@askexenow/exe-os 0.9.340 → 0.9.342

package/dist/{chunk-A47MXY2I.js → chunk-EQHQF5IM.js}

@@ -25,18 +25,17 @@ var PLATFORM_PROCEDURES = [
     priority: "p1",
     content: "exe-os supports three tools: Claude Code (Anthropic), Codex (OpenAI), OpenCode (open source, 75+ providers). Each agent can use a different tool and model. COO uses set_agent_config MCP tool to view/change settings. No args = show all agents. agent_id + runtime + model = change. Claude models: claude-sonnet-4.6, claude-opus-4.6, claude-sonnet-4.8, claude-opus-4.8, claude-opus-4.8-1m, fable (claude-fable-5). Interactive selection: `exe-os settings` from terminal."
   },
-  // --- Updates and deployment (consolidated) ---
-  {
-    title: "How to update exe-os \u2014 channels, versions, and lifecycle",
-    domain: "operations",
-    priority: "p0",
-    content: "TWO-STEP UPDATE: (1) CLI: `npm install -g @askexenow/exe-os@latest` \u2014 updates tools, MCP, procedures. Must happen first. (2) Stack (VPS only): `exe-os stack-update --target <version> --yes` \u2014 pulls new Docker images. CLI MUST precede stack \u2014 the stack-update command itself may have fixes. `exe-os update` is the recommended interactive path (runs npm install + install --global + daemon restart). Agents should NEVER run npm install or stack-update autonomously \u2014 confirm with user first. THREE CHANNELS: stable (default, @latest on npm), canary (@canary, experimental), pinned (blocks updates unless --force). View: `exe-os channel`. Change: `exe-os channel <name>`. TWO VERSION TRACKS: CLI version (e.g. 0.9.90) updates frequently; stack version (e.g. 0.9.8) updates rarely. CLI > stack is normal \u2014 do NOT attempt to make them match. Only update stack when boot brief says so or `exe-os stack-update --check` shows pending changes. WHAT PICKS UP NEW CODE: postinstall restarts daemon automatically. MCP picks up new code on next /mcp reconnect. Hooks pick up on next session (fresh processes). `npm run deploy` is dev-only (build + install + daemon restart). Never run from a worktree. NEVER confuse `exe-os setup` (first-time wizard) with `exe-os update` (replace code + restart). If stack-update fails with EACCES: `sudo mkdir -p /opt/exe-stack && sudo chown $(whoami) /opt/exe-stack`."
-  },
-  {
-    title: "First install \u2014 setup wizard and license activation",
+  // --- Reference pointer (boot-perf audit 2026-07-06 §P1) ---
+  // The heavy reference sections (update lifecycle, first-install wizard, full
+  // MCP tool reference, cognition features, platform capabilities) were moved OUT
+  // of the always-injected block into PLATFORM_REFERENCE_PROCEDURES (read on
+  // demand) to cut the per-session token cost. This one compact pointer stays
+  // inline so agents know the reference exists and how to reach it.
+  {
+    title: "Platform reference \u2014 read on demand, not injected",
     domain: "operations",
     priority: "p1",
-    content: "Fresh install: `npm install -g @askexenow/exe-os` then run `exe` to start the setup wizard. Wizard prompts for: encryption passphrase (creates master key), license key (exe_sk_*), COO name, optional team members. No license key = free tier (1 employee, 5K memories). After setup: hooks auto-install, MCP registers in ~/.claude.json, daemon starts. Verify: `exe-os healthcheck` or mcp_ping()."
+    content: "Reference-heavy platform docs are NOT injected into every session (token budget). Read them on demand from ~/.exe-os/reference/platform-reference.md (auto-written at COO boot), which covers: the full MCP tool reference (all domains + key actions); how to update exe-os (channels, CLI vs stack, `exe-os update`); the first-install setup wizard + license activation; cognition features (dreaming, reflexes, baselines, hot-path summary); and platform capabilities (watchdog, diagnostics, graph extraction, discovery hooks, cloud reminders). For LIVE MCP tool discovery use diagnostics(action='tool_search'); for update status use diagnostics(action='check_update'). When a task needs these details, read the file or recall \u2014 never guess update/setup steps."
   },
   // --- Project boundary ---
   {
@@ -275,27 +274,6 @@ var PLATFORM_PROCEDURES = [
     priority: "p0",
     content: "If MCP tools are unavailable, disconnected, or returning connection errors: STOP. Tell the user: 'MCP server is disconnected. Please run /mcp to reconnect.' No workarounds \u2014 no raw Node imports, no direct DB, no CLI hacks, no daemon socket calls, no tmux send-keys. MCP is the ONLY data interface AND dispatch path. When down, you cannot create tasks, send messages, or coordinate agents. Ask once, wait, proceed when reconnected."
