@askexenow/exe-os 0.9.340 → 0.9.342

package/dist/{chunk-G7WO77Z2.js → chunk-YTCFACP4.js}

@@ -1,14 +1,37 @@
-import {
-  runDriftProbes
-} from "./chunk-XJI7Z6LZ.js";
 import {
   exportOrchestration,
   importOrchestration,
   validatePackage
-} from "./chunk-QZLIZAS7.js";
+} from "./chunk-TLT7NZCW.js";
+import {
+  runDriftProbes
+} from "./chunk-UUQBZPJJ.js";
+import {
+  registerAddBugReportComment,
+  registerGetBugReport,
+  registerGetBugReportComments,
+  registerGetFeatureRequest,
+  registerGetReview,
+  registerListBugReports,
+  registerListFeatureRequests,
+  registerListReviews,
+  registerTriageBugReport,
+  registerTriageFeatureRequest,
+  registerTriageReview
+} from "./chunk-HV4KESRY.js";
+import {
+  persistSupportArtifact
+} from "./chunk-TTCUG2CF.js";
+import {
+  supportCommitSchema,
+  supportIdSchema,
+  supportProductSchema,
+  supportTaskIdSchema,
+  supportVersionSchema
+} from "./chunk-5H47VHB7.js";
 import {
   StewardGate
-} from "./chunk-AOO77BDE.js";
+} from "./chunk-EUS4QUKP.js";
 import {
   DEFAULT_LIST_LIMIT,
   MAX_IMPORTANCE,
@@ -17,11 +40,11 @@ import {
   ingestDocument,
   listDocumentsByWorkspace,
   updateChunksImportance
-} from "./chunk-6M36JFFD.js";
+} from "./chunk-MKYFAKDW.js";
 import {
   isRerankerAvailable,
   rerankWithScores
-} from "./chunk-DRCRZIIJ.js";
+} from "./chunk-UNXQBELK.js";
 import {
   getEntityByName,
   getEntityNeighbors,
@@ -38,32 +61,32 @@ import {
   searchCodeContext,
   searchCodeContextSemantic,
   traceCodeSymbol
-} from "./chunk-W7DHFGCB.js";
+} from "./chunk-S7QUM2UK.js";
 import {
-  DEFAULT_EXPLORE_DURATION_MS,
-  getPlayMode,
-  listExploreSessions,
-  setPlayMode
-} from "./chunk-PVYR4FCQ.js";
+  listRecentSessionEvents
+} from "./chunk-NN2B2QKU.js";
 import {
   DreamingEngine
-} from "./chunk-VJHUVFIW.js";
+} from "./chunk-HAF2DJYV.js";
 import {
   AUTO_WAKE_MAX_RETRIES
-} from "./chunk-XCTGRD4S.js";
+} from "./chunk-CE7F6RHG.js";
 import {
-  listRecentSessionEvents
-} from "./chunk-QFPTDSY2.js";
+  DEFAULT_EXPLORE_DURATION_MS,
+  getPlayMode,
+  listExploreSessions,
+  setPlayMode
+} from "./chunk-4CMVFVFC.js";
 import {
   getCachedLicenseGate,
   refreshLicenseGate
-} from "./chunk-DADMPMYX.js";
+} from "./chunk-P5HIWY2E.js";
 import {
   getToolUsageStats
-} from "./chunk-NQBRGXYR.js";
+} from "./chunk-JRM4TAGS.js";
 import {
   getToolCapabilityIndex
-} from "./chunk-WHRTDN5J.js";
+} from "./chunk-MGGOSFCR.js";
 import {
   isToolAllowed,
   isToolAllowedForPlan
@@ -71,58 +94,59 @@ import {
 import {
   loadOrchestrationPhase,
   setOrchestrationPhase
-} from "./chunk-32SXNM3G.js";
+} from "./chunk-C5QAPURN.js";
 import {
   createOrRefreshResumeTask
-} from "./chunk-LMZISHSJ.js";
+} from "./chunk-FPFPLPUY.js";
+import {
+  registerSendMessage
+} from "./chunk-JMYHW3AL.js";
+import {
+  registerCreateTask,
+  resolveProjectDir
+} from "./chunk-OZEBAGKR.js";
 import {
   registerListTasks
-} from "./chunk-MQRFKSLI.js";
+} from "./chunk-QOO5RW3K.js";
 import {
   registerUpdateTask
-} from "./chunk-LTVCRHHD.js";
+} from "./chunk-Z6RSN7KS.js";
 import {
   registerCreateReminder
-} from "./chunk-6IRVGOUL.js";
+} from "./chunk-NX5INHHG.js";
 import {
   registerListReminders
-} from "./chunk-BU2QQWBQ.js";
+} from "./chunk-4J4PMPXZ.js";
 import {
   registerCompleteReminder
-} from "./chunk-PAEXYFMY.js";
-import {
-  registerDeactivateBehavior
-} from "./chunk-2SG2UGCH.js";
+} from "./chunk-F27XXN6C.js";
 import {
   completeReminder,
   createReminder,
   listReminders
-} from "./chunk-KMBEL7VB.js";
-import {
-  registerImportConversations
-} from "./chunk-WYLV4S6A.js";
+} from "./chunk-UUEKJDK6.js";
 import {
-  registerSendMessage
-} from "./chunk-Q7L6G6KV.js";
+  registerDeactivateBehavior
+} from "./chunk-MZM6EJCU.js";
 import {
-  registerCreateTask
-} from "./chunk-DILD54TU.js";
+  registerImportConversations
+} from "./chunk-6WQ3NNCE.js";
 import {
   TOKENS_PER_IDLE_MINUTE,
   countKillsSince,
   sumTokensSavedSince
-} from "./chunk-T4KZ2Z2N.js";
+} from "./chunk-L4A5DL6Z.js";
 import {
   createSchedule,
   parseHumanCron
-} from "./chunk-GN45PBWI.js";
+} from "./chunk-SQKXKV2Y.js";
 import {
   status
-} from "./chunk-OJTJYEMX.js";
+} from "./chunk-JPUZPAAF.js";
 import {
   evaluateGlobalSpendCap,
   getAgentSpend
-} from "./chunk-BPC5LZ6Y.js";
+} from "./chunk-QRYVCDWS.js";
 import {
   exportGraphHTML,
   generateGraphReport
@@ -135,14 +159,14 @@ import {
   formatReport,
   runAudit,
   shouldFixShards
-} from "./chunk-KCC5A7YL.js";
+} from "./chunk-QQ4E2RYW.js";
 import {
   formatDegradations,
   getRetrievalHealth
-} from "./chunk-IYB2NIW3.js";
+} from "./chunk-2KZNGDSW.js";
 import {
   runHealthCheck
-} from "./chunk-EIF2LQHZ.js";
+} from "./chunk-PDWS3E22.js";
 import {
   checkCpuStealSync
 } from "./chunk-SSC7EKY2.js";
@@ -150,7 +174,7 @@ import {
   hasFailures,
   runHealth,
   runTest
-} from "./chunk-6HBURYON.js";
+} from "./chunk-OTF44GXL.js";
 import {
   isSupportReportSentStatus,
   markSupportReportSent
@@ -161,28 +185,28 @@ import {
 } from "./chunk-2XZ6X3PJ.js";
 import {
   renderClientCOOTemplate
-} from "./chunk-UXBD22CD.js";
+} from "./chunk-XHK3FS3W.js";
 import {
   deactivateGlobalProcedure,
   loadGlobalProcedures,
   storeGlobalProcedure
-} from "./chunk-I3XKO3KQ.js";
+} from "./chunk-GJ26DULE.js";
 import {
   PLATFORM_PROCEDURES
-} from "./chunk-A47MXY2I.js";
+} from "./chunk-EQHQF5IM.js";
 import {
   clearCloudReuploadRequired,
   cloudSync,
   getCloudReuploadRequired,
   markCloudReuploadRequired
-} from "./chunk-7WPOJDTA.js";
+} from "./chunk-CNVBKDEY.js";
 import {
   createARecord
 } from "./chunk-X2Z5GT3V.js";
 import {
   findSimilarTrajectories,
   hashSignature
-} from "./chunk-UPWE5NOG.js";
+} from "./chunk-QDGZJ653.js";
 import {
   GHOST_BEHAVIOR_SQL,
   deactivateBehavior,
@@ -191,40 +215,40 @@ import {
   reactivateBehavior,
   storeBehavior,
   storeReflexBehavior
-} from "./chunk-TLYAEISW.js";
+} from "./chunk-KW2SD2FL.js";
 import {
   countUnconsolidated,
   groupMemories,
   runConsolidation,
   selectUnconsolidated
-} from "./chunk-R44Z32O2.js";
+} from "./chunk-6CH3TPHR.js";
 import {
   entityId,
   mergeEntities
 } from "./chunk-A4DVMPYB.js";
 import {
   embed
-} from "./chunk-3QDSCJ3F.js";
+} from "./chunk-XZXBB3TN.js";
 import {
   detectDcrIncompatibleConnectorsFromDisk,
   detectExternalMcpFailures,
   readMcpHttpEvents,
   summarizeMcpTransport,
   writeMcpTransportSummary
-} from "./chunk-5RACW3LX.js";
+} from "./chunk-RAXVPNMR.js";
 import {
   updateTask
-} from "./chunk-542EWGY3.js";
+} from "./chunk-QYZJHTNE.js";
 import {
   fastDbInit
-} from "./chunk-UFAXZ2PY.js";
+} from "./chunk-PWUFMX75.js";
 import {
   MAX_CONCURRENT_WORKERS
-} from "./chunk-N5I7RL3I.js";
+} from "./chunk-VPZHJCKW.js";
 import {
   hybridSearch,
   recentRecords
-} from "./chunk-ZREGOV2Q.js";
+} from "./chunk-N7QJKQMX.js";
 import {
   buildFtsMatch,
   tokenizeForFts
@@ -234,10 +258,21 @@ import {
   flushBatch,
   initStore,
   writeMemory
-} from "./chunk-H37HHX3E.js";
+} from "./chunk-VSRPS3J7.js";
 import {
   getActiveAgent
-} from "./chunk-DZ6OQM67.js";
+} from "./chunk-5ERDIOV3.js";
+import {
+  UPSTREAM_ATTACHMENT_MAX_CHARS,
+  isTelemetryRedactionEnabled,
+  redactSecrets,
+  redactedToolResult,
+  sanitizeProductFilter,
+  sanitizeUpstreamId,
+  sanitizeUpstreamPayload,
+  sanitizeVersionField,
+  sanitizedUpstreamBody
+} from "./chunk-4QCFFW2H.js";
 import {
   getMySession,
   resolveExeSession,
@@ -246,13 +281,13 @@ import {
   sessionScopeFilter,
   updateTaskStatus,
   writeCheckpoint
-} from "./chunk-PLRIJALF.js";
+} from "./chunk-UP75Z5X7.js";
 import {
   listSessions
-} from "./chunk-UIV2WPBT.js";
+} from "./chunk-KGWRTRKC.js";
 import {
   recordOrchestrationEventBestEffort
-} from "./chunk-FUIIVSW6.js";
+} from "./chunk-2WAVZ5UJ.js";
 import {
   DEFAULT_MODELS,
   KNOWN_RUNTIMES,
@@ -260,35 +295,33 @@ import {
   getAgentRuntime,
   loadAgentConfig,
   setAgentRuntime
-} from "./chunk-65SVQELL.js";
-import {
-  DEFAULT_RUNTIME
-} from "./chunk-NGP6LSV2.js";
+} from "./chunk-HA5R6USD.js";
 import {
   PlanLimitError,
   assertEmployeeLimit,
   assertFeature,
   assertMemoryLimit
-} from "./chunk-MW2GJJ53.js";
+} from "./chunk-JGIPOUIK.js";
 import {
   getProjectName
 } from "./chunk-OPU3NYOO.js";
 import {
   readDaemonToken
-} from "./chunk-3NGZ4PL7.js";
+} from "./chunk-X2Q5NLUL.js";
 import {
   getAgentContext
 } from "./chunk-GJV3WDWM.js";
 import {
+  _resetCache,
   getAccountByName,
   getDefaultAccount
-} from "./chunk-YGAAZN3E.js";
+} from "./chunk-GL57PO3K.js";
 import {
   createNewTrigger,
   isScheduledTrigger,
   loadTriggers,
   sanitizeParam
-} from "./chunk-KTPG4XKI.js";
+} from "./chunk-KP3U5QGJ.js";
 import {
   pushConversationToCRM
 } from "./chunk-ML4S5SHZ.js";
@@ -306,10 +339,11 @@ import {
   isInitialized,
   listIdentities,
   loadEmployees,
+  loadEmployeesState,
   loadEmployeesSync,
   saveEmployees,
   updateIdentity
-} from "./chunk-HEPR6QTL.js";
+} from "./chunk-AOHXREB7.js";
 import {
   getEventLoopLagMs,
   isDaemonAlive,
@@ -317,10 +351,13 @@ import {
 } from "./chunk-7HLWBYH7.js";
 import {
   getMasterKey
-} from "./chunk-Z42MXYWW.js";
+} from "./chunk-QWVXN224.js";
+import {
+  DEFAULT_RUNTIME
+} from "./chunk-NGP6LSV2.js";
 import {
   checkForUpdate
-} from "./chunk-XQNNB5GY.js";
+} from "./chunk-F55P3H4S.js";
 import {
   PLAN_LIMITS,
   checkLicense,
@@ -331,15 +368,15 @@ import {
   refreshLicense,
   saveLicense,
   validateLicense
-} from "./chunk-XACL67CS.js";
+} from "./chunk-PQIDGXSG.js";
 import {
   EXE_AI_DIR,
   loadConfig
-} from "./chunk-7Y5UDEVM.js";
+} from "./chunk-WZHZCDDO.js";
 
 // src/mcp/register-tools.ts
-import { readFileSync as readFileSync8 } from "fs";
-import { join as join5 } from "path";
+import { readFileSync as readFileSync7 } from "fs";
+import { join as join4 } from "path";
 import { homedir as homedir5 } from "os";
 
 // src/mcp/tools/memory.ts
@@ -515,7 +552,7 @@ function registerRecallMyMemory(server) {
     }) => {
       try {
         if (!isInitialized()) {
-          const { fastDbInit: fastDbInit2 } = await import("./fast-db-init-QQB6IVWV.js");
+          const { fastDbInit: fastDbInit2 } = await import("./fast-db-init-4CWHSOOR.js");
           await fastDbInit2();
         }
         if (!recent && !query) {
@@ -562,7 +599,7 @@ function registerRecallMyMemory(server) {
         let federatedCount = 0;
         if (!recent && query && results.length < FEDERATION_THRESHOLD) {
           try {
-            const { searchCodeContextSemantic: searchCodeContextSemantic2 } = await import("./code-context-index-EXXDY3QZ.js");
