F.js";
+} from "./chunk-AP455LBW.js";
 import {
   detectDcrIncompatibleConnectorsFromDisk,
   detectExternalMcpFailures,
@@ -214,17 +227,17 @@ import {
 } from "./chunk-5RACW3LX.js";
 import {
   updateTask
-} from "./chunk-542EWGY3.js";
+} from "./chunk-XSMRR4IW.js";
 import {
   fastDbInit
-} from "./chunk-UFAXZ2PY.js";
+} from "./chunk-7YORGTXC.js";
 import {
   MAX_CONCURRENT_WORKERS
-} from "./chunk-N5I7RL3I.js";
+} from "./chunk-2IWBY7XK.js";
 import {
   hybridSearch,
   recentRecords
-} from "./chunk-GQQHDEEM.js";
+} from "./chunk-FOV57K47.js";
 import {
   buildFtsMatch,
   tokenizeForFts
@@ -234,10 +247,16 @@ import {
   flushBatch,
   initStore,
   writeMemory
-} from "./chunk-H37HHX3E.js";
+} from "./chunk-EDH54E5A.js";
 import {
   getActiveAgent
-} from "./chunk-DZ6OQM67.js";
+} from "./chunk-C445WRUX.js";
+import {
+  UPSTREAM_ATTACHMENT_MAX_CHARS,
+  isTelemetryRedactionEnabled,
+  sanitizeUpstreamPayload,
+  sanitizedUpstreamBody
+} from "./chunk-RP5GETX5.js";
 import {
   getMySession,
   resolveExeSession,
@@ -246,13 +265,13 @@ import {
   sessionScopeFilter,
   updateTaskStatus,
   writeCheckpoint
-} from "./chunk-PLRIJALF.js";
+} from "./chunk-KKOLHBNC.js";
 import {
   listSessions
-} from "./chunk-UIV2WPBT.js";
+} from "./chunk-HNLXMD2V.js";
 import {
   recordOrchestrationEventBestEffort
-} from "./chunk-FUIIVSW6.js";
+} from "./chunk-WH7XN5ER.js";
 import {
   DEFAULT_MODELS,
   KNOWN_RUNTIMES,
@@ -260,7 +279,7 @@ import {
   getAgentRuntime,
   loadAgentConfig,
   setAgentRuntime
-} from "./chunk-65SVQELL.js";
+} from "./chunk-GFDGDFBF.js";
 import {
   DEFAULT_RUNTIME
 } from "./chunk-NGP6LSV2.js";
@@ -269,7 +288,7 @@ import {
   assertEmployeeLimit,
   assertFeature,
   assertMemoryLimit
-} from "./chunk-MW2GJJ53.js";
+} from "./chunk-2UGGBIDL.js";
 import {
   getProjectName
 } from "./chunk-OPU3NYOO.js";
@@ -288,7 +307,7 @@ import {
   isScheduledTrigger,
   loadTriggers,
   sanitizeParam
-} from "./chunk-KTPG4XKI.js";
+} from "./chunk-IB336P52.js";
 import {
   pushConversationToCRM
 } from "./chunk-ML4S5SHZ.js";
@@ -309,7 +328,7 @@ import {
   loadEmployeesSync,
   saveEmployees,
   updateIdentity
-} from "./chunk-HEPR6QTL.js";
+} from "./chunk-RWSLVYTE.js";
 import {
   getEventLoopLagMs,
   isDaemonAlive,
@@ -331,16 +350,16 @@ import {
   refreshLicense,
   saveLicense,
   validateLicense
-} from "./chunk-XACL67CS.js";
+} from "./chunk-7SEC2AG5.js";
 import {
   EXE_AI_DIR,
   loadConfig
 } from "./chunk-7Y5UDEVM.js";
 
 // src/mcp/register-tools.ts
-import { readFileSync as readFileSync8 } from "fs";
-import { join as join5 } from "path";
-import { homedir as homedir5 } from "os";
+import { readFileSync as readFileSync7 } from "fs";
+import { join as join4 } from "path";
+import { homedir as homedir4 } from "os";
 
 // src/mcp/tools/memory.ts
 import { z as z12 } from "zod";
@@ -515,7 +534,7 @@ function registerRecallMyMemory(server) {
     }) => {
       try {
         if (!isInitialized()) {
-          const { fastDbInit: fastDbInit2 } = await import("./fast-db-init-QQB6IVWV.js");
+          const { fastDbInit: fastDbInit2 } = await import("./fast-db-init-JKJEEHUI.js");
           await fastDbInit2();
         }
         if (!recent && !query) {
@@ -562,7 +581,7 @@ function registerRecallMyMemory(server) {
         let federatedCount = 0;
         if (!recent && query && results.length < FEDERATION_THRESHOLD) {
           try {
-            const { searchCodeContextSemantic: searchCodeContextSemantic2 } = await import("./code-context-index-EXXDY3QZ.js");
+            const { searchCodeContextSemantic: searchCodeContextSemantic2 } = await import("./code-context-index-BNBHDXHW.js");
             const codeResults = await Promise.race([
               searchCodeContextSemantic2(query, { limit: 5 }),
               new Promise((_, rej) => setTimeout(() => rej(new Error("timeout")), 2e3))
@@ -800,7 +819,7 @@ function registerStoreMemory(server) {
       }
       const { agentId, agentRole } = getActiveAgent();
       if (kind === "prospective") {
-        const { createProspectiveMemory } = await import("./prospective-memory-W6S67LZZ.js");
+        const { createProspectiveMemory } = await import("./prospective-memory-UACFTYXK.js");
         let sessionScope = null;
         try {
           const { resolveExeSession: resolveExeSession2 } = await import("./lib/tmux-routing.js");
@@ -1786,7 +1805,7 @@ async function handleSupersede(input) {
   }
   try {
     const { getClient: getClient2 } = await import("./lib/database.js");
-    const { getActiveAgent: getActiveAgent2 } = await import("./active-agent-EC6M7KTX.js");
+    const { getActiveAgent: getActiveAgent2 } = await import("./active-agent-AIQP4DFL.js");
     const { writeMemory: writeMemory2, flushBatch: flushBatch2 } = await import("./lib/store.js");
     const { randomUUID: randomUUID2 } = await import("crypto");
     const client = getClient2();
@@ -1839,7 +1858,7 @@ New memory id: ${newId}`
 }
 async function handleResonanceQuery(input) {
   try {
-    const { getHotPairs, getCoActivationNeighbors } = await import("./co-activation-XMPHKGHR.js");
+    const { getHotPairs, getCoActivationNeighbors } = await import("./co-activation-QI5BK4RT.js");
     const subAction = input.resonance_action ?? "hot_pairs";
     const limit = input.limit ?? 20;
     if (subAction === "hot_pairs") {
@@ -1934,7 +1953,7 @@ function registerMemory(server) {
         return handleResonanceQuery(input);
       }
       if (action === "update_working_memory" || action === "get_working_memory") {
-        const { getActiveAgent: getActiveAgent2 } = await import("./active-agent-EC6M7KTX.js");
+        const { getActiveAgent: getActiveAgent2 } = await import("./active-agent-AIQP4DFL.js");
         const { agentId } = getActiveAgent2();
         const { readWorkingMemoryWithMeta, writeWorkingMemory, WORKING_MEMORY_MAX_BYTES } = await import("./working-memory-PY4AG577.js");
         if (action === "get_working_memory") {
@@ -1960,9 +1979,9 @@ function registerMemory(server) {
         }
       }
       if (action === "core_get" || action === "core_set" || action === "core_delete") {
-        const { getActiveAgent: getActiveAgent2 } = await import("./active-agent-EC6M7KTX.js");
+        const { getActiveAgent: getActiveAgent2 } = await import("./active-agent-AIQP4DFL.js");
         const { agentId } = getActiveAgent2();
-        const { getCoreMemory, setCoreMemory, deleteCoreMemory, formatCoreMemoryBlock } = await import("./core-memory-VO5ZIBKH.js");
+        const { getCoreMemory, setCoreMemory, deleteCoreMemory, formatCoreMemoryBlock } = await import("./core-memory-3IBWM4WR.js");
         if (action === "core_get") {
           const entries = await getCoreMemory(agentId);
           const block = formatCoreMemoryBlock(entries);
@@ -2014,12 +2033,12 @@ function registerMemory(server) {
           if (!storeTrigger || !storeTriggerAction) {
             return errorResult('memory action "store" with kind="reflex" requires trigger and trigger_action fields');
           }
-          const { formatReflexContent, storeReflexBehavior: storeReflexBehavior2 } = await import("./behaviors-HLZUJSMP.js");
+          const { formatReflexContent, storeReflexBehavior: storeReflexBehavior2 } = await import("./behaviors-EO7KCP3H.js");
           const reflexText = formatReflexContent(storeTrigger, storeTriggerAction);
           legacyArgs.text ??= reflexText;
           legacyArgs.query ??= reflexText;
           try {
-            const { getActiveAgent: getActiveAgent2 } = await import("./active-agent-EC6M7KTX.js");
+            const { getActiveAgent: getActiveAgent2 } = await import("./active-agent-AIQP4DFL.js");
             const { getProjectName: getProjectName2 } = await import("./project-name-EWG5KAZP.js");
             const agent = getActiveAgent2();
             const behaviorId = await storeReflexBehavior2({
@@ -2375,7 +2394,7 @@ function registerCloseTask(server) {
     async ({ task_id, result: result3, status: status2 }) => {
       const agent = getActiveAgent();
       try {
-        const { StewardGate: StewardGate2 } = await import("./steward-gate-WT7WXQIE.js");
+        const { StewardGate: StewardGate2 } = await import("./steward-gate-4A2XHYFD.js");
         const steward = new StewardGate2();
         const gateDecision = await steward.checkAuthority(agent.agentId || "unknown", "close_task", task_id);
         if (!gateDecision.allowed) {
@@ -2556,8 +2575,8 @@ ${preflightWarnings.join("\n")}`;
       if (mergeNote) text5 += mergeNote;
       if (status2 === "closed" && assignee) {
         try {
-          const { cleanupAgentWorktree } = await import("./worktree-sweep-ZAG3V24E.js");
-          const { getGitRoot } = await import("./worktree-GVF2I5FP.js");
+          const { cleanupAgentWorktree } = await import("./worktree-sweep-5WKBU7E6.js");
+          const { getGitRoot } = await import("./worktree-YXBDRYOC.js");
           const repoRoot = getGitRoot(baseDir);
           if (repoRoot) {
             const cleanupNotes = await cleanupAgentWorktree(repoRoot, assignee);
@@ -2606,8 +2625,8 @@ ${preflightWarnings.join("\n")}`;
                       } catch {
                       }
                       try {
-                        const { cleanupAgentWorktree } = await import("./worktree-sweep-ZAG3V24E.js");
-                        const { getGitRoot } = await import("./worktree-GVF2I5FP.js");
+                        const { cleanupAgentWorktree } = await import("./worktree-sweep-5WKBU7E6.js");
+                        const { getGitRoot } = await import("./worktree-YXBDRYOC.js");
                         const root = getGitRoot(_baseDir);
                         if (root) {
                           const notes = await cleanupAgentWorktree(root, _assignee);
@@ -2710,7 +2729,7 @@ function registerResumeEmployee(server) {
     },
     async ({ agent_id, project_name }) => {
       if (!isInitialized()) {
-        const { fastDbInit: fastDbInit2 } = await import("./fast-db-init-QQB6IVWV.js");
+        const { fastDbInit: fastDbInit2 } = await import("./fast-db-init-JKJEEHUI.js");
         await fastDbInit2();
       }
       const client = getClient();