   },
-  // --- MCP Tool Reference (consolidated from 8 procedures) ---
-  {
-    title: "MCP tool reference \u2014 all domains and key actions",
-    domain: "tool-use",
-    priority: "p1",
-    content: "exe-os MCP uses action-based dispatch (19 consolidated tools). Legacy 108-tool surface via EXE_MCP_TOOL_SURFACE=legacy. MEMORY: recall (search, as_of for bi-temporal, kind filter, retrieval_mode: all|decisions_only|procedures_only|operational|recent_high_value|document_aware) | ask_team | store (kind, procedure_for) | commit (high-importance) | search_everything | session_context | get_by_id | consolidate | cardinality | supersede. DECISION: store (domain, decision, rationale) | get (domain or query). TASK: create (title, assigned_to, context; blocked_by, parent_task_id, reviewer, complexity, budget_tokens, spawn_runtime, spawn_model) | list | get | update (in_progress/done/blocked/cancelled + assertions) | close (COO only) | checkpoint | resume. GRAPH: query_relationships | entity_neighbors | hot_entities | stats | export | merge_entities | similar_trajectories. IDENTITY: get | update. BEHAVIOR: store | list | deactivate. SUPPORT: create_bug (title, description, severity p0-p3, product param for any AskExe product) | create_feature (title, description, use_case, proposed_solution) | list_my_bugs | list_my_features | triage_bug (AskExe-internal, uses triage_notes NOT notes) | health. MESSAGE: send | acknowledge. REMINDER: create | list | complete. SESSION: events | last_response. WIKI: list | get. DOCUMENT: ingest | list | purge | set_importance | rerank. CRM: list_people | get_person | list_tables | describe_table. RAW_DATA: list_sources | query | get. GATEWAY: send_whatsapp | query_conversations | query_company_brain. CONFIG: list_employees | set_agent_config | agent_spend | daemon_health | license_status | cloud_sync (cloud_action: status|sync|reupload) | memory_audit | run_consolidation | worker_gate | auto_wake_status | orchestration_phase | company_procedure (store|list|deactivate) | global_procedure | create_trigger | list_triggers | export_orchestration | import_orchestration | closeout | capability_cards (query param for best-agent match). DIAGNOSTICS: healthcheck | doctor | status_brief | check_update | cloud_status | pending_work_summary | rename_employee | tool_search | drift. DREAMING: run | status | history. MCP_PING: daemon health + license + tool usage + retrieval health."
-  },
-  // --- Cognition features (consolidated from reflex, baselines, hot-path) ---
-  {
-    title: "Cognition features \u2014 dreaming, reflexes, baselines, hot-path summary",
-    domain: "cognition",
-    priority: "p1",
-    content: "DREAMING: Analyzes recent work for patterns \u2014 mistakes, strategies, knowledge gaps. `dreaming(action='run')` triggers manually; `config(action='closeout')` runs as session closeout. Returns: patterns, behavior proposals (review before adopting), drift score (0-1, >0.8 triggers steward gate). status/history actions show past cycles. REFLEXES: Store trigger->action suggestions via behavior(action='store', domain='reflex', trigger='...', trigger_action='...'). Agent always decides \u2014 prominent suggestions, not auto-execution. EMOTIONAL BASELINES: Each role has target tone and anti-patterns. Dreaming tracks emotional drift. Baselines in identity files. HOT-PATH SUMMARY: ~200-token compressed last-session summary injected at boot before any recall. Don't re-search for context already in your session summary."
-  },
-  // --- Platform capabilities (consolidated from watchdog, diagnostics, doc-graph, attachments, reminders, discovery, roster) ---
-  {
-    title: "Platform capabilities \u2014 watchdog, diagnostics, graph extraction, discovery hooks, cloud reminders",
-    domain: "operations",
-    priority: "p2",
-    content: "WATCHDOG: Out-of-process, pings daemon every 10s. After 3 failures (30s), force-restarts via SIGTERM->SIGKILL->launchd. MCP outages bounded to ~30-40s. Wait and retry before telling user to /mcp. DIAGNOSTICS: mcp_ping/cloud_status/memory_audit report embed daemon status, search mode, query router, vector backfill, graph coverage, event loop lag (degraded when >5s). DOC-GRAPH: ingest_document auto-extracts concepts/relationships to knowledge graph. Manual: graph(action='extract_from_document', document_id='...'). ATTACHMENTS: support(action='create_bug/create_feature') accepts attachments=[{filename, content}] (4KB truncated). REMINDERS: Auto-sync to cloud (Cloudflare KV). Created on Mac, visible on VPS. Dedup by text+due_date. DISCOVERY: Compact tool catalog injected at boot (~300 tokens). Per-prompt contextual hints (max 3, ~150 tokens). ROSTER: Team roster injected at boot (name+role). Don't recall for team info. Use config(action='capability_cards') for full agent manifests."