+            const { searchCodeContextSemantic: searchCodeContextSemantic2 } = await import("./code-context-index-WSOJQ72R.js");
             const codeResults = await Promise.race([
               searchCodeContextSemantic2(query, { limit: 5 }),
               new Promise((_, rej) => setTimeout(() => rej(new Error("timeout")), 2e3))
@@ -800,7 +837,7 @@ function registerStoreMemory(server) {
       }
       const { agentId, agentRole } = getActiveAgent();
       if (kind === "prospective") {
-        const { createProspectiveMemory } = await import("./prospective-memory-W6S67LZZ.js");
+        const { createProspectiveMemory } = await import("./prospective-memory-6D2ASWM3.js");
         let sessionScope = null;
         try {
           const { resolveExeSession: resolveExeSession2 } = await import("./lib/tmux-routing.js");
@@ -900,7 +937,7 @@ function registerCommitMemory(server) {
         project: z4.string().optional().describe("Project name (auto-detected if omitted)"),
         key_decisions: z4.array(z4.string()).optional().describe("List of key decisions made in this session"),
         metadata_tags: z4.array(z4.string()).optional().describe("Tags for categorization (e.g., 'architecture', 'bugfix', 'design')"),
-        topic: z4.string().optional().describe("Topic heading, e.g. 'HYGO Phase 2 architecture decisions'"),
+        topic: z4.string().optional().describe("Topic heading, e.g. 'Acme Phase 2 architecture decisions'"),
         current_state: z4.string().optional().describe("What is true NOW \u2014 snapshot of current system state"),
         historical_context: z4.string().optional().describe("What led here \u2014 decisions, trade-offs, prior approaches"),
         importance: z4.number().min(1).max(10).optional().describe("Override importance (default 9)"),
@@ -1066,7 +1103,7 @@ async function searchConversations(query, limit) {
 }
 async function searchWiki(query, limit) {
   try {
-    const { createWikiClient, chatInWorkspace, listWorkspaces } = await import("./wiki-client-VNDOBK63.js");
+    const { createWikiClient, chatInWorkspace, listWorkspaces } = await import("./wiki-client-EAN7F5LV.js");
     const client = await createWikiClient();
     if (!client) return [];
     const workspaces = await listWorkspaces(client);
@@ -1462,7 +1499,7 @@ function registerGetMemoryCardinality(server) {
       title: "Get Memory Cardinality",
       description: "Get memory counts: total active memories and per-project breakdown. Optionally filter by agent.",
       inputSchema: {
-        agent_id: z9.string().optional().describe("Filter to a specific agent (e.g. 'tom', 'exe')")
+        agent_id: z9.string().optional().describe("Filter to a specific agent (e.g. 'engineer', 'coordinator')")
       }
     },
     async ({ agent_id }) => {
@@ -1786,7 +1823,7 @@ async function handleSupersede(input) {
   }
   try {
     const { getClient: getClient2 } = await import("./lib/database.js");
-    const { getActiveAgent: getActiveAgent2 } = await import("./active-agent-EC6M7KTX.js");
+    const { getActiveAgent: getActiveAgent2 } = await import("./active-agent-PVGE57FY.js");
     const { writeMemory: writeMemory2, flushBatch: flushBatch2 } = await import("./lib/store.js");
     const { randomUUID: randomUUID2 } = await import("crypto");
     const client = getClient2();
@@ -1839,7 +1876,7 @@ New memory id: ${newId}`
 }
 async function handleResonanceQuery(input) {
   try {
-    const { getHotPairs, getCoActivationNeighbors } = await import("./co-activation-XMPHKGHR.js");
+    const { getHotPairs, getCoActivationNeighbors } = await import("./co-activation-ZCHPLLP6.js");
     const subAction = input.resonance_action ?? "hot_pairs";
     const limit = input.limit ?? 20;
     if (subAction === "hot_pairs") {
@@ -1867,7 +1904,7 @@ function registerMemory(server) {
       title: "Memory",
       description: "Consolidated memory domain tool. Actions: recall, ask_team, store, commit, search, session_context, get_by_id, consolidate, cardinality, supersede, decision_store, decision_get, resonance_query. Legacy memory tools remain available during migration.",
       inputSchema: {
-        action: z12.enum(["recall", "ask_team", "store", "commit", "search", "session_context", "consolidate", "cardinality", "supersede", "core_get", "core_set", "core_delete", "update_working_memory", "get_working_memory", "decision_store", "decision_get", "resonance_query"]).describe("Memory operation to perform. core_get/core_set/core_delete manage always-in-context key facts. update_working_memory/get_working_memory manage the runtime scratchpad. decision_store/decision_get manage authoritative decisions. resonance_query queries co-activation network."),
+        action: z12.enum(["recall", "ask_team", "store", "commit", "search", "session_context", "get_by_id", "consolidate", "cardinality", "supersede", "core_get", "core_set", "core_delete", "update_working_memory", "get_working_memory", "decision_store", "decision_get", "resonance_query"]).describe("Memory operation to perform. core_get/core_set/core_delete manage always-in-context key facts. update_working_memory/get_working_memory manage the runtime scratchpad. decision_store/decision_get manage authoritative decisions. resonance_query queries co-activation network."),
         query: z12.string().optional().describe("Search query. Also accepted as store text alias."),
         text: z12.string().optional().describe("Memory text for action=store"),
         summary: z12.string().optional().describe("High-importance summary for action=commit"),
@@ -1898,6 +1935,9 @@ function registerMemory(server) {
         session_id: z12.string().optional().describe("Session ID for action=session_context"),
         target_timestamp: z12.string().optional().describe("Center timestamp for action=session_context"),
         window_size: z12.number().optional().describe("Window size for action=session_context"),
+        id: z12.string().optional().describe("Memory UUID for action=get_by_id."),
+        max_chars: z12.coerce.number().int().min(100).max(5e4).optional().describe("Max characters per memory body for action=recall/session_context. Use higher values for long runbooks."),
+        body_chars: z12.coerce.number().int().min(100).max(5e4).optional().describe("Alias for max_chars for action=recall/session_context."),
         max_clusters: z12.coerce.number().optional().describe("Max clusters for action=consolidate"),
         model: z12.string().optional().describe("Model for action=consolidate"),
         agent_id: z12.string().optional().describe("Agent filter for action=cardinality"),
@@ -1934,9 +1974,9 @@ function registerMemory(server) {
         return handleResonanceQuery(input);
       }
       if (action === "update_working_memory" || action === "get_working_memory") {
-        const { getActiveAgent: getActiveAgent2 } = await import("./active-agent-EC6M7KTX.js");
+        const { getActiveAgent: getActiveAgent2 } = await import("./active-agent-PVGE57FY.js");
         const { agentId } = getActiveAgent2();
-        const { readWorkingMemoryWithMeta, writeWorkingMemory, WORKING_MEMORY_MAX_BYTES } = await import("./working-memory-PY4AG577.js");
+        const { readWorkingMemoryWithMeta, writeWorkingMemory, WORKING_MEMORY_MAX_BYTES } = await import("./working-memory-NUVB5SFV.js");
         if (action === "get_working_memory") {
           const wm = readWorkingMemoryWithMeta(agentId);
           if (!wm) {
@@ -1960,9 +2000,9 @@ function registerMemory(server) {
         }
       }
       if (action === "core_get" || action === "core_set" || action === "core_delete") {
-        const { getActiveAgent: getActiveAgent2 } = await import("./active-agent-EC6M7KTX.js");
+        const { getActiveAgent: getActiveAgent2 } = await import("./active-agent-PVGE57FY.js");
         const { agentId } = getActiveAgent2();
-        const { getCoreMemory, setCoreMemory, deleteCoreMemory, formatCoreMemoryBlock } = await import("./core-memory-VO5ZIBKH.js");
+        const { getCoreMemory, setCoreMemory, deleteCoreMemory, formatCoreMemoryBlock } = await import("./core-memory-GAC6EWOQ.js");
         if (action === "core_get") {
           const entries = await getCoreMemory(agentId);
           const block = formatCoreMemoryBlock(entries);
@@ -2014,12 +2054,12 @@ function registerMemory(server) {
           if (!storeTrigger || !storeTriggerAction) {
             return errorResult('memory action "store" with kind="reflex" requires trigger and trigger_action fields');
           }
-          const { formatReflexContent, storeReflexBehavior: storeReflexBehavior2 } = await import("./behaviors-HLZUJSMP.js");
+          const { formatReflexContent, storeReflexBehavior: storeReflexBehavior2 } = await import("./behaviors-KYRB3NGJ.js");
           const reflexText = formatReflexContent(storeTrigger, storeTriggerAction);
           legacyArgs.text ??= reflexText;
           legacyArgs.query ??= reflexText;
           try {
-            const { getActiveAgent: getActiveAgent2 } = await import("./active-agent-EC6M7KTX.js");
+            const { getActiveAgent: getActiveAgent2 } = await import("./active-agent-PVGE57FY.js");
             const { getProjectName: getProjectName2 } = await import("./project-name-EWG5KAZP.js");
             const agent = getActiveAgent2();
             const behaviorId = await storeReflexBehavior2({
@@ -2360,6 +2400,82 @@ function registerGetTask(server) {
 import { z as z15 } from "zod";
 var CLOSE_TASK_ALLOWED_ROLES = /* @__PURE__ */ new Set(["CTO"]);
 var CLOSEABLE_STATUSES = /* @__PURE__ */ new Set(["needs_review", "done"]);
+async function respawnAssigneeAfterClose(input) {
+  const { resolveExeSession: resolveExeSession2, employeeSessionName, ensureEmployee } = await import("./lib/tmux-routing.js");
+  const { shouldAutoInstance } = await import("./lib/employees.js");
+  const exeSession = input.taskScope ?? resolveExeSession2();
+  if (!exeSession) return { respawned: false, reason: "no coordinator session" };
+  if (!input.projectName) {
+    process.stderr.write(
+      `[close-task] respawn SKIPPED for ${input.assignee}: task has no project_name to resolve \u2014 never respawning into process.cwd().
+`
+    );
+    return { respawned: false, reason: "task has no project_name" };
+  }
+  const { resolveProjectDir: resolveProjectDir2 } = await import("./mcp/tools/create-task.js");
+  const projectDir = await resolveProjectDir2(input.projectName, exeSession);
+  if (!projectDir) {
+    process.stderr.write(
+      `[close-task] respawn SKIPPED for ${input.assignee}: could not resolve project dir for "${input.projectName}" in scope ${exeSession} \u2014 never respawning into process.cwd(). Manual nudge can follow.