@@ -2736,7 +2755,7 @@ function registerResumeEmployee(server) {
         };
       }
       try {
-        const { isTmuxSessionAlive } = await import("./tasks-crud-UGK5A25L.js");
+        const { isTmuxSessionAlive } = await import("./tasks-crud-6LBNU43G.js");
         const now = (/* @__PURE__ */ new Date()).toISOString();
         for (const row of openTasks.rows) {
           const status2 = String(row.status);
@@ -2764,7 +2783,7 @@ function registerResumeEmployee(server) {
       }
       let checkpointInfo = "";
       try {
-        const { readLatestCheckpoint } = await import("./tasks-crud-UGK5A25L.js");
+        const { readLatestCheckpoint } = await import("./tasks-crud-6LBNU43G.js");
         const checkpoint = await readLatestCheckpoint(agent_id);
         if (checkpoint) {
           const filesTouched = checkpoint.files_touched?.length > 0 ? checkpoint.files_touched.join(", ") : "none";
@@ -3180,7 +3199,7 @@ function registerTask(server) {
         const missing2 = missingRequiredFields2(args, REQUIRED_FIELDS2.create_group);
         if (missing2.length > 0) return errorResult2(`task action "create_group" missing required field(s): ${missing2.join(", ")}`);
         try {
-          const { createTaskGroup } = await import("./tasks-crud-UGK5A25L.js");
+          const { createTaskGroup } = await import("./tasks-crud-6LBNU43G.js");
           const group = await createTaskGroup({
             title: args.title,
             coordinator: args.coordinator,
@@ -3199,7 +3218,7 @@ function registerTask(server) {
         const missing2 = missingRequiredFields2(args, REQUIRED_FIELDS2.group_status);
         if (missing2.length > 0) return errorResult2(`task action "group_status" missing required field(s): ${missing2.join(", ")}`);
         try {
-          const { getGroupStatus } = await import("./tasks-crud-UGK5A25L.js");
+          const { getGroupStatus } = await import("./tasks-crud-6LBNU43G.js");
           const status2 = await getGroupStatus(args.group_id);
           return { content: [{ type: "text", text: JSON.stringify(status2, null, 2) }] };
         } catch (err) {
@@ -3211,7 +3230,7 @@ function registerTask(server) {
         const missing2 = missingRequiredFields2(args, REQUIRED_FIELDS2.group_results);
         if (missing2.length > 0) return errorResult2(`task action "group_results" missing required field(s): ${missing2.join(", ")}`);
         try {
-          const { getGroupResults } = await import("./tasks-crud-UGK5A25L.js");
+          const { getGroupResults } = await import("./tasks-crud-6LBNU43G.js");
           const results = await getGroupResults(args.group_id);
           return { content: [{ type: "text", text: JSON.stringify(results, null, 2) }] };
         } catch (err) {
@@ -3462,7 +3481,7 @@ function registerMessage(server) {
       if (msgType && msgPayload) {
         try {
           const { buildTypedMessage, serializeMessage } = await import("./typed-messages-TKDGVPHS.js");
-          const { getActiveAgent: getActiveAgent2 } = await import("./active-agent-EC6M7KTX.js");
+          const { getActiveAgent: getActiveAgent2 } = await import("./active-agent-AIQP4DFL.js");
           const { sendMessage } = await import("./lib/messaging.js");
           const { agentId } = getActiveAgent2();
           const envelope = buildTypedMessage({
@@ -3496,7 +3515,7 @@ ID: ${msg.id}`
     if (action === "read") {
       try {
         const { getPendingMessages } = await import("./lib/messaging.js");
-        const { getActiveAgent: getActiveAgent2 } = await import("./active-agent-EC6M7KTX.js");
+        const { getActiveAgent: getActiveAgent2 } = await import("./active-agent-AIQP4DFL.js");
         const { agentId } = getActiveAgent2();
         const messages = await getPendingMessages(agentId);
         if (messages.length === 0) {
@@ -3859,8 +3878,8 @@ function registerIngestDocument(server) {
     },
     async (input) => {
       try {
-        const { assertFeature: assertFeature2 } = await import("./plan-limits-GRNBOBB3.js");
-        const { assertMemoryLimit: assertMemoryLimit2 } = await import("./plan-limits-GRNBOBB3.js");
+        const { assertFeature: assertFeature2 } = await import("./plan-limits-WLQZTCSF.js");
+        const { assertMemoryLimit: assertMemoryLimit2 } = await import("./plan-limits-WLQZTCSF.js");
         await assertFeature2("wiki");
         await assertMemoryLimit2();
         const result3 = await ingestDocument(input);
@@ -3931,8 +3950,8 @@ function registerPurgeDocument(server) {
     },
     async ({ document_id }) => {
       try {
-        const { StewardGate: StewardGate2 } = await import("./steward-gate-WT7WXQIE.js");
-        const { getActiveAgent: getActiveAgent2 } = await import("./active-agent-EC6M7KTX.js");
+        const { StewardGate: StewardGate2 } = await import("./steward-gate-4A2XHYFD.js");
+        const { getActiveAgent: getActiveAgent2 } = await import("./active-agent-AIQP4DFL.js");
         const steward = new StewardGate2();
         const agent = getActiveAgent2();
         const gateDecision = await steward.checkAuthority(agent.agentId || "unknown", "purge_document", document_id);
@@ -4102,7 +4121,7 @@ function registerDocument(server) {
       const { action: _action, ...legacyArgs } = input;
       if (action === "list" && (legacyArgs.workspace_id === void 0 || legacyArgs.workspace_id === null || legacyArgs.workspace_id === "")) {
         try {
-          const { resolveDefaultWorkspaceId, listWorkspaces } = await import("./documents-FHIBU7KJ.js");
+          const { resolveDefaultWorkspaceId, listWorkspaces } = await import("./documents-FA6N7QDA.js");
           const defaultId = await resolveDefaultWorkspaceId();
           if (defaultId) {
             legacyArgs.workspace_id = defaultId;
@@ -4772,12 +4791,12 @@ async function validateGoTrueToken(token, gotrueUrl) {
 }
 async function getGoTrueUser(userId, gotrueUrl) {
   const url = gotrueUrl ?? process.env.GOTRUE_URL ?? process.env.EXE_GOTRUE_URL;
-  const adminToken2 = process.env.GOTRUE_ADMIN_TOKEN ?? process.env.EXE_GOTRUE_ADMIN_TOKEN;
-  if (!url || !adminToken2) return null;
+  const adminToken = process.env.GOTRUE_ADMIN_TOKEN ?? process.env.EXE_GOTRUE_ADMIN_TOKEN;
+  if (!url || !adminToken) return null;
   try {
     const res = await fetch(`${url}/admin/users/${userId}`, {
       headers: {
-        Authorization: `Bearer ${adminToken2}`,
+        Authorization: `Bearer ${adminToken}`,
         "Content-Type": "application/json"
       },
       signal: AbortSignal.timeout(GOTRUE_TIMEOUT_MS)
@@ -5102,7 +5121,7 @@ async function handleStatus() {
     detail: wikiUrl ? `API at ${wikiUrl}` : "EXE_WIKI_API_URL not set"
   };
   try {
-    await import("./graph-rag-JZZAB7PC.js");
+    await import("./graph-rag-WAK2BRJH.js");
     sinks.entity_extraction = { configured: true, detail: "GraphRAG available" };
   } catch {
     sinks.entity_extraction = { configured: false, detail: "graph-rag module unavailable" };
@@ -5129,7 +5148,7 @@ async function handleTrigger(limit) {
     if (rows.rows.length === 0) {
       return text3("No conversations found to re-process.");
     }
-    const { ingest } = await import("./pipeline-router-O6HU7DKH.js");
+    const { ingest } = await import("./pipeline-router-RTLAGZTA.js");
     const results = [];
     for (const row of rows.rows) {
       const r = row;
@@ -5760,8 +5779,8 @@ function registerMergeEntities(server) {
     },
     async ({ source_name, source_type, target_name, target_type }) => {
       try {
-        const { StewardGate: StewardGate2 } = await import("./steward-gate-WT7WXQIE.js");
-        const { getActiveAgent: getActiveAgent2 } = await import("./active-agent-EC6M7KTX.js");
+        const { StewardGate: StewardGate2 } = await import("./steward-gate-4A2XHYFD.js");
+        const { getActiveAgent: getActiveAgent2 } = await import("./active-agent-AIQP4DFL.js");
         const steward = new StewardGate2();
         const agent = getActiveAgent2();
         const gateDecision = await steward.checkAuthority(agent.agentId || "unknown", "merge_entities", `${source_name}\u2192${target_name}`);
@@ -5969,7 +5988,7 @@ async function handleExtractFromDocument(args) {
     return errorResult7('graph action "extract_from_document" requires document_id');
   }
   try {
-    const { extractGraphFromExistingDocument } = await import("./doc-graph-extractor-3TRLGD7M.js");
+    const { extractGraphFromExistingDocument } = await import("./doc-graph-extractor-LR5KMPH7.js");
     const result3 = await extractGraphFromExistingDocument(documentId);
     const lines = [
       `## Graph Extraction for Document ${documentId}`,
@@ -5996,7 +6015,7 @@ async function handleCleanupGarbage(args) {
   const doMerge = !garbageOnly;
   let mod;
   try {
-    mod = await import("./cleanup-graph-garbage-KUABW6LS.js");
+    mod = await import("./cleanup-graph-garbage-MXQ4Q2MA.js");
   } catch (err) {
     return errorResult7(`cleanup_garbage: failed to load cleanup module \u2014 ${err instanceof Error ? err.message : String(err)}`);
   }
@@ -6641,8 +6660,8 @@ ${extHealth.remediation}`);
         } catch {
         }
         try {
-          const { homedir: homedir6 } = await import("os");
-          const dcrConnectors = detectDcrIncompatibleConnectorsFromDisk(homedir6());
+          const { homedir: homedir5 } = await import("os");
+          const dcrConnectors = detectDcrIncompatibleConnectorsFromDisk(homedir5());
           if (dcrConnectors.length > 0) {
             lines.push("\n### Google MCP connectors (auth-incompatible)");
             lines.push("| Connector | Endpoint |");
@@ -6876,7 +6895,7 @@ async function getAgentSessionLoad() {
       return { sessions: [], totalLive: 0, busySessions: 0, idleSessions: 0 };
     }
     const { getClient: getClient2 } = await import("./lib/database.js");
-    const { sessionScopeFilter: sessionScopeFilter2 } = await import("./task-scope-CQEG5SSJ.js");
+    const { sessionScopeFilter: sessionScopeFilter2 } = await import("./task-scope-EKYDCVUF.js");
     const client = getClient2();
     const scope = sessionScopeFilter2();
     for (const s of liveAgentSessions) {
@@ -7003,7 +7022,7 @@ ${mode} Applying repairs...