-  },
   // --- Engineering discipline (coding agents) ---
   {
     title: "Engineering discipline \u2014 lazy ladder, surgical diffs, named failure modes",
@@ -318,11 +296,51 @@ var PLATFORM_PROCEDURES = [
     content: "Your plan (free / pro / team / agency / enterprise) governs your limits \u2014 including how many agents/employees you can run. Enterprise = unlimited. HOW VALIDATION WORKS: your instance validates your license key (or login) against the cloud (api.askexe.com), which reads the users store \u2014 the SINGLE SOURCE OF TRUTH \u2014 and returns your plan as a signed token, cached locally at ~/.exe-os/license-cache.json (works fast, and offline within a grace window). That cached token is what your limits run on day-to-day. IF YOUR PLAN WAS CHANGED (e.g. upgraded to enterprise for more agents): the change lands on the SERVER first; your instance keeps the OLD cached plan until it re-validates \u2014 so nothing changes for you until you refresh. To pick it up IMMEDIATELY, do one of: (1) run the `refresh_license` MCP action, or (2) run the `exe-os license refresh` CLI. Either forces a re-check against the cloud, caches the new plan, and lifts your agent limit on the spot (shows old plan -> new plan + new limits). AUTOMATIC: on your next boot, your instance auto-detects a plan change (cheap cloud check, gated to ~10-min cache freshness) and announces it \u2014 e.g. 'Plan changed: pro -> enterprise. Employee limit now unlimited.' No cache-file editing, ever. ASKEXE ADMINS ONLY: to change a CUSTOMER's plan, use the admin-gated set-customer-plan path (requires the AskExe admin token \u2014 customers can never change their own or anyone's plan). It writes the users store (source of truth); the hourly license sync then reflects it into billing, and the customer runs `refresh_license` to pick it up. (Self-serve refresh available in exe-os 0.9.322+.)"
   }
 ];
+var PLATFORM_REFERENCE_PROCEDURES = [
+  {
+    title: "How to update exe-os \u2014 channels, versions, and lifecycle",
+    domain: "operations",
+    priority: "p0",
+    content: "TWO-STEP UPDATE: (1) CLI: `npm install -g @askexenow/exe-os@latest` \u2014 updates tools, MCP, procedures. Must happen first. (2) Stack (VPS only): `exe-os stack-update --target <version> --yes` \u2014 pulls new Docker images. CLI MUST precede stack \u2014 the stack-update command itself may have fixes. `exe-os update` is the recommended interactive path (runs npm install + install --global + daemon restart). Agents should NEVER run npm install or stack-update autonomously \u2014 confirm with user first. THREE CHANNELS: stable (default, @latest on npm), canary (@canary, experimental), pinned (blocks updates unless --force). View: `exe-os channel`. Change: `exe-os channel <name>`. TWO VERSION TRACKS: CLI version (e.g. 0.9.90) updates frequently; stack version (e.g. 0.9.8) updates rarely. CLI > stack is normal \u2014 do NOT attempt to make them match. Only update stack when boot brief says so or `exe-os stack-update --check` shows pending changes. WHAT PICKS UP NEW CODE: postinstall restarts daemon automatically. MCP picks up new code on next /mcp reconnect. Hooks pick up on next session (fresh processes). `npm run deploy` is dev-only (build + install + daemon restart). Never run from a worktree. NEVER confuse `exe-os setup` (first-time wizard) with `exe-os update` (replace code + restart). If stack-update fails with EACCES: `sudo mkdir -p /opt/exe-stack && sudo chown $(whoami) /opt/exe-stack`."
+  },
+  {
+    title: "First install \u2014 setup wizard and license activation",
+    domain: "operations",
+    priority: "p1",
+    content: "Fresh install: `npm install -g @askexenow/exe-os` then run `exe` to start the setup wizard. Wizard prompts for: encryption passphrase (creates master key), license key (exe_sk_*), COO name, optional team members. No license key = free tier (1 employee, 5K memories). After setup: hooks auto-install, MCP registers in ~/.claude.json, daemon starts. Verify: `exe-os healthcheck` or mcp_ping()."
+  },
+  {
+    title: "MCP tool reference \u2014 all domains and key actions",
+    domain: "tool-use",
+    priority: "p1",