+`
+    );
+    return { respawned: false, reason: "project dir unresolved" };
+  }
+  const oldSession = employeeSessionName(input.assignee, exeSession);
+  const { execSync } = await import("child_process");
+  try {
+    execSync(`tmux kill-session -t ${oldSession} 2>/dev/null`, { timeout: 3e3 });
+  } catch {
+  }
+  try {
+    const { cleanupAgentWorktree } = await import("./worktree-sweep-WTK3MTKH.js");
+    const { getGitRoot } = await import("./worktree-LL62PLQB.js");
+    const root = getGitRoot(projectDir);
+    if (root) {
+      const notes = await cleanupAgentWorktree(root, input.assignee);
+      if (notes) process.stderr.write(`[close-task] Deferred worktree cleanup: ${notes.replace(/\n/g, "; ")}
+`);
+    }
+  } catch {
+  }
+  if (!input.topTaskId) {
+    process.stderr.write(
+      `[close-task] Deferred respawn SKIPPED for ${input.assignee} \u2014 no open task id to gate the claim on; auto-wake will cover any orphan
+`
+    );
+    return { respawned: false, reason: "no open task id to gate the claim on" };
+  }
+  const { tryAcquireDispatchClaim, releaseDispatchClaim } = await import("./dispatch-ack-VYH3ONSS.js");
+  if (!tryAcquireDispatchClaim(input.topTaskId, input.assignee, exeSession)) {
+    process.stderr.write(
+      `[close-task] Deferred respawn DEDUPED for ${input.assignee} task ${input.topTaskId} \u2014 another dispatch is already in flight
+`
+    );
+    return { respawned: false, reason: "another dispatch holds the claim" };
+  }
+  let result3;
+  try {
+    result3 = ensureEmployee(input.assignee, exeSession, projectDir, shouldAutoInstance(input.assignee));
+  } catch (spawnErr) {
+    try {
+      releaseDispatchClaim(input.topTaskId, input.assignee, "respawn threw");
+    } catch {
+    }
+    throw spawnErr;
+  }
+  if (result3.status === "failed") {
+    try {
+      releaseDispatchClaim(input.topTaskId, input.assignee, result3.error ?? "respawn failed");
+    } catch {
+    }
+    return { respawned: false, reason: result3.error ?? "respawn failed", projectDir };
+  }
+  process.stderr.write(
+    `[close-task] Deferred respawn complete: ${result3.sessionName ?? "fresh instance"} in ${projectDir}
+`
+  );
+  return { respawned: true, projectDir };
+}
 function registerCloseTask(server) {
   server.registerTool(
     "close_task",
@@ -2375,7 +2491,7 @@ function registerCloseTask(server) {
     async ({ task_id, result: result3, status: status2 }) => {
       const agent = getActiveAgent();
       try {
-        const { StewardGate: StewardGate2 } = await import("./steward-gate-WT7WXQIE.js");
+        const { StewardGate: StewardGate2 } = await import("./steward-gate-3GQ5XKMJ.js");
         const steward = new StewardGate2();
         const gateDecision = await steward.checkAuthority(agent.agentId || "unknown", "close_task", task_id);
         if (!gateDecision.allowed) {
@@ -2556,8 +2672,8 @@ ${preflightWarnings.join("\n")}`;
       if (mergeNote) text5 += mergeNote;
       if (status2 === "closed" && assignee) {
         try {
-          const { cleanupAgentWorktree } = await import("./worktree-sweep-ZAG3V24E.js");
-          const { getGitRoot } = await import("./worktree-GVF2I5FP.js");
+          const { cleanupAgentWorktree } = await import("./worktree-sweep-WTK3MTKH.js");
+          const { getGitRoot } = await import("./worktree-LL62PLQB.js");
           const repoRoot = getGitRoot(baseDir);
           if (repoRoot) {
             const cleanupNotes = await cleanupAgentWorktree(repoRoot, assignee);
@@ -2585,6 +2701,16 @@ ${preflightWarnings.join("\n")}`;
             });
             const count = Number(remaining.rows[0]?.cnt ?? 0);
             if (count > 0) {
+              let topOpenTaskId;
+              try {
+                const topRes = await client.execute({
+                  sql: `SELECT id FROM tasks WHERE assigned_to = ? AND status = 'open' ${respawnScope.sql}
+                        ORDER BY CASE priority WHEN 'p0' THEN 0 WHEN 'p1' THEN 1 WHEN 'p2' THEN 2 ELSE 3 END, created_at ASC LIMIT 1`,
+                  args: [closedAssignee, ...respawnScope.args]
+                });
+                topOpenTaskId = topRes.rows[0]?.id != null ? String(topRes.rows[0].id) : void 0;
+              } catch {
+              }
               try {
                 const { isMultiInstance } = await import("./lib/employees.js");
                 if (isMultiInstance(closedAssignee)) {
@@ -2592,37 +2718,14 @@ ${preflightWarnings.join("\n")}`;
 
 \u{1F504} Auto-respawn: ${closedAssignee} has ${count} more task(s). Respawn scheduled (deferred to avoid MCP disruption).`;
                   const _assignee = closedAssignee;
-                  const _baseDir = baseDir;
-                  setTimeout(async () => {
-                    try {
-                      const { resolveExeSession: resolveExeSession2, employeeSessionName, ensureEmployee } = await import("./lib/tmux-routing.js");
-                      const { shouldAutoInstance } = await import("./lib/employees.js");
-                      const exeSession = resolveExeSession2();
-                      if (!exeSession) return;
-                      const oldSession = employeeSessionName(_assignee, exeSession);
-                      const { execSync } = await import("child_process");
-                      try {
-                        execSync(`tmux kill-session -t ${oldSession} 2>/dev/null`, { timeout: 3e3 });
-                      } catch {
-                      }
-                      try {
-                        const { cleanupAgentWorktree } = await import("./worktree-sweep-ZAG3V24E.js");
-                        const { getGitRoot } = await import("./worktree-GVF2I5FP.js");
-                        const root = getGitRoot(_baseDir);
-                        if (root) {
-                          const notes = await cleanupAgentWorktree(root, _assignee);
-                          if (notes) process.stderr.write(`[close-task] Deferred worktree cleanup: ${notes.replace(/\n/g, "; ")}
-`);
-                        }
-                      } catch {
-                      }
-                      const result4 = ensureEmployee(_assignee, exeSession, _baseDir, shouldAutoInstance(_assignee));
-                      process.stderr.write(`[close-task] Deferred respawn complete: ${result4.sessionName ?? "fresh instance"}
-`);
-                    } catch (e) {
-                      process.stderr.write(`[close-task] Deferred respawn failed: ${e instanceof Error ? e.message : String(e)}
-`);
-                    }
+                  const _topTaskId = topOpenTaskId ?? null;
+                  const _projectName = row.project_name != null ? String(row.project_name) : null;
+                  const _taskScope = sanitizeSessionScope(row.session_scope == null ? null : String(row.session_scope));
+                  setTimeout(() => {
+                    respawnAssigneeAfterClose({ assignee: _assignee, projectName: _projectName, taskScope: _taskScope, topTaskId: _topTaskId }).catch((e) => process.stderr.write(
+                      `[close-task] Deferred respawn failed: ${e instanceof Error ? e.message : String(e)}
+`
+                    ));
                   }, 500);
                 }
               } catch {
@@ -2696,6 +2799,7 @@ function registerCheckpointTask(server) {
 
 // src/mcp/tools/resume-employee.ts
 import { z as z17 } from "zod";
+import { homedir } from "os";
 var RESUME_CONTEXT_TASK_LIMIT = 10;
 function registerResumeEmployee(server) {
   server.registerTool(
@@ -2710,7 +2814,7 @@ function registerResumeEmployee(server) {
     },
     async ({ agent_id, project_name }) => {
       if (!isInitialized()) {
-        const { fastDbInit: fastDbInit2 } = await import("./fast-db-init-QQB6IVWV.js");
+        const { fastDbInit: fastDbInit2 } = await import("./fast-db-init-4CWHSOOR.js");
         await fastDbInit2();
       }
       const client = getClient();
@@ -2736,7 +2840,7 @@ function registerResumeEmployee(server) {
         };
       }
       try {
-        const { isTmuxSessionAlive } = await import("./tasks-crud-UGK5A25L.js");
+        const { isTmuxSessionAlive } = await import("./tasks-crud-HBDKE6C5.js");
         const now = (/* @__PURE__ */ new Date()).toISOString();
         for (const row of openTasks.rows) {
           const status2 = String(row.status);
@@ -2764,7 +2868,7 @@ function registerResumeEmployee(server) {
       }
       let checkpointInfo = "";
       try {
-        const { readLatestCheckpoint } = await import("./tasks-crud-UGK5A25L.js");
+        const { readLatestCheckpoint } = await import("./tasks-crud-HBDKE6C5.js");
         const checkpoint = await readLatestCheckpoint(agent_id);
         if (checkpoint) {
           const filesTouched = checkpoint.files_touched?.length > 0 ? checkpoint.files_touched.join(", ") : "none";
@@ -2781,9 +2885,18 @@ function registerResumeEmployee(server) {
         }
       } catch {
       }
+      let callerScope;
+      try {
+        const { getAgentContext: getAgentContext2 } = await import("./agent-context-AZTTMUHP.js");
+        const hint = getAgentContext2()?.sessionHint;
+        if (hint) callerScope = hint;
+      } catch {
+      }
+      if (!callerScope) callerScope = process.env.EXE_SESSION_NAME || process.env.EXE_SESSION || void 0;
+      const resumeProjectDir = await resolveProjectDir(project_name, callerScope);
       const { created, taskId } = await createOrRefreshResumeTask(
         agent_id,
-        process.cwd(),
+        resumeProjectDir ?? homedir(),
         openTasks.rows
       );
       if (checkpointInfo && taskId) {
@@ -2805,7 +2918,7 @@ function registerResumeEmployee(server) {
       }
       let dispatchStatus = "";
       try {
-        const { ensureEmployee, resolveExeSession: resolveExeSession2 } = await import("./lib/tmux-routing.js");
+        const { ensureEmployeeAsync, resolveExeSession: resolveExeSession2 } = await import("./lib/tmux-routing.js");
         let taskScope = null;
         if (taskId) {
           try {
@@ -2821,17 +2934,60 @@ function registerResumeEmployee(server) {
         }
         const exeSession = taskScope ?? resolveExeSession2();
         if (!exeSession) throw new Error("No coordinator session found");
+        if (!resumeProjectDir) {
+          throw new Error(
+            `could not resolve project dir for "${project_name}" within scope \u2014 RESUME task left for manual dispatch`
+          );
+        }
         process.stderr.write(
           `[resume_employee] dispatch lane=${exeSession} source=${taskScope ? "task.session_scope" : "caller.resolveExeSession (task has no scope)"} task=${taskId} agent=${agent_id}
 `
         );
         const { shouldAutoInstance } = await import("./lib/employees.js");
-        const result3 = ensureEmployee(agent_id, exeSession, process.cwd(), shouldAutoInstance(agent_id));
+        const { tryAcquireDispatchClaim, releaseDispatchClaim } = await import("./dispatch-ack-VYH3ONSS.js");
+        let claimedResume = false;
+        if (taskId) {
+          claimedResume = tryAcquireDispatchClaim(taskId, agent_id, exeSession);
+          if (!claimedResume) {
+            dispatchStatus = `
+Dispatched: deduped \u2014 another dispatch for task ${taskId} is already in flight`;
+            process.stderr.write(`[resume_employee] DEDUPED spawn for ${agent_id} task ${taskId} \u2014 a fresh dispatch is already in flight
+`);
+            throw new Error("dispatch deduped");
+          }
+        }
+        let result3;
+        try {
+          result3 = await ensureEmployeeAsync(
+            agent_id,
+            exeSession,
+            resumeProjectDir,
+            shouldAutoInstance(agent_id)
+          );
+        } catch (spawnErr) {
+          if (taskId && claimedResume) {
+            try {
+              releaseDispatchClaim(taskId, agent_id, "resume spawn threw");
+            } catch {
+            }
+          }
+          throw spawnErr;
+        }
+        if (result3.status === "failed" && taskId && claimedResume) {
+          try {
+            releaseDispatchClaim(taskId, agent_id, result3.error ?? "resume spawn failed");
+          } catch {
+          }
+        }
         switch (result3.status) {
           case "intercom_sent":
             dispatchStatus = `
 Dispatched: intercom sent to ${result3.sessionName}`;
             break;
+          case "intercom_unprocessed":
+            dispatchStatus = `
+Dispatched: intercom delivered to ${result3.sessionName}`;
+            break;
           case "spawned":
             dispatchStatus = `
 Dispatched: spawned ${result3.sessionName}`;
@@ -3115,6 +3271,8 @@ function registerTask(server) {
         budget_fallback_model: z19.string().optional().describe("Fallback model for action=create"),
         spawn_runtime: z19.string().optional().describe("Override runtime for spawned session (e.g., 'claude', 'codex', 'opencode') for action=create"),
         spawn_model: z19.string().optional().describe("Override model for spawned session (e.g., 'claude-sonnet-4.6') for action=create"),
+        idempotency_key: z19.string().optional().describe("Idempotency key for action=create (bug c06a8803): retrying with the SAME key returns the ORIGINAL task instead of creating a duplicate + duplicate spawn. Must be stable across the original call and its retry \u2014 no timestamp. Optional; omitted = no dedup."),
+        idempotency_window: z19.string().optional().describe("Optional nonce to DERIVE an idempotency key for action=create when idempotency_key is not given. Reuse the same window on a retry to dedup."),
         status: z19.enum(["open", "in_progress", "done", "needs_review", "blocked", "cancelled", "closed"]).optional().describe("Status for action=update/list/close"),
         result: z19.string().optional().describe("Result summary for action=update or action=close"),
         step: z19.string().optional().describe("Checkpoint step for action=checkpoint"),
@@ -3129,6 +3287,7 @@ function registerTask(server) {
         // Reminder params (absorbed from standalone reminder tool)
         text: z19.string().optional().describe("Reminder text for action=reminder_create"),
         due_date: z19.string().optional().describe("Optional due date \u2014 ISO date (2026-04-01) or null for persistent (reminder_create)"),
+        daily_push: z19.string().optional().describe('Optional daily push schedule for action=reminder_create \u2014 JSON {"hours":[9,18]} (0\u201323, founder timezone). A gateway channel pushes this reminder at those hours. Omit for a normal boot-brief-only reminder.'),
         reminder_id: z19.string().optional().describe("Reminder UUID or text substring to match (reminder_complete)"),
         include_completed: z19.boolean().optional().describe("Include completed reminders (reminder_list). Default: false.")