 `];
           if (!isDryRun) {
             try {
-              const { createBackup: createBackup2 } = await import("./db-backup-DLD4QZBO.js");
+              const { createBackup: createBackup2 } = await import("./db-backup-MX2G3CEK.js");
               const backupPath = await createBackup2("pre-fix");
               if (backupPath) {
                 fixLog.push(`  Backup created: ${backupPath.split("/").pop()}`);
@@ -7242,7 +7261,7 @@ async function cloudStatusText() {
   if (lastReuploadedAt) lines.push(`- Last re-upload: ${lastReuploadedAt}`);
   lines.push("");
   try {
-    const { getRetrievalHealth: getRetrievalHealth2, formatDegradations: formatDegradations2 } = await import("./retrieval-health-TWHKYCRK.js");
+    const { getRetrievalHealth: getRetrievalHealth2, formatDegradations: formatDegradations2 } = await import("./retrieval-health-4C2PO6HH.js");
     const h = await getRetrievalHealth2();
     lines.push(formatDegradations2(h.degradations, "Health / Degradations"));
     lines.push("");
@@ -8611,11 +8630,11 @@ async function sendSetPlan(payload) {
   }
   const config = await loadConfig();
   const routerUrl = process.env.API_ROUTER_URL?.replace(/\/+$/, "");
-  const endpoint2 = process.env.EXE_SET_CUSTOMER_PLAN_ENDPOINT || (routerUrl ? `${routerUrl}/admin/customer/plan` : "https://api.askexe.com/admin/customer/plan");
+  const endpoint = process.env.EXE_SET_CUSTOMER_PLAN_ENDPOINT || (routerUrl ? `${routerUrl}/admin/customer/plan` : "https://api.askexe.com/admin/customer/plan");
   const licenseKey = loadLicense() || process.env.EXE_LICENSE_KEY || config.cloud?.apiKey;
   const licenseToken = readCachedLicenseToken();
   try {
-    const parsed = new URL(endpoint2);
+    const parsed = new URL(endpoint);
     if (parsed.protocol !== "https:" && !["localhost", "127.0.0.1", "::1"].includes(parsed.hostname)) {
       return { status: "failed: insecure endpoint rejected" };
     }
@@ -8737,7 +8756,7 @@ function registerCreateTrigger(server) {
       }
     },
     async ({ name, event, conditions, actions, project, enabled, schedule, query }) => {
-      const { assertFeature: assertFeature2 } = await import("./plan-limits-GRNBOBB3.js");
+      const { assertFeature: assertFeature2 } = await import("./plan-limits-WLQZTCSF.js");
       const gatedActions = {
         send_whatsapp: "external_agents",
         update_wiki: "wiki"
@@ -9707,8 +9726,8 @@ function buildHandlers5() {
 }
 async function handleDreaming(action, args) {
   try {
-    const { DreamingEngine: DreamingEngine2 } = await import("./dreaming-OMFUEUCQ.js");
-    const { getActiveAgent: getActiveAgent2 } = await import("./active-agent-EC6M7KTX.js");
+    const { DreamingEngine: DreamingEngine2 } = await import("./dreaming-UKGTQT6I.js");
+    const { getActiveAgent: getActiveAgent2 } = await import("./active-agent-AIQP4DFL.js");
     const { getClient: getClient2 } = await import("./lib/database.js");
     const agentId = args.agent_id ?? getActiveAgent2().agentId;
     if (action === "dreaming_run") {
@@ -9866,8 +9885,8 @@ function registerConfig(server) {
     }
     if (action === "closeout") {
       try {
-        const { DreamingEngine: DreamingEngine2 } = await import("./dreaming-OMFUEUCQ.js");
-        const { getActiveAgent: getActiveAgent2 } = await import("./active-agent-EC6M7KTX.js");
+        const { DreamingEngine: DreamingEngine2 } = await import("./dreaming-UKGTQT6I.js");
+        const { getActiveAgent: getActiveAgent2 } = await import("./active-agent-AIQP4DFL.js");
         const { writeMemory: writeMemory2, flushBatch: flushBatch2 } = await import("./lib/store.js");
         const { randomUUID: randomUUID2 } = await import("crypto");
         const { getProjectName: getProjectName2 } = await import("./project-name-EWG5KAZP.js");
@@ -9938,7 +9957,7 @@ function registerConfig(server) {
     }
     if (action === "capability_cards") {
       try {
-        const { getAllCapabilityCards, findAgentForTask } = await import("./capability-cards-YOKVMMOL.js");
+        const { getAllCapabilityCards, findAgentForTask } = await import("./capability-cards-OBYQNAKZ.js");
         const cards = getAllCapabilityCards();
         const taskQuery = args.query;
         if (taskQuery) {
@@ -9989,7 +10008,7 @@ function registerConfig(server) {
         const existing = loadEmployeesSync2();
         if (existing.some((e) => e.name === employeeName)) return errorResult8(`Employee "${employeeName}" already exists.`);
         try {
-          const { assertEmployeeLimit: assertEmployeeLimit2 } = await import("./plan-limits-GRNBOBB3.js");
+          const { assertEmployeeLimit: assertEmployeeLimit2 } = await import("./plan-limits-WLQZTCSF.js");
           await assertEmployeeLimit2();
         } catch (e) {
           return errorResult8(e instanceof Error ? e.message : "Employee limit reached.");
@@ -10030,7 +10049,7 @@ You are ${employeeName}. Role: ${role}.`, "utf-8");
         }
         try {
           const { generateSessionWrappers } = await import("./lib/session-wrappers.js");
-          const { resolvePackageRoot } = await import("./installer-MNPXDLGG.js");
+          const { resolvePackageRoot } = await import("./installer-T2LGHZKL.js");
           generateSessionWrappers(resolvePackageRoot());
         } catch {
         }
@@ -10117,7 +10136,7 @@ function registerListWikiPages(server) {
       }
     },
     async ({ workspace, folder }) => {
-      const { assertFeature: assertFeature2 } = await import("./plan-limits-GRNBOBB3.js");
+      const { assertFeature: assertFeature2 } = await import("./plan-limits-WLQZTCSF.js");
       await assertFeature2("wiki");
       const apiUrl = process.env.EXE_WIKI_API_URL;
       const apiKey = process.env.EXE_WIKI_API_KEY;
@@ -10217,7 +10236,7 @@ function registerGetWikiPage(server) {
       }
     },
     async ({ workspace, document_id, title }) => {
-      const { assertFeature: assertFeature2 } = await import("./plan-limits-GRNBOBB3.js");
+      const { assertFeature: assertFeature2 } = await import("./plan-limits-WLQZTCSF.js");
       await assertFeature2("wiki");
       const apiUrl = process.env.EXE_WIKI_API_URL;
       const apiKey = process.env.EXE_WIKI_API_KEY;
@@ -10411,10 +10430,10 @@ async function handleWikiSearch(input) {
   const userId = input.user_id;
   if (!workspace) return errorResult9('wiki action "search" requires workspace');
   if (!query) return errorResult9('wiki action "search" requires query');
-  const { assertFeature: assertFeature2 } = await import("./plan-limits-GRNBOBB3.js");
+  const { assertFeature: assertFeature2 } = await import("./plan-limits-WLQZTCSF.js");
   await assertFeature2("wiki");
   if (userId) {
-    const { checkWikiAccess } = await import("./wiki-acl-JA5UCQZ4.js");
+    const { checkWikiAccess } = await import("./wiki-acl-7CROE3MJ.js");
     const { allowed } = await checkWikiAccess(String(userId), String(workspace), "read");
     if (!allowed) {
       return errorResult9(`Access denied: user "${userId}" does not have read access to workspace "${workspace}"`);
@@ -10517,7 +10536,7 @@ function registerWiki(server) {
         return errorResult9('wiki action "document_rerank" requires at least one candidate');
       }
       if (user_id && legacyArgs.workspace) {
-        const { checkWikiAccess } = await import("./wiki-acl-JA5UCQZ4.js");
+        const { checkWikiAccess } = await import("./wiki-acl-7CROE3MJ.js");
         const { allowed } = await checkWikiAccess(
           String(user_id),
           String(legacyArgs.workspace),
@@ -10838,7 +10857,7 @@ Use /exe-forget to remove any that this supersedes.`;
                 }]
               };
             }
-            const { bulkPurgeGhostBehaviors } = await import("./behaviors-HLZUJSMP.js");
+            const { bulkPurgeGhostBehaviors } = await import("./behaviors-EO7KCP3H.js");
             const res = await bulkPurgeGhostBehaviors({ batchSize: 5e3, vacuum: true });
             return {
               content: [{
@@ -10949,7 +10968,7 @@ Use /exe-forget to remove any that this supersedes.`;
           return { content: [{ type: "text", text: `Behavior not found: ${behavior_id}` }], isError: true };
         }
         const row2 = result4.rows[0];
-        const { reactivateBehavior: reactivateBehavior2 } = await import("./behaviors-HLZUJSMP.js");
+        const { reactivateBehavior: reactivateBehavior2 } = await import("./behaviors-EO7KCP3H.js");
         const wasReactivated = await reactivateBehavior2(behavior_id);
         if (!wasReactivated) {
           return { content: [{ type: "text", text: `Behavior ${behavior_id} is already active.` }] };
@@ -11470,7 +11489,7 @@ function registerWorkflowTool(server) {
         getWorkflowInstance,
         listWorkflowInstances,
         approveWorkflowStep
-      } = await import("./workflow-engine-EWCOLD47.js");
+      } = await import("./workflow-engine-MMEHKUN4.js");
       try {
         switch (input.action) {
           case "create_workflow": {
@@ -11650,7 +11669,12 @@ function buildMarkdown(input) {
 function prepareUpstreamPayload(payload) {
   const cleaned = { ...payload };
   delete cleaned.agent_role;
-  return { body: JSON.stringify(cleaned), contentType: "application/json", encrypted: false };
+  if (!isTelemetryRedactionEnabled()) {
+    console.error("[bug-report] WARNING: EXE_TELEMETRY_REDACT=off \u2014 sending UNREDACTED payload upstream");
+    return { body: JSON.stringify(cleaned), contentType: "application/json", encrypted: false, redactedCount: 0, truncatedCount: 0 };
+  }
+  const { payload: sanitized, redactedCount, truncatedCount } = sanitizeUpstreamPayload(cleaned);
+  return { body: JSON.stringify(sanitized), contentType: "application/json", encrypted: false, redactedCount, truncatedCount };
 }
 async function maybeSendUpstream(payload) {
   if (process.env.VITEST || process.env.NODE_ENV === "test") {
@@ -11658,19 +11682,19 @@ async function maybeSendUpstream(payload) {
   }
   const config = await loadConfig();
   const routerUrl = process.env.API_ROUTER_URL?.replace(/\/+$/, "");
-  const endpoint2 = config.support?.bugReportEndpoint || process.env.EXE_BUG_REPORT_ENDPOINT || (routerUrl ? `${routerUrl}/v1/support/bug-reports` : "https://api.askexe.com/v1/support/bug-reports");
+  const endpoint = config.support?.bugReportEndpoint || process.env.EXE_BUG_REPORT_ENDPOINT || (routerUrl ? `${routerUrl}/v1/support/bug-reports` : "https://api.askexe.com/v1/support/bug-reports");
   const token = config.support?.bugReportToken || process.env.EXE_BUG_REPORT_TOKEN;
   const licenseKey = loadLicense() || process.env.EXE_LICENSE_KEY || config.cloud?.apiKey;