+    content: "exe-os MCP uses action-based dispatch (19 consolidated tools). Legacy 108-tool surface via EXE_MCP_TOOL_SURFACE=legacy. MEMORY: recall (search, as_of for bi-temporal, kind filter, retrieval_mode: all|decisions_only|procedures_only|operational|recent_high_value|document_aware) | ask_team | store (kind, procedure_for) | commit (high-importance) | search_everything | session_context | get_by_id | consolidate | cardinality | supersede. DECISION: store (domain, decision, rationale) | get (domain or query). TASK: create (title, assigned_to, context; blocked_by, parent_task_id, reviewer, complexity, budget_tokens, spawn_runtime, spawn_model) | list | get | update (in_progress/done/blocked/cancelled + assertions) | close (COO only) | checkpoint | resume. GRAPH: query_relationships | entity_neighbors | hot_entities | stats | export | merge_entities | similar_trajectories. IDENTITY: get | update. BEHAVIOR: store | list | deactivate. SUPPORT: create_bug (title, description, severity p0-p3, product param for any AskExe product) | create_feature (title, description, use_case, proposed_solution) | list_my_bugs | list_my_features | triage_bug (AskExe-internal, uses triage_notes NOT notes) | health. MESSAGE: send | acknowledge. REMINDER: create | list | complete. SESSION: events | last_response. WIKI: list | get. DOCUMENT: ingest | list | purge | set_importance | rerank. CRM: list_people | get_person | list_tables | describe_table. RAW_DATA: list_sources | query | get. GATEWAY: send_whatsapp | query_conversations | query_company_brain. CONFIG: list_employees | set_agent_config | agent_spend | daemon_health | license_status | cloud_sync (cloud_action: status|sync|reupload) | memory_audit | run_consolidation | worker_gate | auto_wake_status | orchestration_phase | company_procedure (store|list|deactivate) | global_procedure | create_trigger | list_triggers | export_orchestration | import_orchestration | closeout | capability_cards (query param for best-agent match). DIAGNOSTICS: healthcheck | doctor | status_brief | check_update | cloud_status | pending_work_summary | rename_employee | tool_search | drift. DREAMING: run | status | history. MCP_PING: daemon health + license + tool usage + retrieval health."
+  },
+  {
+    title: "Cognition features \u2014 dreaming, reflexes, baselines, hot-path summary",
+    domain: "cognition",
+    priority: "p1",
+    content: "DREAMING: Analyzes recent work for patterns \u2014 mistakes, strategies, knowledge gaps. `dreaming(action='run')` triggers manually; `config(action='closeout')` runs as session closeout. Returns: patterns, behavior proposals (review before adopting), drift score (0-1, >0.8 triggers steward gate). status/history actions show past cycles. REFLEXES: Store trigger->action suggestions via behavior(action='store', domain='reflex', trigger='...', trigger_action='...'). Agent always decides \u2014 prominent suggestions, not auto-execution. EMOTIONAL BASELINES: Each role has target tone and anti-patterns. Dreaming tracks emotional drift. Baselines in identity files. HOT-PATH SUMMARY: ~200-token compressed last-session summary injected at boot before any recall. Don't re-search for context already in your session summary."
+  },
+  {
+    title: "Platform capabilities \u2014 watchdog, diagnostics, graph extraction, discovery hooks, cloud reminders",
+    domain: "operations",
+    priority: "p2",
+    content: "WATCHDOG: Out-of-process, pings daemon every 10s. After 3 failures (30s), force-restarts via SIGTERM->SIGKILL->launchd. MCP outages bounded to ~30-40s. Wait and retry before telling user to /mcp. DIAGNOSTICS: mcp_ping/cloud_status/memory_audit report embed daemon status, search mode, query router, vector backfill, graph coverage, event loop lag (degraded when >5s). DOC-GRAPH: ingest_document auto-extracts concepts/relationships to knowledge graph. Manual: graph(action='extract_from_document', document_id='...'). ATTACHMENTS: support(action='create_bug/create_feature') accepts attachments=[{filename, content}] (4KB truncated). REMINDERS: Auto-sync to cloud (Cloudflare KV). Created on Mac, visible on VPS. Dedup by text+due_date. DISCOVERY: Compact tool catalog injected at boot (~300 tokens). Per-prompt contextual hints (max 3, ~150 tokens). ROSTER: Team roster injected at boot (name+role). Don't recall for team info. Use config(action='capability_cards') for full agent manifests."
+  }
+];
+function getPlatformReferenceMarkdown() {
+  const body = PLATFORM_REFERENCE_PROCEDURES.map((p) => `## ${p.title}
+
+${p.content}`).join("\n\n");
+  return "# exe-os Platform Reference (read on demand)\n\nAuto-generated at COO boot from the installed exe-os version. These sections are intentionally NOT injected into every session's system prompt \u2014 read them here when a task needs them.\n\n" + body + "\n";
+}
 var PLATFORM_PROCEDURE_TITLES = new Set(
-  PLATFORM_PROCEDURES.map((p) => p.title)
+  [...PLATFORM_PROCEDURES, ...PLATFORM_REFERENCE_PROCEDURES].map((p) => p.title)
 );
 