       }
@@ -3139,9 +3298,15 @@ function registerTask(server) {
         const args = input;
         const reminderText = args.text;
         if (!reminderText) return errorResult2('task action "reminder_create" requires text');
-        const reminder = await createReminder(reminderText, args.due_date);
+        let reminder;
+        try {
+          reminder = await createReminder(reminderText, args.due_date, args.daily_push);
+        } catch (err) {
+          return errorResult2(err instanceof Error ? err.message : String(err));
+        }
         const dueStr = reminder.dueDate ? ` (due: ${reminder.dueDate})` : "";
-        return { content: [{ type: "text", text: `Reminder set: "${reminder.text}"${dueStr}` }] };
+        const pushStr = reminder.dailyPush ? ` (daily push: ${reminder.dailyPush})` : "";
+        return { content: [{ type: "text", text: `Reminder set: "${reminder.text}"${dueStr}${pushStr}` }] };
       }
       if (action === "reminder_list") {
         const args = input;
@@ -3149,8 +3314,9 @@ function registerTask(server) {
         if (reminders.length === 0) return { content: [{ type: "text", text: "No active reminders." }] };
         const lines = reminders.map((r) => {
           const due = r.dueDate ? ` (due: ${r.dueDate})` : "";
+          const push = r.dailyPush ? ` (daily push: ${r.dailyPush})` : "";
           const done = r.completedAt ? " [DONE]" : "";
-          return `\u2022 ${r.text}${due}${done}  [id: ${r.id.slice(0, 8)}]`;
+          return `\u2022 ${r.text}${due}${push}${done}  [id: ${r.id.slice(0, 8)}]`;
         });
         return { content: [{ type: "text", text: lines.join("\n") }] };
       }
@@ -3166,7 +3332,7 @@ function registerTask(server) {
         const taskId = input.task_id;
         if (!taskId) return errorResult2("verify_dispatch requires task_id");
         try {
-          const { checkDispatchStatus } = await import("./dispatch-ack-4S44HBWB.js");
+          const { checkDispatchStatus } = await import("./dispatch-ack-VYH3ONSS.js");
           const result4 = checkDispatchStatus(taskId);
           return {
             content: [{ type: "text", text: JSON.stringify(result4, null, 2) }]
@@ -3180,7 +3346,7 @@ function registerTask(server) {
         const missing2 = missingRequiredFields2(args, REQUIRED_FIELDS2.create_group);
         if (missing2.length > 0) return errorResult2(`task action "create_group" missing required field(s): ${missing2.join(", ")}`);
         try {
-          const { createTaskGroup } = await import("./tasks-crud-UGK5A25L.js");
+          const { createTaskGroup } = await import("./tasks-crud-HBDKE6C5.js");
           const group = await createTaskGroup({
             title: args.title,
             coordinator: args.coordinator,
@@ -3199,7 +3365,7 @@ function registerTask(server) {
         const missing2 = missingRequiredFields2(args, REQUIRED_FIELDS2.group_status);
         if (missing2.length > 0) return errorResult2(`task action "group_status" missing required field(s): ${missing2.join(", ")}`);
         try {
-          const { getGroupStatus } = await import("./tasks-crud-UGK5A25L.js");
+          const { getGroupStatus } = await import("./tasks-crud-HBDKE6C5.js");
           const status2 = await getGroupStatus(args.group_id);
           return { content: [{ type: "text", text: JSON.stringify(status2, null, 2) }] };
         } catch (err) {
@@ -3211,7 +3377,7 @@ function registerTask(server) {
         const missing2 = missingRequiredFields2(args, REQUIRED_FIELDS2.group_results);
         if (missing2.length > 0) return errorResult2(`task action "group_results" missing required field(s): ${missing2.join(", ")}`);
         try {
-          const { getGroupResults } = await import("./tasks-crud-UGK5A25L.js");
+          const { getGroupResults } = await import("./tasks-crud-HBDKE6C5.js");
           const results = await getGroupResults(args.group_id);
           return { content: [{ type: "text", text: JSON.stringify(results, null, 2) }] };
         } catch (err) {
@@ -3462,7 +3628,7 @@ function registerMessage(server) {
       if (msgType && msgPayload) {
         try {
           const { buildTypedMessage, serializeMessage } = await import("./typed-messages-TKDGVPHS.js");
-          const { getActiveAgent: getActiveAgent2 } = await import("./active-agent-EC6M7KTX.js");
+          const { getActiveAgent: getActiveAgent2 } = await import("./active-agent-PVGE57FY.js");
           const { sendMessage } = await import("./lib/messaging.js");
           const { agentId } = getActiveAgent2();
           const envelope = buildTypedMessage({
@@ -3496,9 +3662,11 @@ ID: ${msg.id}`
     if (action === "read") {
       try {
         const { getPendingMessages } = await import("./lib/messaging.js");
-        const { getActiveAgent: getActiveAgent2 } = await import("./active-agent-EC6M7KTX.js");
+        const { getActiveAgent: getActiveAgent2 } = await import("./active-agent-PVGE57FY.js");
+        const { resolveExeSession: resolveExeSession2 } = await import("./lib/tmux-routing.js");
         const { agentId } = getActiveAgent2();
-        const messages = await getPendingMessages(agentId);
+        const callerScope = resolveExeSession2() ?? void 0;
+        const messages = await getPendingMessages(agentId, callerScope);
         if (messages.length === 0) {
           return {
             content: [{ type: "text", text: `No pending messages for ${agentId}.` }]
@@ -3859,8 +4027,8 @@ function registerIngestDocument(server) {
     },
     async (input) => {
       try {
-        const { assertFeature: assertFeature2 } = await import("./plan-limits-GRNBOBB3.js");
-        const { assertMemoryLimit: assertMemoryLimit2 } = await import("./plan-limits-GRNBOBB3.js");
+        const { assertFeature: assertFeature2 } = await import("./plan-limits-2FEY2GOS.js");
+        const { assertMemoryLimit: assertMemoryLimit2 } = await import("./plan-limits-2FEY2GOS.js");
         await assertFeature2("wiki");
         await assertMemoryLimit2();
         const result3 = await ingestDocument(input);
@@ -3931,8 +4099,8 @@ function registerPurgeDocument(server) {
     },
     async ({ document_id }) => {
       try {
-        const { StewardGate: StewardGate2 } = await import("./steward-gate-WT7WXQIE.js");
-        const { getActiveAgent: getActiveAgent2 } = await import("./active-agent-EC6M7KTX.js");
+        const { StewardGate: StewardGate2 } = await import("./steward-gate-3GQ5XKMJ.js");
+        const { getActiveAgent: getActiveAgent2 } = await import("./active-agent-PVGE57FY.js");
         const steward = new StewardGate2();
         const agent = getActiveAgent2();
         const gateDecision = await steward.checkAuthority(agent.agentId || "unknown", "purge_document", document_id);
@@ -4102,7 +4270,7 @@ function registerDocument(server) {
       const { action: _action, ...legacyArgs } = input;
       if (action === "list" && (legacyArgs.workspace_id === void 0 || legacyArgs.workspace_id === null || legacyArgs.workspace_id === "")) {
         try {
-          const { resolveDefaultWorkspaceId, listWorkspaces } = await import("./documents-FHIBU7KJ.js");
+          const { resolveDefaultWorkspaceId, listWorkspaces } = await import("./documents-23WX2FPQ.js");
           const defaultId = await resolveDefaultWorkspaceId();
           if (defaultId) {
             legacyArgs.workspace_id = defaultId;
@@ -4140,14 +4308,14 @@ ${lines.join("\n")}`
 
 // src/mcp/tools/gateway.ts
 import { z as z40 } from "zod";
-import { existsSync as existsSync2, readFileSync as readFileSync2, writeFileSync as writeFileSync3, mkdirSync } from "fs";
+import { chmodSync, existsSync as existsSync2, readFileSync as readFileSync2, writeFileSync as writeFileSync3, mkdirSync } from "fs";
 import { join as join2 } from "path";
-import { homedir as homedir2 } from "os";
+import { homedir as homedir3 } from "os";
 
 // src/mcp/tools/send-whatsapp.ts
 import { z as z33 } from "zod";
 import { existsSync, readFileSync } from "fs";
-import { homedir } from "os";
+import { homedir as homedir2 } from "os";
 import { join } from "path";
 var GRAPH_API_VERSION = "v21.0";
 var GRAPH_API_BASE = `https://graph.facebook.com/${GRAPH_API_VERSION}`;
@@ -4203,7 +4371,7 @@ function normalizeGatewaySendUrl(value) {
   return `${raw}/api/send`;
 }
 function loadGatewayJson() {
-  const configPath = process.env.EXE_GATEWAY_CONFIG?.trim() || process.env.EXE_GATEWAY_CONFIG_PATH?.trim() || join(homedir(), ".exe-os", "gateway.json");
+  const configPath = process.env.EXE_GATEWAY_CONFIG?.trim() || process.env.EXE_GATEWAY_CONFIG_PATH?.trim() || join(homedir2(), ".exe-os", "gateway.json");
   if (!existsSync(configPath)) return {};
   try {
     return JSON.parse(readFileSync(configPath, "utf8"));
@@ -4772,12 +4940,12 @@ async function validateGoTrueToken(token, gotrueUrl) {
 }
 async function getGoTrueUser(userId, gotrueUrl) {
   const url = gotrueUrl ?? process.env.GOTRUE_URL ?? process.env.EXE_GOTRUE_URL;
-  const adminToken2 = process.env.GOTRUE_ADMIN_TOKEN ?? process.env.EXE_GOTRUE_ADMIN_TOKEN;
-  if (!url || !adminToken2) return null;
+  const adminToken = process.env.GOTRUE_ADMIN_TOKEN ?? process.env.EXE_GOTRUE_ADMIN_TOKEN;
+  if (!url || !adminToken) return null;
   try {
     const res = await fetch(`${url}/admin/users/${userId}`, {
       headers: {
-        Authorization: `Bearer ${adminToken2}`,
+        Authorization: `Bearer ${adminToken}`,
         "Content-Type": "application/json"
       },
       signal: AbortSignal.timeout(GOTRUE_TIMEOUT_MS)
@@ -5129,7 +5297,7 @@ async function handleTrigger(limit) {
     if (rows.rows.length === 0) {
       return text3("No conversations found to re-process.");
     }
-    const { ingest } = await import("./pipeline-router-O6HU7DKH.js");
+    const { ingest } = await import("./pipeline-router-LM53NMWJ.js");
     const results = [];
     for (const row of rows.rows) {
       const r = row;
@@ -5221,7 +5389,7 @@ function registerPipeline(server) {
 }
 
 // src/mcp/tools/gateway.ts
-var GATEWAY_CONFIG_PATH = join2(homedir2(), ".exe-os", "gateway.json");
+var GATEWAY_CONFIG_PATH = join2(homedir3(), ".exe-os", "gateway.json");
 function okResult(text5) {
   return { content: [{ type: "text", text: text5 }] };
 }
@@ -5251,9 +5419,17 @@ function loadGatewayConfig() {
   return {};
 }
 function saveGatewayConfig(config) {
-  const dir = join2(homedir2(), ".exe-os");
-  mkdirSync(dir, { recursive: true });
-  writeFileSync3(GATEWAY_CONFIG_PATH, JSON.stringify(config, null, 2), "utf8");
+  const dir = join2(homedir3(), ".exe-os");
+  mkdirSync(dir, { recursive: true, mode: 448 });
+  try {
+    chmodSync(dir, 448);
+  } catch {
+  }
+  writeFileSync3(GATEWAY_CONFIG_PATH, JSON.stringify(config, null, 2), { encoding: "utf8", mode: 384 });
+  try {
+    chmodSync(GATEWAY_CONFIG_PATH, 384);
+  } catch {
+  }
 }
 function registerGateway(server) {
   const legacy = buildHandlers3();
@@ -5311,7 +5487,7 @@ function registerGateway(server) {
           'gateway action "configure_whatsapp" requires phone_number_id, access_token, and verify_token'
         );
       }
-      const { configureWhatsApp } = await import("./whatsapp-config-GOSELKTE.js");
+      const { configureWhatsApp } = await import("./whatsapp-config-FAX6EA5K.js");
       const result3 = await configureWhatsApp({
         phoneNumberId,
         accessToken,
@@ -5332,7 +5508,7 @@ Phone: ${result3.phoneDisplay ?? "verified"}
       );
     }
     if (action === "whatsapp_status") {
-      const { getWhatsAppStatus } = await import("./whatsapp-config-GOSELKTE.js");
+      const { getWhatsAppStatus } = await import("./whatsapp-config-FAX6EA5K.js");
       const status2 = getWhatsAppStatus();
       if (!status2.connected) {
         return okResult(
@@ -5371,6 +5547,7 @@ Accounts: ${status2.accounts}
       adapterConfig.accounts = accounts;
       config.adapters = adapters;
       saveGatewayConfig(config);
+      _resetCache();
       return okResult(
         `Account "${accountName}" added to ${accountPlatform} in gateway.json.
 Note: Restart the gateway process for changes to take effect.`
@@ -5399,6 +5576,7 @@ Note: Restart the gateway process for changes to take effect.`
       }
       config.adapters = adapters;
       saveGatewayConfig(config);
+      _resetCache();
       return okResult(
         `Account "${accountName}" removed from gateway.json.
 Note: Restart the gateway process for changes to take effect.`
@@ -5760,8 +5938,8 @@ function registerMergeEntities(server) {
     },
     async ({ source_name, source_type, target_name, target_type }) => {
       try {
-        const { StewardGate: StewardGate2 } = await import("./steward-gate-WT7WXQIE.js");
-        const { getActiveAgent: getActiveAgent2 } = await import("./active-agent-EC6M7KTX.js");
+        const { StewardGate: StewardGate2 } = await import("./steward-gate-3GQ5XKMJ.js");
+        const { getActiveAgent: getActiveAgent2 } = await import("./active-agent-PVGE57FY.js");
         const steward = new StewardGate2();
         const agent = getActiveAgent2();
         const gateDecision = await steward.checkAuthority(agent.agentId || "unknown", "merge_entities", `${source_name}\u2192${target_name}`);
@@ -5969,7 +6147,7 @@ async function handleExtractFromDocument(args) {
     return errorResult7('graph action "extract_from_document" requires document_id');
   }
   try {
-    const { extractGraphFromExistingDocument } = await import("./doc-graph-extractor-3TRLGD7M.js");
+    const { extractGraphFromExistingDocument } = await import("./doc-graph-extractor-F6ODFIID.js");
     const result3 = await extractGraphFromExistingDocument(documentId);
     const lines = [
       `## Graph Extraction for Document ${documentId}`,
@@ -5996,7 +6174,7 @@ async function handleCleanupGarbage(args) {
   const doMerge = !garbageOnly;
   let mod;
   try {
-    mod = await import("./cleanup-graph-garbage-KUABW6LS.js");
+    mod = await import("./cleanup-graph-garbage-XWUFAMFO.js");
   } catch (err) {
     return errorResult7(`cleanup_garbage: failed to load cleanup module \u2014 ${err instanceof Error ? err.message : String(err)}`);
   }
@@ -6150,7 +6328,7 @@ function registerSetAgentConfig(server) {
       inputSchema: {
         agent_id: z48.string().optional().describe("Agent name, or 'default' for org-wide default. Omit to view all agents."),
         runtime: z48.string().optional().describe(`Runtime: ${Object.keys(KNOWN_RUNTIMES).join(", ")}`),
-        model: z48.string().optional().describe("Model name (e.g. claude-opus-4, gpt-5.4, anthropic/claude-sonnet-4-6)"),
+        model: z48.string().optional().describe("Model name (e.g. claude-opus-4, gpt-5.5, anthropic/claude-sonnet-4-6). Codex model availability depends on auth type (ChatGPT account vs OpenAI API key); gpt-5.5 is the verified-usable Codex default."),
         reasoning_effort: z48.string().optional().describe("Codex reasoning effort: low, medium, high, xhigh. Per-agent override for thinking/reasoning depth."),
         mcps: z48.array(z48.string()).optional().describe("MCP server allowlist. Only these servers load for this agent. exe-os always included. Omit to load all MCPs.")
       }
@@ -6358,7 +6536,7 @@ function registerGetAgentSpend(server) {
       description: "Get per-agent token spend attribution. Shows input, output, and cache tokens consumed by each agent over a time period, with estimated cost.",
       inputSchema: {
         period: z50.enum(["24h", "7d", "30d"]).default("7d").describe("Time period to query"),
-        agent_id: z50.string().optional().describe("Filter to a specific agent (e.g. 'tom', 'yoshi')")
+        agent_id: z50.string().optional().describe("Filter to a specific agent (e.g. 'engineer', 'architect')")
       }
     },
     async ({ period, agent_id }) => {
@@ -6876,7 +7054,7 @@ async function getAgentSessionLoad() {
       return { sessions: [], totalLive: 0, busySessions: 0, idleSessions: 0 };
     }
     const { getClient: getClient2 } = await import("./lib/database.js");
-    const { sessionScopeFilter: sessionScopeFilter2 } = await import("./task-scope-CQEG5SSJ.js");
+    const { sessionScopeFilter: sessionScopeFilter2 } = await import("./task-scope-FOIW25HR.js");
     const client = getClient2();
     const scope = sessionScopeFilter2();
     for (const s of liveAgentSessions) {
@@ -6975,27 +7153,40 @@ function registerRunMemoryAudit(server) {
         agent_id: z57.string().optional().describe("Filter audit to a specific agent"),
         project_name: z57.string().optional().describe("Filter audit to a specific project"),
         fix: z57.boolean().optional().default(false).describe("Apply fixes: delete duplicates, chunk bloated records, rebuild FTS, archive shards"),
-        dry_run: z57.boolean().optional().default(false).describe("Preview fixes without applying them")
+        dry_run: z57.boolean().optional().default(false).describe("Preview fixes without applying them"),
+        bounded: z57.boolean().optional().default(true).describe("Cap expensive scans so large memory DBs return promptly. Set false for full CLI-equivalent audit."),
+        duplicate_group_limit: z57.number().int().positive().max(500).optional().describe("Bounded mode: maximum duplicate candidate buckets to inspect"),
+        duplicate_member_limit: z57.number().int().positive().max(1e4).optional().describe("Bounded mode: maximum rows to inspect inside each duplicate candidate bucket")
       }
     },
-    async ({ agent_id, project_name, fix, dry_run }) => {
+    async ({ agent_id, project_name, fix, dry_run, bounded, duplicate_group_limit, duplicate_member_limit }) => {
       try {
         const client = getClient();
         const shouldFix = fix === true;
         const isDryRun = dry_run === true;
+        const boundedAudit = bounded !== false;
         const flags = {
           fix: shouldFix,
           dryRun: isDryRun,
-          verbose: true,
+          verbose: !boundedAudit,
           conflicts: false,
           // O(n²) — opt-in only via CLI --conflicts
           restarts: false,
           // daemon restart report is a separate CLI mode
           agent: agent_id,
-          project: project_name
+          project: project_name,
+          bounded: boundedAudit,
+          duplicateGroupLimit: duplicate_group_limit,
+          duplicateMemberLimit: duplicate_member_limit,
+          deleteLocalSecretResidue: false
         };
         const report = await runAudit(client, flags);
         let formatted = formatReport(report, flags);
+        if (boundedAudit) {
+          formatted += `
+
+Bounded MCP mode: duplicate scan is capped (${duplicate_group_limit ?? 25} bucket(s), ${duplicate_member_limit ?? 250} row(s)/bucket). Set bounded=false for a full audit or run \`exe-os doctor --verbose\` locally.`;
+        }
         if (shouldFix || isDryRun) {
           const mode = isDryRun ? "[dry-run]" : "[fix]";
           const fixLog = [`
@@ -7003,7 +7194,7 @@ ${mode} Applying repairs...