   const licenseToken = readCachedLicenseToken();
-  if (!endpoint2) {
+  if (!endpoint) {
     return "not_configured";
   }
   try {
-    const parsed = new URL(endpoint2);
+    const parsed = new URL(endpoint);
     if (parsed.protocol !== "https:" && !["localhost", "127.0.0.1", "::1"].includes(parsed.hostname)) {
       return "failed: insecure endpoint rejected";
     }
-    const { body, contentType, encrypted } = prepareUpstreamPayload(payload);
+    const { body, contentType, encrypted, redactedCount, truncatedCount } = prepareUpstreamPayload(payload);
     const response = await fetch(parsed, {
       method: "POST",
       headers: {
@@ -11685,7 +11709,11 @@ async function maybeSendUpstream(payload) {
       signal: AbortSignal.timeout(1e4)
     });
     if (!response.ok) return `failed: HTTP ${response.status}`;
-    return encrypted ? "sent (encrypted)" : "sent (redacted)";
+    if (encrypted) return "sent (encrypted)";
+    const parts = ["sanitized"];
+    if (redactedCount > 0) parts.push(`${redactedCount} secret${redactedCount === 1 ? "" : "s"} redacted`);
+    if (truncatedCount > 0) parts.push(`${truncatedCount} field${truncatedCount === 1 ? "" : "s"} truncated`);
+    return `sent (${parts.join(", ")})`;
   } catch (err) {
     return `failed: ${err instanceof Error ? err.message : String(err)}`;
   }
@@ -11757,7 +11785,7 @@ function registerCreateBugReport(server) {
       const version = package_version ?? "unknown";
       let metricsSnapshot = "";
       try {
-        const { getOrchestrationMetrics, formatOrchestrationMetrics } = await import("./orchestration-events-5SIJOE4H.js");
+        const { getOrchestrationMetrics, formatOrchestrationMetrics } = await import("./orchestration-events-ZG7O4HRY.js");
         const sinceIso = new Date(Date.now() - 60 * 60 * 1e3).toISOString();
         const metrics = await getOrchestrationMetrics({ sinceIso });
         if (metrics.totalEvents > 0) {
@@ -11843,11 +11871,9 @@ ${formatOrchestrationMetrics(metrics)}
         file_paths: files_changed ? JSON.stringify(files_changed) : null
       });
       await flushBatch();
-      const UPSTREAM_ATTACHMENT_MAX_CHARS = 4096;
       const upstreamAttachments = attachments?.map((att) => ({
         filename: att.filename,
-        content: att.content.length > UPSTREAM_ATTACHMENT_MAX_CHARS ? att.content.slice(0, UPSTREAM_ATTACHMENT_MAX_CHARS) + `
-... [truncated, ${att.content.length} chars total]` : att.content,
+        content: att.content,
         truncated: att.content.length > UPSTREAM_ATTACHMENT_MAX_CHARS,
         original_size: att.content.length
       }));
@@ -11945,18 +11971,30 @@ async function maybeSendUpstream2(payload) {
   }
   const config = await loadConfig();
   const routerUrl = process.env.API_ROUTER_URL?.replace(/\/+$/, "");
-  const endpoint2 = config.support?.featureRequestEndpoint || process.env.EXE_FEATURE_REQUEST_ENDPOINT || (routerUrl ? `${routerUrl}/v1/support/feature-requests` : "https://api.askexe.com/v1/support/feature-requests");
+  const endpoint = config.support?.featureRequestEndpoint || process.env.EXE_FEATURE_REQUEST_ENDPOINT || (routerUrl ? `${routerUrl}/v1/support/feature-requests` : "https://api.askexe.com/v1/support/feature-requests");
   const token = config.support?.featureRequestToken || process.env.EXE_FEATURE_REQUEST_TOKEN;
   const licenseKey = loadLicense() || process.env.EXE_LICENSE_KEY || config.cloud?.apiKey;
   const licenseToken = readCachedLicenseToken();
-  if (!endpoint2) {
+  if (!endpoint) {
     return "not_configured";
   }
   try {
-    const parsed = new URL(endpoint2);
+    const parsed = new URL(endpoint);
     if (parsed.protocol !== "https:" && !["localhost", "127.0.0.1", "::1"].includes(parsed.hostname)) {
       return "failed: insecure endpoint rejected";
     }
+    let outboundBody;
+    let redactedCount = 0;
+    let truncatedCount = 0;
+    if (isTelemetryRedactionEnabled()) {
+      const sanitized = sanitizeUpstreamPayload(payload);
+      outboundBody = JSON.stringify(sanitized.payload);
+      redactedCount = sanitized.redactedCount;
+      truncatedCount = sanitized.truncatedCount;
+    } else {
+      console.error("[feature-request] WARNING: EXE_TELEMETRY_REDACT=off \u2014 sending UNREDACTED payload upstream");
+      outboundBody = JSON.stringify(payload);
+    }
     const response = await fetch(parsed, {
       method: "POST",
       headers: {
@@ -11966,11 +12004,14 @@ async function maybeSendUpstream2(payload) {
         ...licenseToken ? { "x-exe-license-token": licenseToken } : {},
         ...supportAdminHeaders(config)
       },
-      body: JSON.stringify(payload),
+      body: outboundBody,
       signal: AbortSignal.timeout(1e4)
     });
     if (!response.ok) return `failed: HTTP ${response.status}`;
-    return "sent";
+    const parts = ["sanitized"];
+    if (redactedCount > 0) parts.push(`${redactedCount} secret${redactedCount === 1 ? "" : "s"} redacted`);
+    if (truncatedCount > 0) parts.push(`${truncatedCount} field${truncatedCount === 1 ? "" : "s"} truncated`);
+    return `sent (${parts.join(", ")})`;
   } catch (err) {
     return `failed: ${err instanceof Error ? err.message : String(err)}`;
   }
@@ -12094,11 +12135,9 @@ function registerCreateFeatureRequest(server) {
         file_paths: null
       });
       await flushBatch();
-      const UPSTREAM_ATTACHMENT_MAX_CHARS = 4096;
       const upstreamAttachments = attachments?.map((att) => ({
         filename: att.filename,
-        content: att.content.length > UPSTREAM_ATTACHMENT_MAX_CHARS ? att.content.slice(0, UPSTREAM_ATTACHMENT_MAX_CHARS) + `
-... [truncated, ${att.content.length} chars total]` : att.content,
+        content: att.content,
         truncated: att.content.length > UPSTREAM_ATTACHMENT_MAX_CHARS,
         original_size: att.content.length
       }));
@@ -12227,9 +12266,9 @@ async function appendUpdateSection(filePath, opts) {
 async function sendUpstream(payload, isAdmin) {
   const config = await loadConfig();
   const routerUrl = process.env.API_ROUTER_URL?.replace(/\/+$/, "");
-  const adminToken2 = resolveSupportAdminToken(config);
+  const adminToken = resolveSupportAdminToken(config);
   const support = config.support;
-  const baseEndpoint = isAdmin && adminToken2 ? process.env.ASKEXE_SUPPORT_ADMIN_ENDPOINT || support?.adminEndpoint || support?.admin_endpoint || "https://api.askexe.com/admin/support/bug-reports" : config.support?.bugReportEndpoint || process.env.EXE_BUG_REPORT_ENDPOINT || (routerUrl ? `${routerUrl}/v1/support/bug-reports` : "https://api.askexe.com/v1/support/bug-reports");
+  const baseEndpoint = isAdmin && adminToken ? process.env.ASKEXE_SUPPORT_ADMIN_ENDPOINT || support?.adminEndpoint || support?.admin_endpoint || "https://api.askexe.com/admin/support/bug-reports" : config.support?.bugReportEndpoint || process.env.EXE_BUG_REPORT_ENDPOINT || (routerUrl ? `${routerUrl}/v1/support/bug-reports` : "https://api.askexe.com/v1/support/bug-reports");
   const licenseKey = loadLicense() || process.env.EXE_LICENSE_KEY || config.cloud?.apiKey;
   const licenseToken = readCachedLicenseToken();
   if (!baseEndpoint) return "not_configured";
@@ -12240,18 +12279,21 @@ async function sendUpstream(payload, isAdmin) {
     if (parsed.protocol !== "https:" && !["localhost", "127.0.0.1", "::1"].includes(parsed.hostname)) {
       return "failed: insecure endpoint rejected";
     }
-    const adminHeaders = isAdmin && adminToken2 ? { authorization: `Bearer ${adminToken2}`, ...supportAdminHeaders(config) } : {};
+    const adminHeaders = isAdmin && adminToken ? { authorization: `Bearer ${adminToken}`, ...supportAdminHeaders(config) } : {};
     const response = await fetch(parsed, {
       method: "PATCH",
       headers: {
         "content-type": "application/json",
-        ...isAdmin && adminToken2 ? {} : {
+        ...isAdmin && adminToken ? {} : {
           ...licenseKey ? { "x-exe-license-key": licenseKey, authorization: `Bearer ${licenseKey}` } : {},
           ...licenseToken ? { "x-exe-license-token": licenseToken } : {}
         },
         ...adminHeaders
       },
-      body: JSON.stringify(payload),
+      // Egress redaction gate (dc16fee4) — add_evidence ("logs, repro details,
+      // stack traces"), add_note, and triage_notes are the most secret-dense
+      // support fields; redact before the network send.
+      body: sanitizedUpstreamBody(payload, "update-bug-report"),
       signal: AbortSignal.timeout(1e4)
     });
     if (!response.ok) return `failed: HTTP ${response.status}`;
@@ -12432,9 +12474,9 @@ async function appendStatusUpdate(filePath, status2, notes, shippedVersion) {
 async function sendUpstream2(payload) {
   const config = await loadConfig();
   const routerUrl = process.env.API_ROUTER_URL?.replace(/\/+$/, "");
-  const adminToken2 = resolveSupportAdminToken(config);
+  const adminToken = resolveSupportAdminToken(config);
   const support = config.support;
-  const baseEndpoint = adminToken2 ? process.env.ASKEXE_SUPPORT_ADMIN_FEATURE_ENDPOINT || support?.adminFeatureEndpoint || support?.admin_feature_endpoint || "https://api.askexe.com/admin/support/feature-requests" : config.support?.featureRequestEndpoint || process.env.EXE_FEATURE_REQUEST_ENDPOINT || (routerUrl ? `${routerUrl}/v1/support/feature-requests` : "https://api.askexe.com/v1/support/feature-requests");
+  const baseEndpoint = adminToken ? process.env.ASKEXE_SUPPORT_ADMIN_FEATURE_ENDPOINT || support?.adminFeatureEndpoint || support?.admin_feature_endpoint || "https://api.askexe.com/admin/support/feature-requests" : config.support?.featureRequestEndpoint || process.env.EXE_FEATURE_REQUEST_ENDPOINT || (routerUrl ? `${routerUrl}/v1/support/feature-requests` : "https://api.askexe.com/v1/support/feature-requests");
   const licenseKey = loadLicense() || process.env.EXE_LICENSE_KEY || config.cloud?.apiKey;
   const licenseToken = readCachedLicenseToken();
   if (!baseEndpoint) return "not_configured";
@@ -12449,12 +12491,14 @@ async function sendUpstream2(payload) {
       method: "PATCH",
       headers: {
         "content-type": "application/json",
-        ...adminToken2 ? { authorization: `Bearer ${adminToken2}`, ...supportAdminHeaders(config) } : {
+        ...adminToken ? { authorization: `Bearer ${adminToken}`, ...supportAdminHeaders(config) } : {
           ...licenseKey ? { "x-exe-license-key": licenseKey, authorization: `Bearer ${licenseKey}` } : {},
           ...licenseToken ? { "x-exe-license-token": licenseToken } : {}
         }
       },
-      body: JSON.stringify(payload),
+      // Egress redaction gate (dc16fee4) — redact response_notes/add_note
+      // before the network send.