 export {
   PLATFORM_PROCEDURES,
+  PLATFORM_REFERENCE_PROCEDURES,
+  getPlatformReferenceMarkdown,
   PLATFORM_PROCEDURE_TITLES
 };

package/dist/{chunk-AOO77BDE.js → chunk-EUS4QUKP.js}

@@ -2,7 +2,7 @@ import {
   getClient,
   isCoordinatorName,
   loadEmployeesSync
-} from "./chunk-HEPR6QTL.js";
+} from "./chunk-AOHXREB7.js";
 
 // src/lib/steward-gate.ts
 import crypto from "crypto";

package/dist/{chunk-RLRT2BVM.js → chunk-EV46QTD3.js}

@@ -1,6 +1,6 @@
 import {
   getClient
-} from "./chunk-HEPR6QTL.js";
+} from "./chunk-AOHXREB7.js";
 
 // src/lib/skill-refinement.ts
 import crypto from "crypto";

package/dist/{chunk-PAEXYFMY.js → chunk-F27XXN6C.js}

@@ -1,6 +1,6 @@
 import {
   completeReminder
-} from "./chunk-KMBEL7VB.js";
+} from "./chunk-UUEKJDK6.js";
 
 // src/mcp/tools/complete-reminder.ts
 import { z } from "zod";

package/dist/{chunk-XQNNB5GY.js → chunk-F55P3H4S.js}

@@ -1,7 +1,9 @@
 // src/lib/update-check.ts
-import { execSync } from "child_process";
+import { execFile, execSync } from "child_process";
 import { readFileSync } from "fs";
 import path from "path";
+import { promisify } from "util";
+var execFileAsync = promisify(execFile);
 function getLocalVersion(packageRoot) {
   const pkgPath = path.join(packageRoot, "package.json");
   const pkg = JSON.parse(readFileSync(pkgPath, "utf-8"));
@@ -20,6 +22,19 @@ function getRemoteVersion(tag) {
     return null;
   }
 }
+async function getRemoteVersionAsync(tag) {
+  try {
+    const distTag = tag ?? "latest";
+    const { stdout } = await execFileAsync(
+      "npm",
+      ["view", `@askexenow/exe-os@${distTag}`, "version"],
+      { encoding: "utf-8", timeout: 15e3 }
+    );
+    return String(stdout ?? "").trim() || null;
+  } catch {
+    return null;
+  }
+}
 function channelToDistTag(channel) {
   switch (channel) {
     case "canary":
@@ -51,6 +66,24 @@ function checkForUpdate(packageRoot, channel) {
   }
   const distTag = channelToDistTag(effectiveChannel);
   const remoteVersion = getRemoteVersion(distTag);
+  return buildUpdateResult(localVersion, remoteVersion, effectiveChannel);
+}
+async function checkForUpdateAsync(packageRoot, channel) {
+  const effectiveChannel = channel ?? "stable";
+  const localVersion = getLocalVersion(packageRoot);
+  if (effectiveChannel === "pinned") {
+    return {
+      updateAvailable: false,
+      localVersion,
+      channel: effectiveChannel,
+      error: "Updates pinned. Run with --force to override."
+    };
+  }
+  const distTag = channelToDistTag(effectiveChannel);
+  const remoteVersion = await getRemoteVersionAsync(distTag);
+  return buildUpdateResult(localVersion, remoteVersion, effectiveChannel);
+}
+function buildUpdateResult(localVersion, remoteVersion, effectiveChannel) {
   if (!remoteVersion) {
     return {
       updateAvailable: false,
@@ -68,7 +101,9 @@ function checkForUpdate(packageRoot, channel) {
 export {
   getLocalVersion,
   getRemoteVersion,
+  getRemoteVersionAsync,
   channelToDistTag,
   channelToInstallTag,
-  checkForUpdate
+  checkForUpdate,
+  checkForUpdateAsync
 };

package/dist/{chunk-MWZFF3Q7.js → chunk-F5O7V7UK.js}

@@ -3,7 +3,7 @@ import {
 } from "./chunk-2I23RPSI.js";
 import {
   EXE_AI_DIR
-} from "./chunk-7Y5UDEVM.js";
+} from "./chunk-WZHZCDDO.js";
 
 // src/lib/shard-manager.ts
 import path from "path";

package/dist/{chunk-LMZISHSJ.js → chunk-FPFPLPUY.js}

@@ -1,24 +1,24 @@
 import {
   recordSessionKill
-} from "./chunk-T4KZ2Z2N.js";
+} from "./chunk-L4A5DL6Z.js";
 import {
   sessionScopeFilter,
   verifyPaneAtCapacity,
   writeNotification
-} from "./chunk-PLRIJALF.js";
+} from "./chunk-UP75Z5X7.js";
 import {
   listSessions
-} from "./chunk-UIV2WPBT.js";
+} from "./chunk-KGWRTRKC.js";
 import {
   getTransport
-} from "./chunk-RMOBQ6A5.js";
+} from "./chunk-AD2VCHSS.js";
 import {
   recordOrchestrationEventBestEffort
-} from "./chunk-FUIIVSW6.js";
+} from "./chunk-2WAVZ5UJ.js";
 import {
   getClient,
   isCoordinatorName
-} from "./chunk-HEPR6QTL.js";
+} from "./chunk-AOHXREB7.js";
 
 // src/lib/capacity-monitor.ts
 var CAPACITY_PATTERNS = [

package/dist/{chunk-7TS64TBG.js → chunk-G4RGKBCA.js}

@@ -4,13 +4,13 @@ import {
 import {
   ensureDaemonToken,
   readDaemonToken
-} from "./chunk-3NGZ4PL7.js";
+} from "./chunk-X2Q5NLUL.js";
 import {
   computeDaemonHeapCapMb
 } from "./chunk-NLEW62VC.js";
 import {
   EXE_AI_DIR
-} from "./chunk-7Y5UDEVM.js";
+} from "./chunk-WZHZCDDO.js";
 
 // src/lib/exe-daemon-client.ts
 import net from "net";
@@ -42,6 +42,7 @@ function isBootFast() {
 var _socket = null;
 var _connected = false;
 var _autoReconnecting = false;
+var _intentionalDisconnect = false;
 var _autoReconnectTimer = null;
 var _buffer = "";
 var _requestCount = 0;
@@ -359,6 +360,7 @@ function connectToSocket() {
       _socket = socket;
       _connected = true;
       _buffer = "";
+      _intentionalDisconnect = false;
       socket.on("data", handleData);
       socket.on("close", () => {
         _connected = false;
@@ -368,7 +370,9 @@ function connectToSocket() {
           _pending.delete(id);
           entry.resolve({ error: "Connection closed" });
         }
-        if (!_autoReconnecting && !isBootFast()) {
+        const wasIntentional = _intentionalDisconnect;
+        _intentionalDisconnect = false;
+        if (!wasIntentional && !_autoReconnecting && !isBootFast()) {
           startAutoReconnectLoop();
         }
       });
@@ -586,6 +590,7 @@ async function embedBatchViaClient(texts, priority = "high") {
 function disconnectClient() {
   clearAutoReconnectTimer();
   _autoReconnecting = false;
+  _intentionalDisconnect = true;
   if (_socket) {
     _socket.destroy();
     _socket = null;

package/dist/{chunk-4IYSBPX3.js → chunk-G5T6KDG4.js}

@@ -1,6 +1,6 @@
 import {
   isCoordinatorRole
-} from "./chunk-HEPR6QTL.js";
+} from "./chunk-AOHXREB7.js";
 