 `];
           if (!isDryRun) {
             try {
-              const { createBackup: createBackup2 } = await import("./db-backup-DLD4QZBO.js");
+              const { createBackup: createBackup2 } = await import("./db-backup-W2QFSYQC.js");
               const backupPath = await createBackup2("pre-fix");
               if (backupPath) {
                 fixLog.push(`  Backup created: ${backupPath.split("/").pop()}`);
@@ -7242,7 +7433,7 @@ async function cloudStatusText() {
   if (lastReuploadedAt) lines.push(`- Last re-upload: ${lastReuploadedAt}`);
   lines.push("");
   try {
-    const { getRetrievalHealth: getRetrievalHealth2, formatDegradations: formatDegradations2 } = await import("./retrieval-health-TWHKYCRK.js");
+    const { getRetrievalHealth: getRetrievalHealth2, formatDegradations: formatDegradations2 } = await import("./retrieval-health-4Z242P3B.js");
     const h = await getRetrievalHealth2();
     lines.push(formatDegradations2(h.degradations, "Health / Degradations"));
     lines.push("");
@@ -8611,11 +8802,11 @@ async function sendSetPlan(payload) {
   }
   const config = await loadConfig();
   const routerUrl = process.env.API_ROUTER_URL?.replace(/\/+$/, "");
-  const endpoint2 = process.env.EXE_SET_CUSTOMER_PLAN_ENDPOINT || (routerUrl ? `${routerUrl}/admin/customer/plan` : "https://api.askexe.com/admin/customer/plan");
+  const endpoint = process.env.EXE_SET_CUSTOMER_PLAN_ENDPOINT || (routerUrl ? `${routerUrl}/admin/customer/plan` : "https://api.askexe.com/admin/customer/plan");
   const licenseKey = loadLicense() || process.env.EXE_LICENSE_KEY || config.cloud?.apiKey;
   const licenseToken = readCachedLicenseToken();
   try {
-    const parsed = new URL(endpoint2);
+    const parsed = new URL(endpoint);
     if (parsed.protocol !== "https:" && !["localhost", "127.0.0.1", "::1"].includes(parsed.hostname)) {
       return { status: "failed: insecure endpoint rejected" };
     }
@@ -8737,7 +8928,7 @@ function registerCreateTrigger(server) {
       }
     },
     async ({ name, event, conditions, actions, project, enabled, schedule, query }) => {
-      const { assertFeature: assertFeature2 } = await import("./plan-limits-GRNBOBB3.js");
+      const { assertFeature: assertFeature2 } = await import("./plan-limits-2FEY2GOS.js");
       const gatedActions = {
         send_whatsapp: "external_agents",
         update_wiki: "wiki"
@@ -9196,8 +9387,8 @@ ${err.message}`
 import { z as z72 } from "zod";
 import { readFileSync as readFileSync4, readdirSync as readdirSync3, statSync } from "fs";
 import path10 from "path";
-import { homedir as homedir3 } from "os";
-var SKILLS_DIR = path10.join(homedir3(), ".claude", "skills");
+import { homedir as homedir4 } from "os";
+var SKILLS_DIR = path10.join(homedir4(), ".claude", "skills");
 function listAvailableSkills() {
   try {
     const entries = readdirSync3(SKILLS_DIR);
@@ -9707,8 +9898,8 @@ function buildHandlers5() {
 }
 async function handleDreaming(action, args) {
   try {
-    const { DreamingEngine: DreamingEngine2 } = await import("./dreaming-OMFUEUCQ.js");
-    const { getActiveAgent: getActiveAgent2 } = await import("./active-agent-EC6M7KTX.js");
+    const { DreamingEngine: DreamingEngine2 } = await import("./dreaming-NWD22UQ5.js");
+    const { getActiveAgent: getActiveAgent2 } = await import("./active-agent-PVGE57FY.js");
     const { getClient: getClient2 } = await import("./lib/database.js");
     const agentId = args.agent_id ?? getActiveAgent2().agentId;
     if (action === "dreaming_run") {
@@ -9866,8 +10057,8 @@ function registerConfig(server) {
     }
     if (action === "closeout") {
       try {
-        const { DreamingEngine: DreamingEngine2 } = await import("./dreaming-OMFUEUCQ.js");
-        const { getActiveAgent: getActiveAgent2 } = await import("./active-agent-EC6M7KTX.js");
+        const { DreamingEngine: DreamingEngine2 } = await import("./dreaming-NWD22UQ5.js");
+        const { getActiveAgent: getActiveAgent2 } = await import("./active-agent-PVGE57FY.js");
         const { writeMemory: writeMemory2, flushBatch: flushBatch2 } = await import("./lib/store.js");
         const { randomUUID: randomUUID2 } = await import("crypto");
         const { getProjectName: getProjectName2 } = await import("./project-name-EWG5KAZP.js");
@@ -9938,7 +10129,7 @@ function registerConfig(server) {
     }
     if (action === "capability_cards") {
       try {
-        const { getAllCapabilityCards, findAgentForTask } = await import("./capability-cards-YOKVMMOL.js");
+        const { getAllCapabilityCards, findAgentForTask } = await import("./capability-cards-DN5UIKVN.js");
         const cards = getAllCapabilityCards();
         const taskQuery = args.query;
         if (taskQuery) {
@@ -9989,7 +10180,7 @@ function registerConfig(server) {
         const existing = loadEmployeesSync2();
         if (existing.some((e) => e.name === employeeName)) return errorResult8(`Employee "${employeeName}" already exists.`);
         try {
-          const { assertEmployeeLimit: assertEmployeeLimit2 } = await import("./plan-limits-GRNBOBB3.js");
+          const { assertEmployeeLimit: assertEmployeeLimit2 } = await import("./plan-limits-2FEY2GOS.js");
           await assertEmployeeLimit2();
         } catch (e) {
           return errorResult8(e instanceof Error ? e.message : "Employee limit reached.");
@@ -10030,7 +10221,7 @@ You are ${employeeName}. Role: ${role}.`, "utf-8");
         }
         try {
           const { generateSessionWrappers } = await import("./lib/session-wrappers.js");
-          const { resolvePackageRoot } = await import("./installer-MNPXDLGG.js");
+          const { resolvePackageRoot } = await import("./installer-L7EVH5U5.js");
           generateSessionWrappers(resolvePackageRoot());
         } catch {
         }
@@ -10117,7 +10308,7 @@ function registerListWikiPages(server) {
       }
     },
     async ({ workspace, folder }) => {
-      const { assertFeature: assertFeature2 } = await import("./plan-limits-GRNBOBB3.js");
+      const { assertFeature: assertFeature2 } = await import("./plan-limits-2FEY2GOS.js");
       await assertFeature2("wiki");
       const apiUrl = process.env.EXE_WIKI_API_URL;
       const apiKey = process.env.EXE_WIKI_API_KEY;
@@ -10217,7 +10408,7 @@ function registerGetWikiPage(server) {
       }
     },
     async ({ workspace, document_id, title }) => {
-      const { assertFeature: assertFeature2 } = await import("./plan-limits-GRNBOBB3.js");
+      const { assertFeature: assertFeature2 } = await import("./plan-limits-2FEY2GOS.js");
       await assertFeature2("wiki");
       const apiUrl = process.env.EXE_WIKI_API_URL;
       const apiKey = process.env.EXE_WIKI_API_KEY;
@@ -10411,10 +10602,10 @@ async function handleWikiSearch(input) {
   const userId = input.user_id;
   if (!workspace) return errorResult9('wiki action "search" requires workspace');
   if (!query) return errorResult9('wiki action "search" requires query');
-  const { assertFeature: assertFeature2 } = await import("./plan-limits-GRNBOBB3.js");
+  const { assertFeature: assertFeature2 } = await import("./plan-limits-2FEY2GOS.js");
   await assertFeature2("wiki");
   if (userId) {
-    const { checkWikiAccess } = await import("./wiki-acl-JA5UCQZ4.js");
+    const { checkWikiAccess } = await import("./wiki-acl-74BLWG6J.js");
     const { allowed } = await checkWikiAccess(String(userId), String(workspace), "read");
     if (!allowed) {
       return errorResult9(`Access denied: user "${userId}" does not have read access to workspace "${workspace}"`);
@@ -10517,7 +10708,7 @@ function registerWiki(server) {
         return errorResult9('wiki action "document_rerank" requires at least one candidate');
       }
       if (user_id && legacyArgs.workspace) {
-        const { checkWikiAccess } = await import("./wiki-acl-JA5UCQZ4.js");
+        const { checkWikiAccess } = await import("./wiki-acl-74BLWG6J.js");
         const { allowed } = await checkWikiAccess(
           String(user_id),
           String(legacyArgs.workspace),
@@ -10698,12 +10889,22 @@ ${lines.join("\n")}`
           };
         }
         const caller2 = getActiveAgent();
-        const roster = loadEmployeesSync();
+        const rosterState = loadEmployeesState();
+        const roster = rosterState.employees;
         const rawAgent = agent_id ?? caller2.agentId;
         const resolvedAgent = baseAgentName(rawAgent, roster);
         const callerBase = baseAgentName(caller2.agentId, roster);
         const isCrossAgentWrite = resolvedAgent !== callerBase;
         if (isCrossAgentWrite) {
+          if (rosterState.status === "error") {
+            return {
+              content: [{
+                type: "text",
+                text: `Permission denied: the employee roster is unreadable or corrupt, so the chain of command cannot be verified. Cross-agent behavior writes are blocked until the roster (exe-employees.json) is repaired.`
+              }],
+              isError: true
+            };
+          }
           const allowed2 = canManage(callerBase, caller2.agentRole, resolvedAgent, roster);
           if (!allowed2) {
             return {
@@ -10838,7 +11039,7 @@ Use /exe-forget to remove any that this supersedes.`;
                 }]
               };
             }
-            const { bulkPurgeGhostBehaviors } = await import("./behaviors-HLZUJSMP.js");
+            const { bulkPurgeGhostBehaviors } = await import("./behaviors-KYRB3NGJ.js");
             const res = await bulkPurgeGhostBehaviors({ batchSize: 5e3, vacuum: true });
             return {
               content: [{
@@ -10949,7 +11150,7 @@ Use /exe-forget to remove any that this supersedes.`;
           return { content: [{ type: "text", text: `Behavior not found: ${behavior_id}` }], isError: true };
         }
         const row2 = result4.rows[0];
-        const { reactivateBehavior: reactivateBehavior2 } = await import("./behaviors-HLZUJSMP.js");
+        const { reactivateBehavior: reactivateBehavior2 } = await import("./behaviors-KYRB3NGJ.js");
         const wasReactivated = await reactivateBehavior2(behavior_id);
         if (!wasReactivated) {
           return { content: [{ type: "text", text: `Behavior ${behavior_id} is already active.` }] };
@@ -11030,11 +11231,12 @@ function registerReminder(server) {
         action: z82.enum(["create", "list", "complete"]).describe("Action to perform"),
         text: z82.string().optional().describe("What to remind about (create)"),
         due_date: z82.string().optional().describe("Optional due date \u2014 ISO date (2026-04-01) or null for persistent (create)"),
+        daily_push: z82.string().optional().describe('Optional daily push schedule (create) \u2014 JSON {"hours":[9,18]} (0\u201323, founder timezone). A gateway channel pushes this reminder at those hours.'),
         reminder_id: z82.string().optional().describe("Reminder UUID or text substring to match (complete)"),
         include_completed: z82.boolean().optional().default(false).describe("Include completed reminders (list)")
       }
     },
-    async ({ action, text: text5, due_date, reminder_id, include_completed }) => {
+    async ({ action, text: text5, due_date, daily_push, reminder_id, include_completed }) => {
       if (action === "create") {
         if (!text5) {
           return {
@@ -11042,10 +11244,19 @@ function registerReminder(server) {
             isError: true
           };
         }
-        const reminder2 = await createReminder(text5, due_date);
+        let reminder2;
+        try {
+          reminder2 = await createReminder(text5, due_date, daily_push);
+        } catch (err) {
+          return {
+            content: [{ type: "text", text: err instanceof Error ? err.message : String(err) }],
+            isError: true
+          };
+        }
         const dueStr = reminder2.dueDate ? ` (due: ${reminder2.dueDate})` : "";
+        const pushStr = reminder2.dailyPush ? ` (daily push: ${reminder2.dailyPush})` : "";
         return {
-          content: [{ type: "text", text: `Reminder set: "${reminder2.text}"${dueStr}` }]
+          content: [{ type: "text", text: `Reminder set: "${reminder2.text}"${dueStr}${pushStr}` }]
         };
       }
       if (action === "list") {
@@ -11057,8 +11268,9 @@ function registerReminder(server) {
         }
         const lines = reminders.map((r) => {
           const due = r.dueDate ? ` (due: ${r.dueDate})` : "";
+          const push = r.dailyPush ? ` (daily push: ${r.dailyPush})` : "";
           const done = r.completedAt ? " [DONE]" : "";
-          return `\u2022 ${r.text}${due}${done}  [id: ${r.id.slice(0, 8)}]`;
+          return `\u2022 ${r.text}${due}${push}${done}  [id: ${r.id.slice(0, 8)}]`;
         });
         return {
           content: [{ type: "text", text: lines.join("\n") }]
@@ -11470,7 +11682,7 @@ function registerWorkflowTool(server) {
         getWorkflowInstance,
         listWorkflowInstances,
         approveWorkflowStep
-      } = await import("./workflow-engine-EWCOLD47.js");
+      } = await import("./workflow-engine-YITHXZR5.js");
       try {
         switch (input.action) {
           case "create_workflow": {
@@ -11595,7 +11807,6 @@ function formatInstanceStatus(inst, def) {
 // src/mcp/tools/create-bug-report.ts
 import { z as z88 } from "zod";
 import crypto4 from "crypto";
-import { mkdir as mkdir2, writeFile as writeFile2 } from "fs/promises";
 import path13 from "path";
 var CLASSIFICATION = z88.enum([
   "upstream_bug",
@@ -11650,7 +11861,12 @@ function buildMarkdown(input) {
 function prepareUpstreamPayload(payload) {
   const cleaned = { ...payload };
   delete cleaned.agent_role;
-  return { body: JSON.stringify(cleaned), contentType: "application/json", encrypted: false };
+  if (!isTelemetryRedactionEnabled()) {