+      body: sanitizedUpstreamBody(payload, "update-feature-request"),
       signal: AbortSignal.timeout(1e4)
     });
     if (!response.ok) return `failed: HTTP ${response.status}`;
@@ -12619,10 +12663,10 @@ function registerSupportTools(server) {
           isError: true
         };
       }
-      const endpoint2 = new URL("https://api.askexe.com/v1/support/my-reports");
-      endpoint2.searchParams.set("status", status2);
-      endpoint2.searchParams.set("limit", String(limit));
-      endpoint2.searchParams.set("offset", String(offset));
+      const endpoint = new URL("https://api.askexe.com/v1/support/my-reports");
+      endpoint.searchParams.set("status", status2);
+      endpoint.searchParams.set("limit", String(limit));
+      endpoint.searchParams.set("offset", String(offset));
       const headers = { "content-type": "application/json" };
       if (licenseKey) {
         headers["authorization"] = `Bearer ${licenseKey}`;
@@ -12630,7 +12674,7 @@ function registerSupportTools(server) {
       }
       if (licenseToken) headers["x-exe-license-token"] = licenseToken;
       try {
-        const res = await fetch(endpoint2.toString(), { method: "GET", headers, signal: AbortSignal.timeout(15e3) });
+        const res = await fetch(endpoint.toString(), { method: "GET", headers, signal: AbortSignal.timeout(15e3) });
         if (!res.ok) {
           const body = await res.text().catch(() => "");
           return {
@@ -12691,10 +12735,10 @@ function registerSupportTools(server) {
           isError: true
         };
       }
-      const endpoint2 = new URL("https://api.askexe.com/v1/support/my-feature-requests");
-      endpoint2.searchParams.set("status", status2);
-      endpoint2.searchParams.set("limit", String(limit));
-      endpoint2.searchParams.set("offset", String(offset));
+      const endpoint = new URL("https://api.askexe.com/v1/support/my-feature-requests");
+      endpoint.searchParams.set("status", status2);
+      endpoint.searchParams.set("limit", String(limit));
+      endpoint.searchParams.set("offset", String(offset));
       const headers = { "content-type": "application/json" };
       if (licenseKey) {
         headers["authorization"] = `Bearer ${licenseKey}`;
@@ -12702,7 +12746,7 @@ function registerSupportTools(server) {
       }
       if (licenseToken) headers["x-exe-license-token"] = licenseToken;
       try {
-        const res = await fetch(endpoint2.toString(), { method: "GET", headers, signal: AbortSignal.timeout(15e3) });
+        const res = await fetch(endpoint.toString(), { method: "GET", headers, signal: AbortSignal.timeout(15e3) });
         if (!res.ok) {
           const body = await res.text().catch(() => "");
           return {
@@ -12763,9 +12807,9 @@ function registerSupportTools(server) {
           isError: true
         };
       }
-      const endpoint2 = new URL("https://api.askexe.com/v1/support/my-reviews");
-      endpoint2.searchParams.set("status", status2);
-      endpoint2.searchParams.set("limit", String(limit));
+      const endpoint = new URL("https://api.askexe.com/v1/support/my-reviews");
+      endpoint.searchParams.set("status", status2);
+      endpoint.searchParams.set("limit", String(limit));
       const headers = { "content-type": "application/json" };
       if (licenseKey) {
         headers["authorization"] = `Bearer ${licenseKey}`;
@@ -12773,7 +12817,7 @@ function registerSupportTools(server) {
       }
       if (licenseToken) headers["x-exe-license-token"] = licenseToken;
       try {
-        const res = await fetch(endpoint2.toString(), { method: "GET", headers, signal: AbortSignal.timeout(15e3) });
+        const res = await fetch(endpoint.toString(), { method: "GET", headers, signal: AbortSignal.timeout(15e3) });
         if (!res.ok) {
           const body = await res.text().catch(() => "");
           if (res.status === 500 || res.status === 404) {
@@ -13031,7 +13075,7 @@ function registerCliParityTools(server) {
     const out = await runCommand("exe-os", ["cloud", "status"], 45e3);
     let healthSection = "";
     try {
-      const { getRetrievalHealth: getRetrievalHealth2, formatDegradations: formatDegradations2 } = await import("./retrieval-health-TWHKYCRK.js");
+      const { getRetrievalHealth: getRetrievalHealth2, formatDegradations: formatDegradations2 } = await import("./retrieval-health-4C2PO6HH.js");
       const h = await getRetrievalHealth2();
       const lines = [
         "",
@@ -13099,7 +13143,7 @@ function registerCodeContext(server) {
       const index = buildCodeContextIndex(opts);
       let graphExtract;
       try {
-        const { autoExtractGraphEntities } = await import("./graph-auto-extract-LKIQ57PL.js");
+        const { autoExtractGraphEntities } = await import("./graph-auto-extract-HCQQF5AG.js");
         graphExtract = await autoExtractGraphEntities(opts.projectRoot);
       } catch {
       }
@@ -13173,355 +13217,8 @@ function registerCodeContext(server) {
   });
 }
 
-// src/mcp/tools/support-inbox.ts
-import { z as z95 } from "zod";
-import { readFileSync as readFileSync7 } from "fs";
-import { join as join4 } from "path";
-import { homedir as homedir4 } from "os";
-var DEFAULT_ENDPOINT = "https://api.askexe.com/admin/support/bug-reports";
-var DEFAULT_OWNER_ENDPOINT = "https://api.askexe.com/v1/support/bug-reports";
-var STATUS3 = z95.enum(["open", "triaged", "fixed", "closed", "wontfix"]);
-function adminToken() {
-  if (process.env.ASKEXE_SUPPORT_ADMIN_TOKEN) return process.env.ASKEXE_SUPPORT_ADMIN_TOKEN;
-  if (process.env.EXE_SUPPORT_ADMIN_TOKEN) return process.env.EXE_SUPPORT_ADMIN_TOKEN;
-  try {
-    const configPath = join4(process.env.EXE_OS_DIR ?? join4(homedir4(), ".exe-os"), "config.json");
-    const config = JSON.parse(readFileSync7(configPath, "utf-8"));
-    return config.support?.adminToken || config.support?.admin_token;
-  } catch {
-    return void 0;
-  }
-}
-function endpoint() {
-  return (process.env.ASKEXE_SUPPORT_ADMIN_ENDPOINT || DEFAULT_ENDPOINT).replace(/\/+$/, "");
-}
-function ownerEndpoint() {
-  const routerUrl = process.env.API_ROUTER_URL?.replace(/\/+$/, "");
-  let configured;
-  try {
-    const configPath = join4(process.env.EXE_OS_DIR ?? join4(homedir4(), ".exe-os"), "config.json");
-    const config = JSON.parse(readFileSync7(configPath, "utf-8"));
-    configured = config.support?.bugReportEndpoint;
-  } catch {
-  }
-  const base = configured || process.env.EXE_BUG_REPORT_ENDPOINT || (routerUrl ? `${routerUrl}/v1/support/bug-reports` : DEFAULT_OWNER_ENDPOINT);
-  return base.replace(/\/+$/, "");
-}
-function ownerAuthHeaders() {
-  let cloudApiKey;
-  try {
-    const configPath = join4(process.env.EXE_OS_DIR ?? join4(homedir4(), ".exe-os"), "config.json");
-    const config = JSON.parse(readFileSync7(configPath, "utf-8"));
-    cloudApiKey = config.cloud?.apiKey;
-  } catch {
-  }
-  const licenseKey = loadLicense() || process.env.EXE_LICENSE_KEY || cloudApiKey;
-  const licenseToken = readCachedLicenseToken();
-  const headers = {};
-  if (licenseKey) {
-    headers["x-exe-license-key"] = licenseKey;
-    headers.authorization = `Bearer ${licenseKey}`;
-  }
-  if (licenseToken) headers["x-exe-license-token"] = licenseToken;
-  return headers;
-}
-function assertInternal() {
-  const token = adminToken();
-  if (!token) throw new Error("AskExe support admin token not configured");
-  return token;
-}
-async function requestJson(url, init) {
-  const token = assertInternal();
-  const res = await fetch(url, {
-    ...init,
-    headers: {
-      "content-type": "application/json",
-      authorization: `Bearer ${token}`,
-      ...init?.headers ?? {}
-    },
-    signal: AbortSignal.timeout(1e4)
-  });
-  const text5 = await res.text();
-  let data = text5;
-  try {
-    data = text5 ? JSON.parse(text5) : {};
-  } catch {
-  }
-  if (!res.ok) throw new Error(`HTTP ${res.status}: ${typeof data === "string" ? data : JSON.stringify(data)}`);
-  return data;
-}
-async function fetchJson(url, headers, init) {
-  const res = await fetch(url, {
-    ...init,
-    headers: { "content-type": "application/json", ...headers, ...init?.headers ?? {} },
-    signal: AbortSignal.timeout(1e4)
-  });
-  const text5 = await res.text();
-  let data = text5;
-  try {
-    data = text5 ? JSON.parse(text5) : {};
-  } catch {
-  }
-  if (!res.ok) throw new Error(`HTTP ${res.status}: ${typeof data === "string" ? data : JSON.stringify(data)}`);
-  return data;
-}
-async function commentRequestJson(bugId, init) {
-  const token = adminToken();
-  if (token) {
-    const url2 = `${endpoint()}/${encodeURIComponent(bugId)}/comments`;
-    return fetchJson(url2, { authorization: `Bearer ${token}` }, init);
-  }
-  const ownerHeaders = ownerAuthHeaders();
-  if (!ownerHeaders.authorization && !ownerHeaders["x-exe-license-token"]) {
-    throw new Error(
-      "Not authenticated for support comments. Run `exe-os login` (GoTrue) or set a license key, or configure an AskExe admin token (ASKEXE_SUPPORT_ADMIN_TOKEN)."