 // src/lib/task-router.ts
 import { randomUUID } from "crypto";

package/dist/{chunk-7WDXEKUL.js → chunk-GBTTBXAF.js}

@@ -1,6 +1,6 @@
 import {
   getClient
-} from "./chunk-HEPR6QTL.js";
+} from "./chunk-AOHXREB7.js";
 
 // src/lib/pipeline-router.ts
 import crypto from "crypto";
@@ -116,12 +116,12 @@ async function sinkCRM(msg, agentResponse, agentName) {
 }
 async function sinkWiki(msg, agentResponse) {
   try {
-    const { createWikiClient } = await import("./wiki-client-VNDOBK63.js");
+    const { createWikiClient } = await import("./wiki-client-EAN7F5LV.js");
     const client = await createWikiClient();
     if (!client) return false;
     const content = msg.text ?? "";
     if (content.length < 50) return false;
-    const { chatInWorkspace } = await import("./wiki-client-VNDOBK63.js");
+    const { chatInWorkspace } = await import("./wiki-client-EAN7F5LV.js");
     const ingestText = [
       `[${msg.platform}] Message from ${msg.senderName ?? msg.senderId} (${msg.timestamp}):`,
       content,
@@ -149,7 +149,7 @@ async function sinkEntityExtraction(msg, agentResponse, agentName) {
     const client = getClient();
     const memoryId = `conv:${msg.messageId}`;
     await storeExtraction(client, extraction, memoryId, msg.timestamp);
-    import("./conversation-wiki-populator-WU4HEQ7C.js").then(
+    import("./conversation-wiki-populator-WQN3IUU6.js").then(
       ({ populateWikiFromExtraction }) => populateWikiFromExtraction(extraction, msg, agentResponse, agentName)
     ).catch((err) => {
       process.stderr.write(

package/dist/{chunk-6MRWJMI5.js → chunk-GDIJE6D7.js}

@@ -1,6 +1,6 @@
 import {
   processCRMEvent
-} from "./chunk-KTPG4XKI.js";
+} from "./chunk-KP3U5QGJ.js";
 
 // src/gateway/adapters/crm-webhook.ts
 function parseTwentyWebhook(payload) {

package/dist/{chunk-AVKXCSBI.js → chunk-GG5NDQNN.js}

@@ -1,9 +1,9 @@
 import {
   sanitizePort
-} from "./chunk-X2FHTDIU.js";
+} from "./chunk-IBYL4DHM.js";
 import {
   loadEmployeesSync
-} from "./chunk-HEPR6QTL.js";
+} from "./chunk-AOHXREB7.js";
 
 // src/adapters/mcp-http-config.ts
 import { chmodSync, existsSync, mkdirSync, readFileSync, writeFileSync } from "fs";

package/dist/{chunk-I3XKO3KQ.js → chunk-GJ26DULE.js}

@@ -1,10 +1,10 @@
 import {
   PLATFORM_PROCEDURES,
   PLATFORM_PROCEDURE_TITLES
-} from "./chunk-A47MXY2I.js";
+} from "./chunk-EQHQF5IM.js";
 import {
   getClient
-} from "./chunk-HEPR6QTL.js";
+} from "./chunk-AOHXREB7.js";
 
 // src/lib/global-procedures.ts
 import { randomUUID } from "crypto";