+    console.error("[bug-report] WARNING: EXE_TELEMETRY_REDACT=off \u2014 sending UNREDACTED payload upstream");
+    return { body: JSON.stringify(cleaned), contentType: "application/json", encrypted: false, redactedCount: 0, truncatedCount: 0 };
+  }
+  const { payload: sanitized, redactedCount, truncatedCount } = sanitizeUpstreamPayload(cleaned);
+  return { body: JSON.stringify(sanitized), contentType: "application/json", encrypted: false, redactedCount, truncatedCount };
 }
 async function maybeSendUpstream(payload) {
   if (process.env.VITEST || process.env.NODE_ENV === "test") {
@@ -11658,19 +11874,19 @@ async function maybeSendUpstream(payload) {
   }
   const config = await loadConfig();
   const routerUrl = process.env.API_ROUTER_URL?.replace(/\/+$/, "");
-  const endpoint2 = config.support?.bugReportEndpoint || process.env.EXE_BUG_REPORT_ENDPOINT || (routerUrl ? `${routerUrl}/v1/support/bug-reports` : "https://api.askexe.com/v1/support/bug-reports");
+  const endpoint = config.support?.bugReportEndpoint || process.env.EXE_BUG_REPORT_ENDPOINT || (routerUrl ? `${routerUrl}/v1/support/bug-reports` : "https://api.askexe.com/v1/support/bug-reports");
   const token = config.support?.bugReportToken || process.env.EXE_BUG_REPORT_TOKEN;
   const licenseKey = loadLicense() || process.env.EXE_LICENSE_KEY || config.cloud?.apiKey;
   const licenseToken = readCachedLicenseToken();
-  if (!endpoint2) {
+  if (!endpoint) {
     return "not_configured";
   }
   try {
-    const parsed = new URL(endpoint2);
+    const parsed = new URL(endpoint);
     if (parsed.protocol !== "https:" && !["localhost", "127.0.0.1", "::1"].includes(parsed.hostname)) {
       return "failed: insecure endpoint rejected";
     }
-    const { body, contentType, encrypted } = prepareUpstreamPayload(payload);
+    const { body, contentType, encrypted, redactedCount, truncatedCount } = prepareUpstreamPayload(payload);
     const response = await fetch(parsed, {
       method: "POST",
       headers: {
@@ -11685,7 +11901,11 @@ async function maybeSendUpstream(payload) {
       signal: AbortSignal.timeout(1e4)
     });
     if (!response.ok) return `failed: HTTP ${response.status}`;
-    return encrypted ? "sent (encrypted)" : "sent (redacted)";
+    if (encrypted) return "sent (encrypted)";
+    const parts = ["sanitized"];
+    if (redactedCount > 0) parts.push(`${redactedCount} secret${redactedCount === 1 ? "" : "s"} redacted`);
+    if (truncatedCount > 0) parts.push(`${truncatedCount} field${truncatedCount === 1 ? "" : "s"} truncated`);
+    return `sent (${parts.join(", ")})`;
   } catch (err) {
     return `failed: ${err instanceof Error ? err.message : String(err)}`;
   }
@@ -11710,7 +11930,7 @@ function registerCreateBugReport(server) {
         files_changed: z88.array(z88.string()).optional().describe("Files changed or suspected"),
         workaround: z88.string().optional().describe("Temporary local workaround/hotfix, if any"),
         local_patch_diff: z88.string().optional().describe("Small local diff or patch summary"),
-        product: z88.string().optional().describe("Product this bug is for: exe-os, exe-create, exe-wiki, exe-gateway, exe-crm, exe-build. Defaults to exe-os."),
+        product: supportProductSchema.optional().describe("Product this bug is for: exe-os, exe-create, exe-wiki, exe-gateway, exe-crm, exe-build. Defaults to exe-os."),
         package_version: z88.string().optional().describe("Installed package version"),
         project_name: z88.string().optional().describe("Project/customer context"),
         implementing_branch: z88.string().optional().describe("Branch name or PR URL that implements/fixes this bug. Recorded on the report so future work can find existing fixes instead of redoing them (bug e324f244)."),
@@ -11722,6 +11942,7 @@ function registerCreateBugReport(server) {
         on_behalf_of_email: z88.string().email().optional().describe("ADMIN ONLY: file this request owned by another customer's license email; ignored unless caller holds the support admin token")
       }
     },
+    // Structural sink guard (round 6): deep-redact the whole return object + errors.
     async ({
       title,
       classification,
@@ -11741,7 +11962,7 @@ function registerCreateBugReport(server) {
       attachments,
       send_upstream,
       on_behalf_of_email
-    }) => {
+    }) => redactedToolResult(async () => {
       if (!summary || summary.trim().length === 0) {
         return {
           content: [{
@@ -11754,10 +11975,10 @@ function registerCreateBugReport(server) {
       const { agentId, agentRole } = getActiveAgent();
       const id = crypto4.randomUUID();
       const resolvedProduct = product ?? "exe-os";
-      const version = package_version ?? "unknown";
+      const version = sanitizeVersionField(package_version) ?? "unknown";
       let metricsSnapshot = "";
       try {
-        const { getOrchestrationMetrics, formatOrchestrationMetrics } = await import("./orchestration-events-5SIJOE4H.js");
+        const { getOrchestrationMetrics, formatOrchestrationMetrics } = await import("./orchestration-events-WV4NWKZH.js");
         const sinceIso = new Date(Date.now() - 60 * 60 * 1e3).toISOString();
         const metrics = await getOrchestrationMetrics({ sinceIso });
         if (metrics.totalEvents > 0) {
@@ -11803,51 +12024,41 @@ ${formatOrchestrationMetrics(metrics)}
       }
       const fullMarkdown = markdown + metricsSnapshot + attachmentSection;
       const outDir = path13.join(EXE_AI_DIR, "bug-reports");
-      await mkdir2(outDir, { recursive: true });
-      const reportPath = path13.join(outDir, `${(/* @__PURE__ */ new Date()).toISOString().slice(0, 10)}-${slugify(title)}-${id.slice(0, 8)}.md`);
-      await writeFile2(reportPath, fullMarkdown, "utf-8");
-      if (attachments && attachments.length > 0) {
-        const attachDir = path13.join(outDir, `${id.slice(0, 8)}-attachments`);
-        await mkdir2(attachDir, { recursive: true });
-        for (const att of attachments) {
-          const safeName = att.filename.replace(/[/\\]/g, "_").replace(/\.\./g, "_");
-          const attPath = path13.join(attachDir, safeName);
-          await writeFile2(attPath, att.content, "utf-8");
-          savedAttachmentPaths.push(attPath);
+      const reportPath = path13.join(outDir, `${(/* @__PURE__ */ new Date()).toISOString().slice(0, 10)}-${slugify(redactSecrets(title).text)}-${id.slice(0, 8)}.md`);
+      const attachDir = path13.join(outDir, `${id.slice(0, 8)}-attachments`);
+      const persistAttachments = (attachments ?? []).map((att) => ({
+        // Sanitize filename — redact secrets first (F6: filename lands on disk),
+        // then strip path separators to prevent directory traversal.
+        path: path13.join(attachDir, redactSecrets(att.filename).text.replace(/[/\\]/g, "_").replace(/\.\./g, "_")),
+        content: att.content
+      }));
+      const persisted = await persistSupportArtifact({
+        memoryText: fullMarkdown,
+        file: { path: reportPath, content: fullMarkdown },
+        attachments: persistAttachments,
+        memory: {
+          id,
+          agent_id: agentId,
+          agent_role: agentRole,
+          session_id: process.env.SESSION_ID ?? "manual",
+          timestamp: (/* @__PURE__ */ new Date()).toISOString(),
+          tool_name: "create_bug_report",
+          project_name: project_name ?? "support",
+          has_error: classification === "upstream_bug" || classification === "emergency_hotfix",
+          source_path: reportPath,
+          source_type: "bug_report",
+          memory_type: "bug_report",
+          tier: 1,
+          importance: severity === "p0" ? 10 : severity === "p1" ? 9 : 7,
+          intent: "report",
+          domain: "support",
+          file_paths: files_changed ? JSON.stringify(files_changed) : null
         }
-      }
-      let vector = null;
-      try {
-        vector = await embed(fullMarkdown);
-      } catch {
-        vector = null;
-      }
-      await writeMemory({
-        id,
-        agent_id: agentId,
-        agent_role: agentRole,
-        session_id: process.env.SESSION_ID ?? "manual",
-        timestamp: (/* @__PURE__ */ new Date()).toISOString(),
-        tool_name: "create_bug_report",
-        project_name: project_name ?? "support",
-        has_error: classification === "upstream_bug" || classification === "emergency_hotfix",
-        raw_text: fullMarkdown,
-        vector,
-        source_path: reportPath,
-        source_type: "bug_report",
-        memory_type: "bug_report",
-        tier: 1,
-        importance: severity === "p0" ? 10 : severity === "p1" ? 9 : 7,
-        intent: "report",
-        domain: "support",
-        file_paths: files_changed ? JSON.stringify(files_changed) : null
       });
-      await flushBatch();
-      const UPSTREAM_ATTACHMENT_MAX_CHARS = 4096;
+      savedAttachmentPaths.push(...persisted.attachmentPaths);
       const upstreamAttachments = attachments?.map((att) => ({
         filename: att.filename,
-        content: att.content.length > UPSTREAM_ATTACHMENT_MAX_CHARS ? att.content.slice(0, UPSTREAM_ATTACHMENT_MAX_CHARS) + `
-... [truncated, ${att.content.length} chars total]` : att.content,
+        content: att.content,
         truncated: att.content.length > UPSTREAM_ATTACHMENT_MAX_CHARS,
         original_size: att.content.length
       }));
@@ -11893,14 +12104,13 @@ Upstream status: ${upstreamStatus}`
           }
         ]
       };
-    }
+    })
   );
 }
 
 // src/mcp/tools/create-feature-request.ts
 import { z as z89 } from "zod";
 import crypto5 from "crypto";
-import { mkdir as mkdir3, writeFile as writeFile3 } from "fs/promises";
 import path14 from "path";
 var CATEGORY = z89.enum([
   "upstream_feature",
@@ -11945,18 +12155,30 @@ async function maybeSendUpstream2(payload) {
   }
   const config = await loadConfig();
   const routerUrl = process.env.API_ROUTER_URL?.replace(/\/+$/, "");
-  const endpoint2 = config.support?.featureRequestEndpoint || process.env.EXE_FEATURE_REQUEST_ENDPOINT || (routerUrl ? `${routerUrl}/v1/support/feature-requests` : "https://api.askexe.com/v1/support/feature-requests");
+  const endpoint = config.support?.featureRequestEndpoint || process.env.EXE_FEATURE_REQUEST_ENDPOINT || (routerUrl ? `${routerUrl}/v1/support/feature-requests` : "https://api.askexe.com/v1/support/feature-requests");
   const token = config.support?.featureRequestToken || process.env.EXE_FEATURE_REQUEST_TOKEN;
   const licenseKey = loadLicense() || process.env.EXE_LICENSE_KEY || config.cloud?.apiKey;
   const licenseToken = readCachedLicenseToken();
-  if (!endpoint2) {
+  if (!endpoint) {
     return "not_configured";
   }
   try {
-    const parsed = new URL(endpoint2);
+    const parsed = new URL(endpoint);
     if (parsed.protocol !== "https:" && !["localhost", "127.0.0.1", "::1"].includes(parsed.hostname)) {
       return "failed: insecure endpoint rejected";
     }
+    let outboundBody;
+    let redactedCount = 0;
+    let truncatedCount = 0;
+    if (isTelemetryRedactionEnabled()) {
+      const sanitized = sanitizeUpstreamPayload(payload);
+      outboundBody = JSON.stringify(sanitized.payload);
+      redactedCount = sanitized.redactedCount;
+      truncatedCount = sanitized.truncatedCount;
+    } else {
+      console.error("[feature-request] WARNING: EXE_TELEMETRY_REDACT=off \u2014 sending UNREDACTED payload upstream");
+      outboundBody = JSON.stringify(payload);
+    }
     const response = await fetch(parsed, {
       method: "POST",
       headers: {
@@ -11966,11 +12188,14 @@ async function maybeSendUpstream2(payload) {
         ...licenseToken ? { "x-exe-license-token": licenseToken } : {},
         ...supportAdminHeaders(config)
       },
-      body: JSON.stringify(payload),
+      body: outboundBody,
       signal: AbortSignal.timeout(1e4)
     });
     if (!response.ok) return `failed: HTTP ${response.status}`;
-    return "sent";
+    const parts = ["sanitized"];
+    if (redactedCount > 0) parts.push(`${redactedCount} secret${redactedCount === 1 ? "" : "s"} redacted`);
+    if (truncatedCount > 0) parts.push(`${truncatedCount} field${truncatedCount === 1 ? "" : "s"} truncated`);
+    return `sent (${parts.join(", ")})`;
   } catch (err) {
     return `failed: ${err instanceof Error ? err.message : String(err)}`;
   }
@@ -11992,7 +12217,7 @@ function registerCreateFeatureRequest(server) {
         current_workaround: z89.string().optional().describe("How the need is currently addressed, if at all"),
         proposed_solution: z89.string().optional().describe("Suggested implementation approach"),
         business_impact: z89.string().optional().describe("Impact on business/workflow if this ships"),
-        product: z89.string().optional().describe("Product this feature is for: exe-os, exe-create, exe-wiki, exe-gateway, exe-crm, exe-build. Defaults to exe-os."),
+        product: supportProductSchema.optional().describe("Product this feature is for: exe-os, exe-create, exe-wiki, exe-gateway, exe-crm, exe-build. Defaults to exe-os."),
         package_version: z89.string().optional().describe("Installed package version"),
         project_name: z89.string().optional().describe("Project/customer context"),
         implementing_branch: z89.string().optional().describe("Branch name or PR URL that implements this feature. Recorded on the request so future work can find existing implementations instead of redoing them (bug e324f244)."),
@@ -12004,6 +12229,7 @@ function registerCreateFeatureRequest(server) {
         on_behalf_of_email: z89.string().email().optional().describe("ADMIN ONLY: file this request owned by another customer's license email; ignored unless caller holds the support admin token")
       }
     },
+    // Structural sink guard (round 6): deep-redact the whole return object + errors.