-    );
-  }
-  const url = `${ownerEndpoint()}/${encodeURIComponent(bugId)}/comments`;
-  return fetchJson(url, ownerHeaders, init);
-}
-function registerListBugReports(server) {
-  server.registerTool(
-    "list_bug_reports",
-    {
-      title: "List Bug Reports",
-      description: "AskExe-internal only: list incoming customer bug reports from the support inbox.",
-      inputSchema: {
-        status: z95.enum(["all", "open", "triaged", "fixed", "closed", "wontfix"]).default("open"),
-        severity: z95.enum(["p0", "p1", "p2", "p3"]).optional(),
-        limit: z95.number().int().min(1).max(100).default(25)
-      }
-    },
-    async ({ status: status2, severity, limit }) => {
-      const url = new URL(endpoint());
-      url.searchParams.set("status", status2);
-      url.searchParams.set("limit", String(limit));
-      if (severity) url.searchParams.set("severity", severity);
-      const data = await requestJson(url.toString());
-      return { content: [{ type: "text", text: JSON.stringify(data, null, 2) }] };
-    }
-  );
-}
-function parseComments(row) {
-  if (!row || typeof row !== "object") return [];
-  const raw = row.progress_log;
-  if (typeof raw !== "string" || !raw.trim()) return [];
-  try {
-    const parsed = JSON.parse(raw);
-    return Array.isArray(parsed) ? parsed : [];
-  } catch {
-    return [];
-  }
-}
-function registerGetBugReport(server) {
-  server.registerTool(
-    "get_bug_report",
-    {
-      title: "Get Bug Report",
-      description: "AskExe-internal only: fetch one customer bug report with full markdown payload and comments thread.",
-      inputSchema: { id: z95.string().min(8) }
-    },
-    async ({ id }) => {
-      const data = await requestJson(`${endpoint()}/${encodeURIComponent(id)}`);
-      const comments = parseComments(data);
-      const enriched = data && typeof data === "object" ? { ...data, comments } : { id, comments };
-      return { content: [{ type: "text", text: JSON.stringify(enriched, null, 2) }] };
-    }
-  );
-}
-function registerAddBugReportComment(server) {
-  server.registerTool(
-    "add_bug_report_comment",
-    {
-      title: "Add Bug Report Comment",
-      description: "AskExe-internal only: append a comment to a bug report's thread (POST /comments). Non-destructive \u2014 does not touch triage_notes or status.",
-      inputSchema: {
-        id: z95.string().min(8),
-        comment: z95.string().min(1).describe("Comment text to append to the bug report thread")
-      }
-    },
-    async ({ id, comment }) => {
-      const data = await commentRequestJson(id, {
-        method: "POST",
-        body: JSON.stringify({ comment })
-      });
-      return { content: [{ type: "text", text: JSON.stringify(data, null, 2) }] };
-    }
-  );
-}
-function registerGetBugReportComments(server) {
-  server.registerTool(
-    "get_bug_report_comments",
-    {
-      title: "Get Bug Report Comments",
-      description: "AskExe-internal only: list the comments thread on a bug report (GET /comments).",
-      inputSchema: { id: z95.string().min(8) }
-    },
-    async ({ id }) => {
-      const data = await commentRequestJson(id);
-      return { content: [{ type: "text", text: JSON.stringify(data, null, 2) }] };
-    }
-  );
-}
-function registerTriageBugReport(server) {
-  server.registerTool(
-    "triage_bug_report",
-    {
-      title: "Triage Bug Report",
-      description: "AskExe-internal only: update bug report status and link task/commit/release metadata.",
-      inputSchema: {
-        id: z95.string().min(8),
-        status: STATUS3.optional(),
-        triage_notes: z95.string().optional(),
-        add_note: z95.string().optional().describe("Append a timestamped progress note without changing status or replacing triage_notes"),
-        linked_task_id: z95.string().optional(),
-        linked_commit: z95.string().optional(),
-        fixed_version: z95.string().optional(),
-        product: z95.string().optional().describe("Re-label this bug's product: exe-os, exe-create, exe-wiki, exe-gateway, exe-crm, exe-build, exe-chat, exe-auth, exe-monitor, exe-db, exe-erp")
-      }
-    },
-    async ({ id, status: status2, triage_notes, add_note, linked_task_id, linked_commit, fixed_version, product }) => {
-      const effectiveStatus = fixed_version && !status2 ? "closed" : status2;
-      const data = await requestJson(`${endpoint()}/${encodeURIComponent(id)}`, {
-        method: "PATCH",
-        body: JSON.stringify({ status: effectiveStatus, triage_notes, add_note, linked_task_id, linked_commit, fixed_version, product })
-      });
-      return { content: [{ type: "text", text: JSON.stringify(data, null, 2) }] };
-    }
-  );
-}
-var FEATURE_STATUS = z95.enum(["open", "planned", "in_progress", "shipped", "closed", "wontdo"]);
-function featureEndpoint() {
-  return endpoint().replace(/\/bug-reports\/?$/, "/feature-requests");
-}
-function registerListFeatureRequests(server) {
-  server.registerTool(
-    "list_feature_requests",
-    {
-      title: "List Feature Requests",
-      description: "AskExe-internal only: list incoming customer feature requests from the support inbox.",
-      inputSchema: {
-        status: z95.enum(["all", "open", "planned", "in_progress", "shipped", "closed", "wontdo"]).default("open"),
-        priority: z95.enum(["p0", "p1", "p2", "p3"]).optional(),
-        limit: z95.number().int().min(1).max(100).default(25)
-      }
-    },
-    async ({ status: status2, priority, limit }) => {
-      const url = new URL(featureEndpoint());
-      url.searchParams.set("status", status2);
-      url.searchParams.set("limit", String(limit));
-      if (priority) url.searchParams.set("priority", priority);
-      const data = await requestJson(url.toString());
-      return { content: [{ type: "text", text: JSON.stringify(data, null, 2) }] };
-    }
-  );
-}
-function registerGetFeatureRequest(server) {
-  server.registerTool(
-    "get_feature_request",
-    {
-      title: "Get Feature Request",
-      description: "AskExe-internal only: fetch one customer feature request with full payload.",
-      inputSchema: { id: z95.string().min(8) }
-    },
-    async ({ id }) => {
-      const data = await requestJson(`${featureEndpoint()}/${encodeURIComponent(id)}`);
-      return { content: [{ type: "text", text: JSON.stringify(data, null, 2) }] };
-    }
-  );
-}
-function registerTriageFeatureRequest(server) {
-  server.registerTool(
-    "triage_feature_request",
-    {
-      title: "Triage Feature Request",
-      description: "AskExe-internal only: update feature request status, response notes, and version metadata.",
-      inputSchema: {
-        id: z95.string().min(8),
-        status: FEATURE_STATUS.optional(),
-        response_notes: z95.string().optional(),
-        add_note: z95.string().optional().describe("Append a timestamped progress note without changing status or replacing response_notes"),
-        target_version: z95.string().optional(),
-        shipped_version: z95.string().optional()
-      }
-    },
-    async ({ id, status: status2, response_notes, add_note, target_version, shipped_version }) => {
-      const effectiveStatus = shipped_version && !status2 ? "shipped" : status2;
-      const data = await requestJson(`${featureEndpoint()}/${encodeURIComponent(id)}`, {
-        method: "PATCH",
-        body: JSON.stringify({ status: effectiveStatus, response_notes, add_note, target_version, shipped_version })
-      });
-      return { content: [{ type: "text", text: JSON.stringify(data, null, 2) }] };
-    }
-  );
-}
-var REVIEW_STATUS = z95.enum(["open", "in_review", "approved", "merged", "closed", "rejected"]);
-function reviewEndpoint() {
-  return endpoint().replace(/\/bug-reports\/?$/, "/reviews");
-}
-function registerListReviews(server) {
-  server.registerTool(
-    "list_reviews",
-    {
-      title: "List Reviews",
-      description: "AskExe-internal only: list incoming review requests from the support inbox.",
-      inputSchema: {
-        status: z95.enum(["all", "open", "in_review", "approved", "merged", "closed", "rejected"]).default("open"),
-        priority: z95.enum(["p0", "p1", "p2", "p3"]).optional(),
-        limit: z95.number().int().min(1).max(100).default(25)
-      }
-    },
-    async ({ status: status2, priority, limit }) => {
-      const url = new URL(reviewEndpoint());
-      url.searchParams.set("status", status2);
-      url.searchParams.set("limit", String(limit));
-      if (priority) url.searchParams.set("priority", priority);
-      const data = await requestJson(url.toString());
-      return { content: [{ type: "text", text: JSON.stringify(data, null, 2) }] };
-    }
-  );
-}
-function registerGetReview(server) {
-  server.registerTool(
-    "get_review",
-    {
-      title: "Get Review",
-      description: "AskExe-internal only: fetch one review with full payload.",
-      inputSchema: { id: z95.string().min(8) }
-    },
-    async ({ id }) => {
-      const data = await requestJson(`${reviewEndpoint()}/${encodeURIComponent(id)}`);
-      return { content: [{ type: "text", text: JSON.stringify(data, null, 2) }] };
-    }
-  );
-}
-function registerTriageReview(server) {
-  server.registerTool(
-    "triage_review",
-    {
-      title: "Triage Review",
-      description: "AskExe-internal only: update review status, response notes, and resolution.",
-      inputSchema: {
-        id: z95.string().min(8),
-        status: REVIEW_STATUS.optional(),
-        response_notes: z95.string().optional(),
-        add_note: z95.string().optional().describe("Append a timestamped progress note without changing status or replacing response_notes"),
-        resolution: z95.string().optional(),
-        pr_url: z95.string().optional()
-      }
-    },
-    async ({ id, status: status2, response_notes, add_note, resolution, pr_url }) => {
-      const data = await requestJson(`${reviewEndpoint()}/${encodeURIComponent(id)}`, {
-        method: "PATCH",
-        body: JSON.stringify({ status: status2, response_notes, add_note, resolution, pr_url })
-      });
-      return { content: [{ type: "text", text: JSON.stringify(data, null, 2) }] };
-    }
-  );
-}
-
 // src/mcp/tools/decision.ts
-import { z as z96 } from "zod";
+import { z as z95 } from "zod";
 function buildHandlers6() {
   const tools = /* @__PURE__ */ new Map();
   const fake = {
@@ -13545,12 +13242,12 @@ function registerDecision(server) {
       title: "Decision",
       description: "Store or retrieve authoritative decisions. Actions: store (persist a decision by domain), get (look up a decision by domain/query).",
       inputSchema: {
-        action: z96.enum(["store", "get"]).describe("Decision operation"),
-        domain: z96.string().optional().describe("Decision domain (e.g. 'architecture', 'hiring')"),
-        decision: z96.string().optional().describe("Decision text for action=store"),
-        rationale: z96.string().optional().describe("Why this decision was made (action=store)"),
-        query: z96.string().optional().describe("Search query for action=get"),
-        limit: z96.coerce.number().optional().describe("Max results for action=get")
+        action: z95.enum(["store", "get"]).describe("Decision operation"),
+        domain: z95.string().optional().describe("Decision domain (e.g. 'architecture', 'hiring')"),
+        decision: z95.string().optional().describe("Decision text for action=store"),
+        rationale: z95.string().optional().describe("Why this decision was made (action=store)"),
+        query: z95.string().optional().describe("Search query for action=get"),
+        limit: z95.coerce.number().optional().describe("Max results for action=get")
       }
     },
     async (input, extra) => {
@@ -13566,7 +13263,7 @@ function registerDecision(server) {
 }
 
 // src/mcp/tools/session.ts
-import { z as z97 } from "zod";
+import { z as z96 } from "zod";
 function buildHandlers7() {
   const tools = /* @__PURE__ */ new Map();
   const fake = {
@@ -13614,17 +13311,17 @@ function registerSession(server) {
       title: "Session",
       description: "Session tools. Actions: events (session event log), last_response (most recent assistant text), set_mode (enter explore or task mode), get_mode (query current mode and active explore sessions).",
       inputSchema: {
-        action: z97.enum(["events", "last_response", "set_mode", "get_mode"]).describe("Session operation"),
-        session_id: z97.string().optional().describe("Session ID for action=events"),
-        limit: z97.coerce.number().optional().describe("Max events for action=events"),
+        action: z96.enum(["events", "last_response", "set_mode", "get_mode"]).describe("Session operation"),
+        session_id: z96.string().optional().describe("Session ID for action=events"),
+        limit: z96.coerce.number().optional().describe("Max events for action=events"),
         // set_mode params
-        mode: z97.enum(["explore", "task"]).optional().describe(
+        mode: z96.enum(["explore", "task"]).optional().describe(
           "Mode for action=set_mode. 'explore' = divergent, no deliverable, nudges suppressed. 'task' = default convergent behaviour (resets any active explore session)."