package/dist/chunk-GL57PO3K.js

@@ -0,0 +1,104 @@
+// src/gateway/whatsapp-accounts.ts
+import { readFileSync } from "fs";
+import { join } from "path";
+import { homedir } from "os";
+var CONFIG_PATH = join(homedir(), ".exe-os", "whatsapp-accounts.json");
+var GATEWAY_CONFIG_PATH = join(homedir(), ".exe-os", "gateway.json");
+var cachedAccounts = null;
+function loadLegacyGatewayAccounts() {
+  try {
+    const raw = readFileSync(GATEWAY_CONFIG_PATH, "utf8");
+    const cfg = JSON.parse(raw);
+    const legacy = cfg?.adapters?.whatsapp?.accounts;
+    if (!Array.isArray(legacy)) return [];
+    const out = [];
+    for (const a of legacy) {
+      const name = typeof a?.name === "string" ? a.name : void 0;
+      if (!name) continue;
+      out.push({
+        name,
+        phoneNumberId: typeof a.phoneNumberId === "string" ? a.phoneNumberId : "",
+        accessToken: typeof a.accessToken === "string" ? a.accessToken : "",
+        businessAccountId: typeof a.businessAccountId === "string" ? a.businessAccountId : "",
+        verifyToken: typeof a.verifyToken === "string" ? a.verifyToken : "",
+        ...typeof a.defaultAgent === "string" ? { defaultAgent: a.defaultAgent } : {}
+      });
+    }
+    return out;
+  } catch (err) {
+    if (err.code !== "ENOENT") {
+      console.warn("[whatsapp] Failed to load legacy gateway.json accounts:", err.message);
+    }
+    return [];
+  }
+}
+function loadPrimaryAccounts() {
+  try {
+    const raw = readFileSync(CONFIG_PATH, "utf8");
+    const parsed = JSON.parse(raw);
+    if (!Array.isArray(parsed)) {
+      console.warn("[whatsapp] Config is not an array, ignoring");
+      return [];
+    }
+    return parsed.filter((a) => a && typeof a.name === "string");
+  } catch (err) {
+    if (err.code !== "ENOENT") {
+      console.warn("[whatsapp] Failed to load accounts config:", err.message);
+    }
+    return [];
+  }
+}
+function hasCredentials(a) {
+  return Boolean(a.phoneNumberId && a.accessToken);
+}
+function sameCredentials(a, b) {
+  return a.phoneNumberId === b.phoneNumberId && a.accessToken === b.accessToken;
+}
+function loadAccounts() {
+  if (cachedAccounts !== null) return cachedAccounts;
+  const byName = /* @__PURE__ */ new Map();
+  for (const a of loadPrimaryAccounts()) byName.set(a.name, a);
+  for (const legacy of loadLegacyGatewayAccounts()) {
+    const existing = byName.get(legacy.name);
+    if (!existing) {
+      byName.set(legacy.name, legacy);
+      continue;
+    }
+    const existingHasCreds = hasCredentials(existing);
+    const legacyHasCreds = hasCredentials(legacy);
+    if (existingHasCreds && !legacyHasCreds) continue;
+    if (!existingHasCreds && legacyHasCreds) {
+      byName.set(legacy.name, legacy);
+      continue;
+    }
+    if (existingHasCreds && legacyHasCreds && !sameCredentials(existing, legacy)) {
+      console.warn(
+        `[whatsapp] account "${legacy.name}" has CONFLICTING credentials in whatsapp-accounts.json and gateway.json (phoneNumberId "${existing.phoneNumberId}" vs "${legacy.phoneNumberId}"). Using whatsapp-accounts.json (validated store). Reconcile via gateway(action='configure_whatsapp').`
+      );
+      continue;
+    }
+  }
+  cachedAccounts = Array.from(byName.values());
+  return cachedAccounts;
+}
+function getAccountByName(name) {
+  return loadAccounts().find((a) => a.name === name);
+}
+function getAccountByPhoneNumberId(phoneNumberId) {
+  return loadAccounts().find((a) => a.phoneNumberId === phoneNumberId);
+}
+function getDefaultAccount() {
+  const accounts = loadAccounts();
+  return accounts[0];
+}
+function _resetCache() {
+  cachedAccounts = null;
+}
+
+export {
+  loadAccounts,
+  getAccountByName,
+  getAccountByPhoneNumberId,
+  getDefaultAccount,
+  _resetCache
+};

package/dist/chunk-GWDSB25T.js

@@ -0,0 +1,6 @@
+// src/lib/session-busy-pattern.ts
+var BUSY_PATTERN = /[✻✽✶✳].*…|Running…|• Working|• Ran |• Explored|• Called|esc to interrupt/;
+
+export {
+  BUSY_PATTERN
+};

package/dist/{chunk-F55JF43M.js → chunk-H6BV5TKD.js}

@@ -1,22 +1,25 @@
 import {
   getBrandAsciiArt,
   getBrandName
-} from "./chunk-TPHCZDE3.js";
+} from "./chunk-O5V57XYE.js";
 import {
   getMasterKey,
   setMasterKey
-} from "./chunk-Z42MXYWW.js";
+} from "./chunk-QWVXN224.js";
+import {
+  RUNTIME_TABLE
+} from "./chunk-NGP6LSV2.js";
 import {
   EXE_AI_DIR,
   LEGACY_LANCE_PATH,
   MODELS_DIR,
   loadConfig,
   saveConfig
-} from "./chunk-7Y5UDEVM.js";
+} from "./chunk-WZHZCDDO.js";
 import {
   atomicWriteJsonSync,
   atomicWriteSync
-} from "./chunk-SHIICYJW.js";
+} from "./chunk-BYTDMAGB.js";
 