     async ({
       title,
       category,
@@ -12020,11 +12246,11 @@ function registerCreateFeatureRequest(server) {
       attachments,
       send_upstream,
       on_behalf_of_email
-    }) => {
+    }) => redactedToolResult(async () => {
       const { agentId, agentRole } = getActiveAgent();
       const id = crypto5.randomUUID();
       const resolvedProduct = product ?? "exe-os";
-      const version = package_version ?? "unknown";
+      const version = sanitizeVersionField(package_version) ?? "unknown";
       const markdownBase = buildMarkdown2({
         id,
         title,
@@ -12054,51 +12280,40 @@ function registerCreateFeatureRequest(server) {
       }
       const markdown = markdownBase + attachmentSection;
       const outDir = path14.join(EXE_AI_DIR, "feature-requests");
-      await mkdir3(outDir, { recursive: true });
-      const reportPath = path14.join(outDir, `${(/* @__PURE__ */ new Date()).toISOString().slice(0, 10)}-${slugify2(title)}-${id.slice(0, 8)}.md`);
-      await writeFile3(reportPath, markdown, "utf-8");
-      if (attachments && attachments.length > 0) {
-        const attachDir = path14.join(outDir, `${id.slice(0, 8)}-attachments`);
-        await mkdir3(attachDir, { recursive: true });
-        for (const att of attachments) {
-          const safeName = att.filename.replace(/[/\\]/g, "_").replace(/\.\./g, "_");
-          const attPath = path14.join(attachDir, safeName);
-          await writeFile3(attPath, att.content, "utf-8");
-          savedAttachmentPaths.push(attPath);
+      const reportPath = path14.join(outDir, `${(/* @__PURE__ */ new Date()).toISOString().slice(0, 10)}-${slugify2(redactSecrets(title).text)}-${id.slice(0, 8)}.md`);
+      const attachDir = path14.join(outDir, `${id.slice(0, 8)}-attachments`);
+      const persistAttachments = (attachments ?? []).map((att) => ({
+        // F6: redact secrets from the filename before it lands on disk.
+        path: path14.join(attachDir, redactSecrets(att.filename).text.replace(/[/\\]/g, "_").replace(/\.\./g, "_")),
+        content: att.content
+      }));
+      const persisted = await persistSupportArtifact({
+        memoryText: markdown,
+        file: { path: reportPath, content: markdown },
+        attachments: persistAttachments,
+        memory: {
+          id,
+          agent_id: agentId,
+          agent_role: agentRole,
+          session_id: process.env.SESSION_ID ?? "manual",
+          timestamp: (/* @__PURE__ */ new Date()).toISOString(),
+          tool_name: "create_feature_request",
+          project_name: project_name ?? "support",
+          has_error: false,
+          source_path: reportPath,
+          source_type: "feature_request",
+          memory_type: "feature_request",
+          tier: 1,
+          importance: priority === "p0" ? 10 : priority === "p1" ? 9 : priority === "p2" ? 7 : 5,
+          intent: "request",
+          domain: "support",
+          file_paths: null
         }
-      }
-      let vector = null;
-      try {
-        vector = await embed(markdown);
-      } catch {
-        vector = null;
-      }
-      await writeMemory({
-        id,
-        agent_id: agentId,
-        agent_role: agentRole,
-        session_id: process.env.SESSION_ID ?? "manual",
-        timestamp: (/* @__PURE__ */ new Date()).toISOString(),
-        tool_name: "create_feature_request",
-        project_name: project_name ?? "support",
-        has_error: false,
-        raw_text: markdown,
-        vector,
-        source_path: reportPath,
-        source_type: "feature_request",
-        memory_type: "feature_request",
-        tier: 1,
-        importance: priority === "p0" ? 10 : priority === "p1" ? 9 : priority === "p2" ? 7 : 5,
-        intent: "request",
-        domain: "support",
-        file_paths: null
       });
-      await flushBatch();
-      const UPSTREAM_ATTACHMENT_MAX_CHARS = 4096;
+      savedAttachmentPaths.push(...persisted.attachmentPaths);
       const upstreamAttachments = attachments?.map((att) => ({
         filename: att.filename,
-        content: att.content.length > UPSTREAM_ATTACHMENT_MAX_CHARS ? att.content.slice(0, UPSTREAM_ATTACHMENT_MAX_CHARS) + `
-... [truncated, ${att.content.length} chars total]` : att.content,
+        content: att.content,
         truncated: att.content.length > UPSTREAM_ATTACHMENT_MAX_CHARS,
         original_size: att.content.length
       }));
@@ -12152,13 +12367,13 @@ Upstream status: ${upstreamStatus}`
           }
         ]
       };
-    }
+    })
   );
 }
 
 // src/mcp/tools/update-bug-report.ts
 import { z as z90 } from "zod";
-import { readdir, readFile as readFile2, writeFile as writeFile4 } from "fs/promises";
+import { readdir, readFile as readFile2 } from "fs/promises";
 import path15 from "path";
 var STATUS = z90.enum(["open", "triaged", "fixed", "closed", "wontfix"]);
 var UUID_RE = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/;
@@ -12208,8 +12423,13 @@ async function findReportFile(id) {
   }
   return null;
 }
-async function appendUpdateSection(filePath, opts) {
-  const existing = await readFile2(filePath, "utf-8");
+async function buildUpdateSection(filePath, opts) {
+  let existing = "";
+  try {
+    existing = await readFile2(filePath, "utf-8");
+  } catch {
+    existing = "";
+  }
   const heading = opts.reopen ? "Reopen Request" : "Status Update";
   const updateBlock = [
     "",
@@ -12221,37 +12441,39 @@ async function appendUpdateSection(filePath, opts) {
     ...opts.evidence ? [``, `Evidence: ${opts.evidence}`] : []
   ].join("\n");
   const titleMatch = existing.match(/^# Bug Report — (.+)$/m);
-  await writeFile4(filePath, existing + updateBlock, "utf-8");
-  return titleMatch?.[1] ?? "Unknown bug";
+  return { title: titleMatch?.[1] ?? "Unknown bug", updateBlock };
 }
 async function sendUpstream(payload, isAdmin) {
   const config = await loadConfig();
   const routerUrl = process.env.API_ROUTER_URL?.replace(/\/+$/, "");
-  const adminToken2 = resolveSupportAdminToken(config);
+  const adminToken = resolveSupportAdminToken(config);
   const support = config.support;
-  const baseEndpoint = isAdmin && adminToken2 ? process.env.ASKEXE_SUPPORT_ADMIN_ENDPOINT || support?.adminEndpoint || support?.admin_endpoint || "https://api.askexe.com/admin/support/bug-reports" : config.support?.bugReportEndpoint || process.env.EXE_BUG_REPORT_ENDPOINT || (routerUrl ? `${routerUrl}/v1/support/bug-reports` : "https://api.askexe.com/v1/support/bug-reports");
+  const baseEndpoint = isAdmin && adminToken ? process.env.ASKEXE_SUPPORT_ADMIN_ENDPOINT || support?.adminEndpoint || support?.admin_endpoint || "https://api.askexe.com/admin/support/bug-reports" : config.support?.bugReportEndpoint || process.env.EXE_BUG_REPORT_ENDPOINT || (routerUrl ? `${routerUrl}/v1/support/bug-reports` : "https://api.askexe.com/v1/support/bug-reports");
   const licenseKey = loadLicense() || process.env.EXE_LICENSE_KEY || config.cloud?.apiKey;
   const licenseToken = readCachedLicenseToken();
   if (!baseEndpoint) return "not_configured";
   try {
     const base = baseEndpoint.replace(/\/+$/, "");
-    const url = `${base}/${encodeURIComponent(payload.id)}`;
+    const url = `${base}/${encodeURIComponent(sanitizeUpstreamId(payload.id))}`;
     const parsed = new URL(url);
     if (parsed.protocol !== "https:" && !["localhost", "127.0.0.1", "::1"].includes(parsed.hostname)) {
       return "failed: insecure endpoint rejected";
     }
-    const adminHeaders = isAdmin && adminToken2 ? { authorization: `Bearer ${adminToken2}`, ...supportAdminHeaders(config) } : {};
+    const adminHeaders = isAdmin && adminToken ? { authorization: `Bearer ${adminToken}`, ...supportAdminHeaders(config) } : {};
     const response = await fetch(parsed, {
       method: "PATCH",
       headers: {
         "content-type": "application/json",
-        ...isAdmin && adminToken2 ? {} : {
+        ...isAdmin && adminToken ? {} : {
           ...licenseKey ? { "x-exe-license-key": licenseKey, authorization: `Bearer ${licenseKey}` } : {},
           ...licenseToken ? { "x-exe-license-token": licenseToken } : {}
         },
         ...adminHeaders
       },
-      body: JSON.stringify(payload),
+      // Egress redaction gate (dc16fee4) — add_evidence ("logs, repro details,
+      // stack traces"), add_note, and triage_notes are the most secret-dense
+      // support fields; redact before the network send.
+      body: sanitizedUpstreamBody(payload, "update-bug-report"),
       signal: AbortSignal.timeout(1e4)
     });
     if (!response.ok) return `failed: HTTP ${response.status}`;
@@ -12267,12 +12489,12 @@ function registerUpdateBugReport(server) {
       title: "Update Bug Report",
       description: "Update a previously filed bug report. As the filing customer (owner) you can add follow-up notes (notes/add_note), attach additional evidence (add_evidence), and request a reopen on a recurring fixed bug (reopen_request). AskExe support (with an admin token) can also move status: open \u2192 triaged \u2192 fixed \u2192 closed (or wontfix). Updates the local file, POSTs the change to AskExe support, and stores a memory.",
       inputSchema: {
-        id: z90.string().min(8).describe("Bug report UUID (full or 8-char prefix)"),
+        id: supportIdSchema.describe("Bug report UUID (full or 8-char prefix)"),
         status: STATUS.optional().describe(
           "New status (admin only): open, triaged, fixed, closed, wontfix. Owners cannot set this \u2014 use reopen_request instead."
         ),
-        fix_version: z90.string().optional().describe("Version that fixes this bug (admin only, e.g. '0.9.161')"),
-        product: z90.string().optional().describe("Re-label this bug's product (admin only): exe-os, exe-create, exe-wiki, exe-gateway, exe-crm, exe-build, exe-chat, exe-auth, exe-monitor, exe-db, exe-erp"),
+        fix_version: supportVersionSchema.optional().describe("Version that fixes this bug (admin only, e.g. '0.9.161')"),
+        product: supportProductSchema.optional().describe("Re-label this bug's product (admin only): exe-os, exe-create, exe-wiki, exe-gateway, exe-crm, exe-build, exe-chat, exe-auth, exe-monitor, exe-db, exe-erp"),
         notes: z90.string().optional().describe("Follow-up notes about the bug or status change"),
         add_note: z90.string().optional().describe("Owner follow-up note (alias of notes)"),
         add_evidence: z90.string().optional().describe("Additional evidence: logs, repro details, stack traces"),
@@ -12281,7 +12503,7 @@ function registerUpdateBugReport(server) {
         send_upstream: z90.boolean().default(true).describe("POST the change to AskExe support endpoint")
       }
     },
-    async ({ id, status: status2, fix_version, product, notes, add_note, add_evidence, reopen_request, reopen_reason, send_upstream }) => {
+    async ({ id, status: status2, fix_version, product, notes, add_note, add_evidence, reopen_request, reopen_reason, send_upstream }) => redactedToolResult(async () => {
       const { agentId, agentRole } = getActiveAgent();
       const config = await loadConfig();
       const isAdmin = !!resolveSupportAdminToken(config);
@@ -12307,67 +12529,69 @@ These do not match \u2014 not updating to avoid mutating the wrong bug. Verify t
       }
       const fullId = resolved?.fullId ?? id;
       let localTitle = "Unknown bug";
+      let updateBlock = null;
       if (localFile) {
         try {
-          localTitle = await appendUpdateSection(localFile, {
+          const built = await buildUpdateSection(localFile, {
             status: reopen ? "open" : status2,
             notes: followUpNote,
             fixVersion: fix_version,
             evidence: add_evidence,
             reopen
           });
+          localTitle = built.title;
+          updateBlock = built.updateBlock;
         } catch {
         }
       }
       const changeParts = [];
       if (reopen) changeParts.push("reopen requested");
       else if (status2) changeParts.push(`marked ${status2}`);
-      if (fix_version) changeParts.push(`fix v${fix_version}`);
+      if (fix_version) changeParts.push(`fix v ${fix_version}`);
       if (product) changeParts.push(`product \u2192 ${product}`);
       if (add_evidence) changeParts.push("evidence added");
       if (followUpNote && !reopen && !status2) changeParts.push("note added");
       const change = changeParts.length > 0 ? changeParts.join(", ") : "updated";
       const memoryText = `Bug "${localTitle}" (${fullId.slice(0, 8)}) ${change}` + (reopen_reason ? `. Reopen reason: ${reopen_reason}` : "") + (followUpNote ? `. Notes: ${followUpNote}` : "");
-      let vector = null;
-      try {
-        vector = await embed(memoryText);
-      } catch {
-        vector = null;
-      }
       const memoryId = `${fullId}-update-${Date.now()}`;
-      await writeMemory({
-        id: memoryId,
-        agent_id: agentId,
-        agent_role: agentRole,
-        session_id: process.env.SESSION_ID ?? "manual",
-        timestamp: (/* @__PURE__ */ new Date()).toISOString(),
-        tool_name: "update_bug_report",
-        project_name: "support",
-        has_error: false,
-        raw_text: memoryText,
-        vector,
-        source_path: localFile ?? null,
-        source_type: "bug_report",
-        memory_type: "bug_report",
-        tier: 1,
-        importance: status2 === "fixed" || status2 === "closed" ? 8 : 6,
-        intent: "update",
-        domain: "support",
-        file_paths: null
+      await persistSupportArtifact({
+        memoryText,
+        file: localFile && updateBlock !== null ? { path: localFile, content: updateBlock, append: true } : void 0,
+        memory: {
+          id: memoryId,
+          agent_id: agentId,
+          agent_role: agentRole,
+          session_id: process.env.SESSION_ID ?? "manual",
+          timestamp: (/* @__PURE__ */ new Date()).toISOString(),
+          tool_name: "update_bug_report",
+          project_name: "support",
+          has_error: false,
+          source_path: localFile ?? null,
+          source_type: "bug_report",
+          memory_type: "bug_report",
+          tier: 1,
+          importance: status2 === "fixed" || status2 === "closed" ? 8 : 6,
+          intent: "update",
+          domain: "support",
+          file_paths: null
+        }
       });
-      await flushBatch();
       const payload = {
-        id: fullId,
+        // Body belt (round 9): even past ingress validation, sanitize the id so a
+        // value from a non-schema caller can't put a raw id in the JSON body.