         ),
-        duration_minutes: z97.number().optional().describe(
+        duration_minutes: z96.number().optional().describe(
           `How long to stay in explore mode in minutes (action=set_mode, mode=explore). Default: ${DEFAULT_EXPLORE_DURATION_MS / 6e4} minutes (1 hour).`
         ),
-        notes: z97.string().optional().describe("Optional notes about this explore session (action=set_mode)")
+        notes: z96.string().optional().describe("Optional notes about this explore session (action=set_mode)")
       }
     },
     async (input, extra) => {
@@ -13689,14 +13386,14 @@ All active explore sessions (${active.length}):
 }
 
 // src/mcp/tools/support-consolidated.ts
-import { z as z99 } from "zod";
+import { z as z98 } from "zod";
 
 // src/mcp/tools/create-review.ts
-import { z as z98 } from "zod";
+import { z as z97 } from "zod";
 import crypto6 from "crypto";
 import { mkdir as mkdir4, writeFile as writeFile6 } from "fs/promises";
 import path17 from "path";
-var PRIORITY2 = z98.enum(["p0", "p1", "p2", "p3"]);
+var PRIORITY2 = z97.enum(["p0", "p1", "p2", "p3"]);
 function slugify3(input) {
   return input.toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/^-+|-+$/g, "").slice(0, 80) || "review";
 }
@@ -13725,15 +13422,15 @@ function buildMarkdown3(input) {
 async function maybeSendUpstream3(payload) {
   const config = await loadConfig();
   const routerUrl = process.env.API_ROUTER_URL?.replace(/\/+$/, "");
-  const endpoint2 = config.support?.reviewEndpoint || process.env.EXE_REVIEW_ENDPOINT || (routerUrl ? `${routerUrl}/v1/support/reviews` : "https://api.askexe.com/v1/support/reviews");
+  const endpoint = config.support?.reviewEndpoint || process.env.EXE_REVIEW_ENDPOINT || (routerUrl ? `${routerUrl}/v1/support/reviews` : "https://api.askexe.com/v1/support/reviews");
   const token = config.support?.reviewToken || process.env.EXE_REVIEW_TOKEN;
   const licenseKey = loadLicense() || process.env.EXE_LICENSE_KEY || config.cloud?.apiKey;
   const licenseToken = readCachedLicenseToken();
-  if (!endpoint2) {
+  if (!endpoint) {
     return "not_configured";
   }
   try {
-    const parsed = new URL(endpoint2);
+    const parsed = new URL(endpoint);
     if (parsed.protocol !== "https:" && !["localhost", "127.0.0.1", "::1"].includes(parsed.hostname)) {
       return "failed: insecure endpoint rejected";
     }
@@ -13746,7 +13443,10 @@ async function maybeSendUpstream3(payload) {
         ...licenseToken ? { "x-exe-license-token": licenseToken } : {},
         ...supportAdminHeaders(config)
       },
-      body: JSON.stringify(payload),
+      // Egress redaction gate (dc16fee4) — redact secrets from description +
+      // rendered markdown before the network send. No disk outbox for reviews,
+      // so this direct send is the only path.
+      body: sanitizedUpstreamBody(payload, "create-review"),
       signal: AbortSignal.timeout(1e4)
     });
     if (!response.ok) return `failed: HTTP ${response.status}`;
@@ -13762,15 +13462,15 @@ function registerCreateReview(server) {
       title: "Create Review",
       description: "File a review request (code review, self-improvement findings, PR review needs). Writes a local report, stores memory, and optionally sends to AskExe support.",
       inputSchema: {
-        title: z98.string().min(3).describe("Short descriptive title"),
-        description: z98.string().optional().describe("What needs review and why"),
+        title: z97.string().min(3).describe("Short descriptive title"),
+        description: z97.string().optional().describe("What needs review and why"),
         priority: PRIORITY2.default("p1").describe("p0 critical -> p3 low"),
-        source: z98.string().optional().describe("Source: self-improve, manual, ci, etc."),
-        pr_url: z98.string().optional().describe("PR URL if applicable"),
-        product: z98.string().optional().describe("Product: exe-os (default), exe-create, exe-wiki, exe-gateway, exe-crm, exe-build"),
-        package_version: z98.string().optional().describe("Installed package version"),
-        project_name: z98.string().optional().describe("Project/customer context"),
-        send_upstream: z98.boolean().default(false).describe("Attempt to POST to configured AskExe support endpoint (disabled by default \u2014 review route not yet live)")
+        source: z97.string().optional().describe("Source: self-improve, manual, ci, etc."),
+        pr_url: z97.string().optional().describe("PR URL if applicable"),
+        product: z97.string().optional().describe("Product: exe-os (default), exe-create, exe-wiki, exe-gateway, exe-crm, exe-build"),
+        package_version: z97.string().optional().describe("Installed package version"),
+        project_name: z97.string().optional().describe("Project/customer context"),
+        send_upstream: z97.boolean().default(false).describe("Attempt to POST to configured AskExe support endpoint (disabled by default \u2014 review route not yet live)")
       }
     },
     async ({
@@ -13926,7 +13626,7 @@ function registerSupportConsolidated(server) {
       title: "Support",
       description: "Bug reports, feature requests, reviews, and support system. Actions: create_bug, create_feature, create_review, update_bug, update_feature, list_my_bugs, list_my_features, list_my_reviews, list_bugs, get_bug, add_comment, get_comments, triage_bug, list_features, get_feature, triage_feature, list_reviews, get_review, triage_review, health, test. Use 'product' param to file bugs for any AskExe product.",
       inputSchema: {
-        action: z99.enum([
+        action: z98.enum([
           "create_bug",
           "create_feature",
           "create_review",
@@ -13949,40 +13649,40 @@ function registerSupportConsolidated(server) {
           "health",
           "test"
         ]).describe("Support operation"),
-        title: z99.string().optional().describe("Bug/feature title"),
-        description: z99.string().optional().describe("Bug/feature description"),
-        steps_to_reproduce: z99.string().optional().describe("Steps to reproduce (bugs)"),
-        expected_behavior: z99.string().optional().describe("Expected behavior (bugs)"),
-        actual_behavior: z99.string().optional().describe("Actual behavior (bugs)"),
-        severity: z99.string().optional().describe("Severity: p0/p1/p2/p3"),
-        product: z99.string().optional().describe("Product (create_bug default exe-os; also re-labels a bug via update_bug, admin only): exe-os, exe-create, exe-wiki, exe-gateway, exe-crm, exe-build, exe-chat, exe-auth, exe-monitor, exe-db, exe-erp"),
-        use_case: z99.string().optional().describe("Use case (features)"),
-        proposed_solution: z99.string().optional().describe("Proposed solution (features)"),
-        priority: z99.string().optional().describe("Priority (features)"),
-        on_behalf_of_email: z99.string().email().optional().describe("ADMIN ONLY: file this request owned by another customer's license email; ignored unless caller holds the support admin token (create_bug/create_feature)"),
-        id: z99.string().optional().describe("Bug/feature ID for get/triage/add_comment/get_comments"),
-        comment: z99.string().optional().describe("Comment text to append to a bug report thread (add_comment)"),
-        status: z99.string().optional().describe("Filter by status"),
-        classification: z99.string().optional().describe("Triage classification"),
-        resolution: z99.string().optional().describe("Triage resolution"),
-        notes: z99.string().optional().describe("Triage notes (mapped to triage_notes for bug/feature triage)"),
-        triage_notes: z99.string().optional().describe("Triage notes (legacy field name)"),
-        linked_task_id: z99.string().optional().describe("Linked task ID for triage"),
-        linked_commit: z99.string().optional().describe("Linked commit hash for triage"),
-        fixed_version: z99.string().optional().describe("Version that fixes this bug"),
-        shipped_version: z99.string().optional().describe("Version that ships this feature (features only)"),
-        add_evidence: z99.string().optional().describe("Owner self-service: additional evidence (logs, repro, stack traces) for update_bug"),
-        reopen_request: z99.boolean().optional().describe("Owner self-service: request a reopen on a recurring fixed bug (update_bug)"),
-        reopen_reason: z99.string().optional().describe("Owner self-service: why the bug should be reopened (update_bug)"),
-        attachments: z99.array(z99.object({
-          filename: z99.string().min(1).describe("Filename for the attachment"),
-          content: z99.string().min(1).describe("File content \u2014 plain text")
+        title: z98.string().optional().describe("Bug/feature title"),
+        description: z98.string().optional().describe("Bug/feature description"),
+        steps_to_reproduce: z98.string().optional().describe("Steps to reproduce (bugs)"),
+        expected_behavior: z98.string().optional().describe("Expected behavior (bugs)"),
+        actual_behavior: z98.string().optional().describe("Actual behavior (bugs)"),
+        severity: z98.string().optional().describe("Severity: p0/p1/p2/p3"),
+        product: z98.string().optional().describe("Product (create_bug default exe-os; also re-labels a bug via update_bug, admin only): exe-os, exe-create, exe-wiki, exe-gateway, exe-crm, exe-build, exe-chat, exe-auth, exe-monitor, exe-db, exe-erp"),
+        use_case: z98.string().optional().describe("Use case (features)"),
+        proposed_solution: z98.string().optional().describe("Proposed solution (features)"),
+        priority: z98.string().optional().describe("Priority (features)"),
+        on_behalf_of_email: z98.string().email().optional().describe("ADMIN ONLY: file this request owned by another customer's license email; ignored unless caller holds the support admin token (create_bug/create_feature)"),
+        id: z98.string().optional().describe("Bug/feature ID for get/triage/add_comment/get_comments"),
+        comment: z98.string().optional().describe("Comment text to append to a bug report thread (add_comment)"),
+        status: z98.string().optional().describe("Filter by status"),
+        classification: z98.string().optional().describe("Triage classification"),
+        resolution: z98.string().optional().describe("Triage resolution"),
+        notes: z98.string().optional().describe("Triage notes (mapped to triage_notes for bug/feature triage)"),
+        triage_notes: z98.string().optional().describe("Triage notes (legacy field name)"),
+        linked_task_id: z98.string().optional().describe("Linked task ID for triage"),
+        linked_commit: z98.string().optional().describe("Linked commit hash for triage"),
+        fixed_version: z98.string().optional().describe("Version that fixes this bug"),
+        shipped_version: z98.string().optional().describe("Version that ships this feature (features only)"),
+        add_evidence: z98.string().optional().describe("Owner self-service: additional evidence (logs, repro, stack traces) for update_bug"),
+        reopen_request: z98.boolean().optional().describe("Owner self-service: request a reopen on a recurring fixed bug (update_bug)"),
+        reopen_reason: z98.string().optional().describe("Owner self-service: why the bug should be reopened (update_bug)"),
+        attachments: z98.array(z98.object({
+          filename: z98.string().min(1).describe("Filename for the attachment"),
+          content: z98.string().min(1).describe("File content \u2014 plain text")
         })).optional().describe("File attachments for bug reports / feature requests (diffs, logs, config snippets)"),
-        source: z99.string().optional().describe("Review source: self-improve, manual, ci"),
-        pr_url: z99.string().optional().describe("PR URL (reviews)"),
-        review_resolution: z99.string().optional().describe("Resolution text (reviews)"),
-        limit: z99.coerce.number().optional().describe("Max results per page (up to 500)"),
-        offset: z99.coerce.number().optional().describe("Number of results to skip for pagination (list_my_bugs/list_my_features). Use next_offset from a prior response.")