 // src/lib/setup-wizard.ts
 import crypto from "crypto";
@@ -204,7 +207,7 @@ function clearSetupState() {
 }
 async function probeDaemonHealthAfterInstall() {
   try {
-    const { waitForDaemonReady } = await import("./daemon-ready-5XI5BIJD.js");
+    const { waitForDaemonReady } = await import("./daemon-ready-4JTSFKAY.js");
     return await waitForDaemonReady(4, 500);
   } catch {
     return false;
@@ -488,7 +491,7 @@ async function runSetupWizard(opts = {}) {
       log("  The old directory will not be modified or deleted.");
       log("");
     }
-    const { getKeyBackupStatus, markKeyBackupConfirmed } = await import("./key-backup-status-TNEHXA2X.js");
+    const { getKeyBackupStatus, markKeyBackupConfirmed } = await import("./key-backup-status-LOSMVATJ.js");
     const keyBackupBeforeStep1 = getKeyBackupStatus();
     const mustRunKeyCeremony = !state.completedSteps.includes(1) || !keyBackupBeforeStep1.exists;
     if (mustRunKeyCeremony) {
@@ -509,20 +512,22 @@ async function runSetupWizard(opts = {}) {
         log("");
         const { exportMnemonic } = await import("./lib/keychain.js");
         const mnemonic = await exportMnemonic(key);
-        log("=============================================================");
-        log("  YOUR 24-WORD RECOVERY PHRASE");
-        log("=============================================================");
-        log("");
-        log("  " + mnemonic);
-        log("");
-        log("  SAVE THIS NOW before continuing.");
-        log("  Best: put it in your password manager, or write it down and keep it safe.");
-        log("  This phrase is the ONLY way to decrypt your memories if you lose this computer.");
-        log("  We cannot recover it for you.");
-        log("");
-        log("  Like a Bitcoin wallet \u2014 lose the phrase, lose everything.");
-        log("=============================================================");
-        log("");
+        if (!nonInteractive) {
+          log("=============================================================");
+          log("  YOUR 24-WORD RECOVERY PHRASE");
+          log("=============================================================");
+          log("");
+          log("  " + mnemonic);
+          log("");
+          log("  SAVE THIS NOW before continuing.");
+          log("  Best: put it in your password manager, or write it down and keep it safe.");
+          log("  This phrase is the ONLY way to decrypt your memories if you lose this computer.");
+          log("  We cannot recover it for you.");
+          log("");
+          log("  Like a Bitcoin wallet \u2014 lose the phrase, lose everything.");
+          log("=============================================================");
+          log("");
+        }
         const confirmation = nonInteractive ? "" : await ask(rl, 'Type "I SAVED MY RECOVERY PHRASE" after you have saved it: ', true);
         if (nonInteractive) {
           const recoveryPath = path2.join(EXE_AI_DIR, "recovery-phrase.txt");
@@ -530,6 +535,16 @@ async function runSetupWizard(opts = {}) {
           writeFileSync(recoveryPath, mnemonic + "\n", { mode: 384 });
           chmodSync(recoveryPath, 384);
           log(`[headless] Recovery phrase written to ${recoveryPath} (0600). It is not marked as confirmed.`);
+          log("");
+          log("  ============================================================");
+          log("  \u26A0 SECURITY: recovery-phrase.txt is PLAINTEXT on disk.");
+          log("  Record the 24-word phrase in a password manager or offline");
+          log("  vault, then DELETE the file \u2014 it is not deleted for you:");
+          log("      exe-os doctor --delete-local-secret-residue");
+          log("  Leaving it on disk defeats end-to-end encryption if this");
+          log("  machine is compromised.");
+          log("  ============================================================");
+          log("");
         }
         if (!nonInteractive && confirmation.toUpperCase().trim() !== "I SAVED MY RECOVERY PHRASE") {
           throw new Error(
@@ -711,7 +726,7 @@ async function runSetupWizard(opts = {}) {
       if (cloudConfig) {
         config.cloud = cloudConfig;
       }
-      const { applyDefaultOrchestrationPhase } = await import("./orchestration-phase-CXRCBCK7.js");
+      const { applyDefaultOrchestrationPhase } = await import("./orchestration-phase-AWBXPO52.js");
       applyDefaultOrchestrationPhase(config);
       await saveConfig(config);
       log("");
@@ -737,7 +752,7 @@ async function runSetupWizard(opts = {}) {
       log("Step 5 already complete \u2014 skipping.");
     }
     if (!state.completedSteps.includes(55)) {
-      const { savePreferences, loadPreferences: loadPrefs } = await import("./preferences-TYTGDXQZ.js");
+      const { savePreferences, loadPreferences: loadPrefs } = await import("./preferences-TWIXZBKS.js");
       const existingPrefs = loadPrefs();
       const prefs = { ...existingPrefs };
       if (!fast) {
@@ -808,7 +823,7 @@ async function runSetupWizard(opts = {}) {
       }
       const rtMap = {
         "1": { runtime: "claude", defaultModel: "claude-sonnet-4.6" },
-        "2": { runtime: "codex", defaultModel: "o3" },
+        "2": { runtime: "codex", defaultModel: RUNTIME_TABLE.codex.defaultModel },
         "3": { runtime: "opencode", defaultModel: "anthropic/claude-sonnet-4-6" }
       };
       const selected = rtMap[rtChoice.trim()] ?? rtMap["1"];
@@ -1097,7 +1112,7 @@ async function runSetupWizard(opts = {}) {
         log("");
         unlockExecutives = (await askOrEnv("Unlock Phase 2 executives now? (y/N): ", void 0, "n")).toLowerCase() === "y";
       }
-      const { setOrchestrationPhase } = await import("./orchestration-phase-CXRCBCK7.js");
+      const { setOrchestrationPhase } = await import("./orchestration-phase-AWBXPO52.js");
       if (!unlockExecutives) {
         await setOrchestrationPhase("phase_1_coo", "setup-wizard");
         log("");