+        source: z98.string().optional().describe("Review source: self-improve, manual, ci"),
+        pr_url: z98.string().optional().describe("PR URL (reviews)"),
+        review_resolution: z98.string().optional().describe("Resolution text (reviews)"),
+        limit: z98.coerce.number().optional().describe("Max results per page (up to 500)"),
+        offset: z98.coerce.number().optional().describe("Number of results to skip for pagination (list_my_bugs/list_my_features). Use next_offset from a prior response.")
       }
     },
     async (input, extra) => {
@@ -14068,7 +13768,7 @@ function registerSupportConsolidated(server) {
 }
 
 // src/mcp/tools/diagnostics.ts
-import { z as z100 } from "zod";
+import { z as z99 } from "zod";
 function buildHandlers9() {
   const tools = /* @__PURE__ */ new Map();
   const fake = {
@@ -14089,21 +13789,21 @@ function registerDiagnostics(server) {
       title: "Diagnostics",
       description: `System diagnostics and admin operations. Actions: ${toolNames.join(", ")}. Covers health checks, update status, cloud status, key management, employee rename, semantic tool discovery (tool_search), identity drift detection (drift), agent liveness monitoring (agent_liveness), agent memory reassignment (merge_agent_memories), steward identity gate (steward_check, steward_audit_log, steward_override), daemon restart forensics (daemon_restarts \u2014 'why did the daemon restart?': restart-cause breakdown, slowest-timer leaderboard, event-loop-block frequency), and orchestration-health visibility: spawn_failures ('why did dispatch fail?': tmux spawn fail count + cause breakdown path_not_found/claude_launch_failed/timeout + success-vs-fail ratio), orchestration_health ('is the box healthy / is the spiral happening?': load/core, event-loop lag, direct-SQLite-fallback count, event-loop blocks), and work_map ('who's doing what / who died and why?': live sessions \xD7 role \xD7 task \xD7 worktree flag, plus recent session deaths with cause/load + worktree violations).`,
       inputSchema: {
-        action: z100.string().describe(`Diagnostic operation: ${toolNames.join(", ")}`),
+        action: z99.string().describe(`Diagnostic operation: ${toolNames.join(", ")}`),
         // Pass-through params used by various sub-tools
-        agent_id: z100.string().optional().describe("Agent to probe (drift). Defaults to all agents."),
-        name: z100.string().optional().describe("Employee name (rename_employee)"),
-        new_name: z100.string().optional().describe("New employee name (rename_employee)"),
-        query: z100.string().optional().describe("Search/filter query, or natural language for tool_search"),
-        format: z100.string().optional().describe("Output format"),
-        limit: z100.coerce.number().int().min(1).max(100).optional().describe("Max results for tool_search (default 20)"),
-        from_agent_id: z100.string().optional().describe("Source agent ID to merge from (merge_agent_memories)"),
-        to_agent_id: z100.string().optional().describe("Target agent ID to merge into (merge_agent_memories)"),
-        dry_run: z100.boolean().optional().default(true).describe("Preview mode \u2014 show count without changing (merge_agent_memories). Default: true"),
+        agent_id: z99.string().optional().describe("Agent to probe (drift). Defaults to all agents."),
+        name: z99.string().optional().describe("Employee name (rename_employee)"),
+        new_name: z99.string().optional().describe("New employee name (rename_employee)"),
+        query: z99.string().optional().describe("Search/filter query, or natural language for tool_search"),
+        format: z99.string().optional().describe("Output format"),
+        limit: z99.coerce.number().int().min(1).max(100).optional().describe("Max results for tool_search (default 20)"),
+        from_agent_id: z99.string().optional().describe("Source agent ID to merge from (merge_agent_memories)"),
+        to_agent_id: z99.string().optional().describe("Target agent ID to merge into (merge_agent_memories)"),
+        dry_run: z99.boolean().optional().default(true).describe("Preview mode \u2014 show count without changing (merge_agent_memories). Default: true"),
         // Steward params (absorbed from steward tool)
-        operation: z100.string().optional().describe("Operation name for steward_check/steward_override"),
-        target: z100.string().optional().describe("Target resource for steward_check/steward_override"),
-        reason: z100.string().optional().describe("Override reason for steward_override")
+        operation: z99.string().optional().describe("Operation name for steward_check/steward_override"),
+        target: z99.string().optional().describe("Target resource for steward_check/steward_override"),
+        reason: z99.string().optional().describe("Override reason for steward_override")
       }
     },
     async (input, extra) => {
@@ -14268,7 +13968,7 @@ async function handleMergeAgentMemories(input) {
 }
 async function handleSpawnFailures() {
   try {
-    const { getOrchestrationMetrics } = await import("./orchestration-events-5SIJOE4H.js");
+    const { getOrchestrationMetrics } = await import("./orchestration-events-ZG7O4HRY.js");
     const metrics = await getOrchestrationMetrics();
     const c = metrics.counts;
     const attempted = c.tmuxSpawnAttempted;
@@ -14370,7 +14070,7 @@ async function handleOrchestrationHealth() {
 async function handleWorkMap() {
   try {
     const { getAgentLivenessReport } = await import("./agent-heartbeat-I5UPGXAU.js");
-    const { classifyRole } = await import("./session-kill-telemetry-CZSPN5V6.js");
+    const { classifyRole } = await import("./session-kill-telemetry-6YDGEF27.js");
     const { buildSessionDeathSummary } = await import("./orchestration-health-read-EJWVUARG.js");
     const { getPaneCwd } = await import("./lib/tmux-status.js");
     const live = getAgentLivenessReport();
@@ -14505,7 +14205,7 @@ async function handleDrift(input) {
 }
 async function handleSteward(action, input) {
   const gate = new StewardGate();
-  const { getActiveAgent: getActiveAgent2 } = await import("./active-agent-EC6M7KTX.js");
+  const { getActiveAgent: getActiveAgent2 } = await import("./active-agent-AIQP4DFL.js");
   const inputAgent = input.agent_id;
   const operation = input.operation;
   const target = input.target;
@@ -14553,7 +14253,7 @@ async function handleSteward(action, input) {
 }
 
 // src/mcp/tools/dreaming.ts
-import { z as z101 } from "zod";
+import { z as z100 } from "zod";
 function registerDreaming(server) {
   server.registerTool(
     "dreaming",
@@ -14561,10 +14261,10 @@ function registerDreaming(server) {
       title: "Dreaming",
       description: "Self-improvement loop \u2014 reviews recent work, identifies patterns, proposes behavior changes, and detects identity drift. Actions: run (execute dream cycle), status (last cycle result), history (past cycles).",
       inputSchema: {
-        action: z101.enum(["run", "status", "history"]).describe("Action to perform"),
-        agent_id: z101.string().optional().describe("Agent to analyze. Defaults to calling agent."),
-        hours: z101.coerce.number().min(1).max(720).optional().describe("Lookback window in hours (run). Default 24."),
-        limit: z101.coerce.number().int().min(1).max(50).optional().describe("Max results for history. Default 10.")
+        action: z100.enum(["run", "status", "history"]).describe("Action to perform"),
+        agent_id: z100.string().optional().describe("Agent to analyze. Defaults to calling agent."),
+        hours: z100.coerce.number().min(1).max(720).optional().describe("Lookback window in hours (run). Default 24."),
+        limit: z100.coerce.number().int().min(1).max(50).optional().describe("Max results for history. Default 10.")
       }
     },
     async ({ action, agent_id, hours, limit }) => {
@@ -14687,7 +14387,7 @@ ${String(row.raw_text)}`
 }
 
 // src/mcp/tools/steward.ts
-import { z as z102 } from "zod";
+import { z as z101 } from "zod";
 function errorResult11(text5) {
   return { content: [{ type: "text", text: text5 }], isError: true };
 }
@@ -14699,12 +14399,12 @@ function registerSteward(server) {
       title: "Steward Identity Gate",
       description: "Constitutional check before destructive operations. action=check: verify agent authority for an operation. action=audit_log: query the audit trail. action=override: coordinator-only bypass with reason.",
       inputSchema: {
-        action: z102.enum(["check", "audit_log", "override"]).describe("Steward operation to perform"),
-        agent: z102.string().optional().describe("Agent to check (defaults to calling agent for action=check)"),
-        operation: z102.string().optional().describe("Operation name (required for check/override)"),
-        target: z102.string().optional().describe("Target resource (required for check/override)"),
-        reason: z102.string().optional().describe("Override reason (required for action=override)"),
-        limit: z102.number().optional().describe("Max audit entries to return (default: 50)")
+        action: z101.enum(["check", "audit_log", "override"]).describe("Steward operation to perform"),
+        agent: z101.string().optional().describe("Agent to check (defaults to calling agent for action=check)"),
+        operation: z101.string().optional().describe("Operation name (required for check/override)"),
+        target: z101.string().optional().describe("Target resource (required for check/override)"),
+        reason: z101.string().optional().describe("Override reason (required for action=override)"),
+        limit: z101.number().optional().describe("Max audit entries to return (default: 50)")
       }
     },
     async (input) => {
@@ -14787,7 +14487,7 @@ function registerSteward(server) {
 }
 
 // src/mcp/tools/resonance.ts
-import { z as z103 } from "zod";
+import { z as z102 } from "zod";
 function text4(content, isError = false) {
   return { content: [{ type: "text", text: content }], ...isError ? { isError: true } : {} };
 }
@@ -14796,14 +14496,14 @@ function registerResonance(server) {
     title: "Resonance Network",
     description: "Co-activation network queries. Actions: hot_pairs (top co-activated memory pairs), neighbors (co-activation neighbors for a specific memory).",
     inputSchema: {
-      action: z103.enum(["hot_pairs", "neighbors"]).describe("Resonance query type"),
-      memory_id: z103.string().optional().describe("Memory ID for neighbors action"),
-      entity_id: z103.string().optional().describe("Deprecated alias for memory_id on neighbors action"),
-      limit: z103.number().optional().describe("Max results (default 20)")
+      action: z102.enum(["hot_pairs", "neighbors"]).describe("Resonance query type"),
+      memory_id: z102.string().optional().describe("Memory ID for neighbors action"),
+      entity_id: z102.string().optional().describe("Deprecated alias for memory_id on neighbors action"),
+      limit: z102.number().optional().describe("Max results (default 20)")
     }
   }, async ({ action, memory_id, entity_id, limit }) => {
     try {
-      const { getHotPairs, getCoActivationNeighbors } = await import("./co-activation-XMPHKGHR.js");
+      const { getHotPairs, getCoActivationNeighbors } = await import("./co-activation-QI5BK4RT.js");
       if (action === "hot_pairs") {
         const pairs = await getHotPairs(limit ?? 20);
         if (pairs.length === 0) return text4("No co-activation data yet. Pairs are recorded as memories are accessed together in searches.");
@@ -15217,7 +14917,7 @@ ${err.stack ?? ""}` : String(err);
     gate("registerSupportTools", registerSupportTools);
     const hasAdminToken = !!(process.env.ASKEXE_SUPPORT_ADMIN_TOKEN || process.env.EXE_SUPPORT_ADMIN_TOKEN || (() => {
       try {
-        const c = JSON.parse(readFileSync8(join5(process.env.EXE_OS_DIR ?? join5(homedir5(), ".exe-os"), "config.json"), "utf-8"));
+        const c = JSON.parse(readFileSync7(join4(process.env.EXE_OS_DIR ?? join4(homedir4(), ".exe-os"), "config.json"), "utf-8"));
         return c.support?.adminToken || c.support?.admin_token;
       } catch {
         return "";