+        id: sanitizeUpstreamId(fullId),
         updated_at: (/* @__PURE__ */ new Date()).toISOString(),
         agent_id: agentId
       };
       if (isAdmin) {
         if (status2) payload.status = status2;
-        if (fix_version) {
-          payload.fixed_version = fix_version;
-          payload.fix_version = fix_version;
+        const safeFixVersion = sanitizeVersionField(fix_version);
+        if (safeFixVersion) {
+          payload.fixed_version = safeFixVersion;
+          payload.fix_version = safeFixVersion;
         }
-        if (product) payload.product = product;
+        const safeProduct = sanitizeProductFilter(product);
+        if (safeProduct) payload.product = safeProduct;
         if (followUpNote) payload.triage_notes = followUpNote;
       } else {
         if (followUpNote) payload.add_note = followUpNote;
@@ -12397,13 +12621,13 @@ Upstream status: ${upstreamStatus}`
           }
         ]
       };
-    }
+    })
   );
 }
 
 // src/mcp/tools/update-feature-request.ts
 import { z as z91 } from "zod";
-import { readdir as readdir2, readFile as readFile3, writeFile as writeFile5 } from "fs/promises";
+import { readdir as readdir2, readFile as readFile3 } from "fs/promises";
 import path16 from "path";
 var STATUS2 = z91.enum(["open", "planned", "in_progress", "shipped", "closed", "wontdo"]);
 async function findRequestFile(id) {
@@ -12417,9 +12641,8 @@ async function findRequestFile(id) {
     return null;
   }
 }
-async function appendStatusUpdate(filePath, status2, notes, shippedVersion) {
-  const existing = await readFile3(filePath, "utf-8");
-  const updateBlock = [
+function buildStatusUpdate(status2, notes, shippedVersion) {
+  return [
     "",
     `## Status Update \u2014 ${(/* @__PURE__ */ new Date()).toISOString()}`,
     "",
@@ -12427,20 +12650,19 @@ async function appendStatusUpdate(filePath, status2, notes, shippedVersion) {
     ...shippedVersion ? [`shipped_version: ${shippedVersion}`] : [],
     ...notes ? [``, `${notes}`] : []
   ].join("\n");
-  await writeFile5(filePath, existing + updateBlock, "utf-8");
 }
 async function sendUpstream2(payload) {
   const config = await loadConfig();
   const routerUrl = process.env.API_ROUTER_URL?.replace(/\/+$/, "");
-  const adminToken2 = resolveSupportAdminToken(config);
+  const adminToken = resolveSupportAdminToken(config);
   const support = config.support;
-  const baseEndpoint = adminToken2 ? process.env.ASKEXE_SUPPORT_ADMIN_FEATURE_ENDPOINT || support?.adminFeatureEndpoint || support?.admin_feature_endpoint || "https://api.askexe.com/admin/support/feature-requests" : config.support?.featureRequestEndpoint || process.env.EXE_FEATURE_REQUEST_ENDPOINT || (routerUrl ? `${routerUrl}/v1/support/feature-requests` : "https://api.askexe.com/v1/support/feature-requests");
+  const baseEndpoint = adminToken ? process.env.ASKEXE_SUPPORT_ADMIN_FEATURE_ENDPOINT || support?.adminFeatureEndpoint || support?.admin_feature_endpoint || "https://api.askexe.com/admin/support/feature-requests" : config.support?.featureRequestEndpoint || process.env.EXE_FEATURE_REQUEST_ENDPOINT || (routerUrl ? `${routerUrl}/v1/support/feature-requests` : "https://api.askexe.com/v1/support/feature-requests");
   const licenseKey = loadLicense() || process.env.EXE_LICENSE_KEY || config.cloud?.apiKey;
   const licenseToken = readCachedLicenseToken();
   if (!baseEndpoint) return "not_configured";
   try {
     const base = baseEndpoint.replace(/\/+$/, "");
-    const url = `${base}/${encodeURIComponent(payload.id)}`;
+    const url = `${base}/${encodeURIComponent(sanitizeUpstreamId(payload.id))}`;
     const parsed = new URL(url);
     if (parsed.protocol !== "https:" && !["localhost", "127.0.0.1", "::1"].includes(parsed.hostname)) {
       return "failed: insecure endpoint rejected";
@@ -12449,12 +12671,14 @@ async function sendUpstream2(payload) {
       method: "PATCH",
       headers: {
         "content-type": "application/json",
-        ...adminToken2 ? { authorization: `Bearer ${adminToken2}`, ...supportAdminHeaders(config) } : {
+        ...adminToken ? { authorization: `Bearer ${adminToken}`, ...supportAdminHeaders(config) } : {
           ...licenseKey ? { "x-exe-license-key": licenseKey, authorization: `Bearer ${licenseKey}` } : {},
           ...licenseToken ? { "x-exe-license-token": licenseToken } : {}
         }
       },
-      body: JSON.stringify(payload),
+      // Egress redaction gate (dc16fee4) — redact response_notes/add_note
+      // before the network send.
+      body: sanitizedUpstreamBody(payload, "update-feature-request"),
       signal: AbortSignal.timeout(1e4)
     });
     if (!response.ok) return `failed: HTTP ${response.status}`;
@@ -12470,59 +12694,59 @@ function registerUpdateFeatureRequest(server) {
       title: "Update Feature Request",
       description: "Update the status of a previously filed feature request. Updates local file, POSTs change to AskExe support, and stores a memory. Status flow: open \u2192 planned \u2192 in_progress \u2192 shipped \u2192 closed (or wontdo at any point).",
       inputSchema: {
-        id: z91.string().min(8).describe("Feature request UUID (full or 8-char prefix)"),
+        id: supportIdSchema.describe("Feature request UUID (full or 8-char prefix)"),
         status: STATUS2.describe("New status: open, planned, in_progress, shipped, closed, wontdo"),
-        shipped_version: z91.string().optional().describe("Version that ships this feature (e.g. '0.9.161')"),
+        shipped_version: supportVersionSchema.optional().describe("Version that ships this feature (e.g. '0.9.161')"),
         notes: z91.string().optional().describe("Notes about the status change"),
         send_upstream: z91.boolean().default(true).describe("POST status change to AskExe support endpoint")
       }
     },
-    async ({ id, status: status2, shipped_version, notes, send_upstream }) => {
+    async ({ id, status: status2, shipped_version, notes, send_upstream }) => redactedToolResult(async () => {
       const { agentId, agentRole } = getActiveAgent();
       const localFile = await findRequestFile(id);
       let localTitle = "Unknown feature";
+      let updateBlock = null;
       if (localFile) {
         try {
           const content = await readFile3(localFile, "utf-8");
           const titleMatch = content.match(/^# Feature Request — (.+)$/m);
           if (titleMatch?.[1]) localTitle = titleMatch[1];
-          await appendStatusUpdate(localFile, status2, notes, shipped_version);
+          updateBlock = buildStatusUpdate(status2, notes, shipped_version);
         } catch {
         }
       }
-      const memoryText = `Feature "${localTitle}" (${id.slice(0, 8)}) marked ${status2}` + (shipped_version ? ` in v${shipped_version}` : "") + (notes ? `. Notes: ${notes}` : "");
-      let vector = null;
-      try {
-        vector = await embed(memoryText);
-      } catch {
-        vector = null;
-      }
+      const memoryText = `Feature "${localTitle}" (${id.slice(0, 8)}) marked ${status2}` + (shipped_version ? ` in v ${shipped_version}` : "") + (notes ? `. Notes: ${notes}` : "");
       const memoryId = `${id}-update-${Date.now()}`;
-      await writeMemory({
-        id: memoryId,
-        agent_id: agentId,
-        agent_role: agentRole,
-        session_id: process.env.SESSION_ID ?? "manual",
-        timestamp: (/* @__PURE__ */ new Date()).toISOString(),
-        tool_name: "update_feature_request",
-        project_name: "support",
-        has_error: false,
-        raw_text: memoryText,
-        vector,
-        source_path: localFile ?? null,
-        source_type: "feature_request",
-        memory_type: "feature_request",
-        tier: 1,
-        importance: status2 === "shipped" || status2 === "closed" ? 8 : 6,
-        intent: "update",
-        domain: "support",
-        file_paths: null
+      await persistSupportArtifact({
+        memoryText,
+        file: localFile && updateBlock !== null ? { path: localFile, content: updateBlock, append: true } : void 0,
+        memory: {
+          id: memoryId,
+          agent_id: agentId,
+          agent_role: agentRole,
+          session_id: process.env.SESSION_ID ?? "manual",
+          timestamp: (/* @__PURE__ */ new Date()).toISOString(),
+          tool_name: "update_feature_request",
+          project_name: "support",
+          has_error: false,
+          source_path: localFile ?? null,
+          source_type: "feature_request",
+          memory_type: "feature_request",
+          tier: 1,
+          importance: status2 === "shipped" || status2 === "closed" ? 8 : 6,
+          intent: "update",
+          domain: "support",
+          file_paths: null
+        }
       });
-      await flushBatch();
       const upstreamStatus = send_upstream ? await sendUpstream2({
-        id,
+        // Body belt (round 9): sanitize the id so a non-schema caller can't put
+        // a raw id in the JSON body (the URL is sanitized separately).
+        id: sanitizeUpstreamId(id),
         status: status2,
-        shipped_version,
+        // Body belt (round 10): shape-validate the version so a schema-bypassing
+        // caller can't put a raw credential-shaped version in the body.
+        shipped_version: sanitizeVersionField(shipped_version),
         notes,
         updated_at: (/* @__PURE__ */ new Date()).toISOString(),
         agent_id: agentId
@@ -12541,7 +12765,7 @@ Upstream status: ${upstreamStatus}`
           }
         ]
       };
-    }
+    })
   );
 }
 
@@ -12619,10 +12843,10 @@ function registerSupportTools(server) {
           isError: true
         };
       }
-      const endpoint2 = new URL("https://api.askexe.com/v1/support/my-reports");
-      endpoint2.searchParams.set("status", status2);
-      endpoint2.searchParams.set("limit", String(limit));
-      endpoint2.searchParams.set("offset", String(offset));
+      const endpoint = new URL("https://api.askexe.com/v1/support/my-reports");
+      endpoint.searchParams.set("status", status2);
+      endpoint.searchParams.set("limit", String(limit));
+      endpoint.searchParams.set("offset", String(offset));
       const headers = { "content-type": "application/json" };
       if (licenseKey) {
         headers["authorization"] = `Bearer ${licenseKey}`;
@@ -12630,7 +12854,7 @@ function registerSupportTools(server) {
       }
       if (licenseToken) headers["x-exe-license-token"] = licenseToken;
       try {
-        const res = await fetch(endpoint2.toString(), { method: "GET", headers, signal: AbortSignal.timeout(15e3) });
+        const res = await fetch(endpoint.toString(), { method: "GET", headers, signal: AbortSignal.timeout(15e3) });
         if (!res.ok) {
           const body = await res.text().catch(() => "");
           return {
@@ -12691,10 +12915,10 @@ function registerSupportTools(server) {
           isError: true
         };
       }
-      const endpoint2 = new URL("https://api.askexe.com/v1/support/my-feature-requests");
-      endpoint2.searchParams.set("status", status2);
-      endpoint2.searchParams.set("limit", String(limit));
-      endpoint2.searchParams.set("offset", String(offset));
+      const endpoint = new URL("https://api.askexe.com/v1/support/my-feature-requests");
+      endpoint.searchParams.set("status", status2);
+      endpoint.searchParams.set("limit", String(limit));
+      endpoint.searchParams.set("offset", String(offset));
       const headers = { "content-type": "application/json" };
       if (licenseKey) {
         headers["authorization"] = `Bearer ${licenseKey}`;
@@ -12702,7 +12926,7 @@ function registerSupportTools(server) {
       }
       if (licenseToken) headers["x-exe-license-token"] = licenseToken;
       try {
-        const res = await fetch(endpoint2.toString(), { method: "GET", headers, signal: AbortSignal.timeout(15e3) });
+        const res = await fetch(endpoint.toString(), { method: "GET", headers, signal: AbortSignal.timeout(15e3) });
         if (!res.ok) {
           const body = await res.text().catch(() => "");
           return {
@@ -12763,9 +12987,9 @@ function registerSupportTools(server) {
           isError: true
         };
       }
-      const endpoint2 = new URL("https://api.askexe.com/v1/support/my-reviews");
-      endpoint2.searchParams.set("status", status2);
-      endpoint2.searchParams.set("limit", String(limit));
+      const endpoint = new URL("https://api.askexe.com/v1/support/my-reviews");
+      endpoint.searchParams.set("status", status2);
+      endpoint.searchParams.set("limit", String(limit));
       const headers = { "content-type": "application/json" };
       if (licenseKey) {
         headers["authorization"] = `Bearer ${licenseKey}`;
@@ -12773,7 +12997,7 @@ function registerSupportTools(server) {
       }
       if (licenseToken) headers["x-exe-license-token"] = licenseToken;
       try {
-        const res = await fetch(endpoint2.toString(), { method: "GET", headers, signal: AbortSignal.timeout(15e3) });
+        const res = await fetch(endpoint.toString(), { method: "GET", headers, signal: AbortSignal.timeout(15e3) });
         if (!res.ok) {
           const body = await res.text().catch(() => "");
           if (res.status === 500 || res.status === 404) {
@@ -13031,7 +13255,7 @@ function registerCliParityTools(server) {
     const out = await runCommand("exe-os", ["cloud", "status"], 45e3);
     let healthSection = "";
     try {
-      const { getRetrievalHealth: getRetrievalHealth2, formatDegradations: formatDegradations2 } = await import("./retrieval-health-TWHKYCRK.js");
+      const { getRetrievalHealth: getRetrievalHealth2, formatDegradations: formatDegradations2 } = await import("./retrieval-health-4Z242P3B.js");
       const h = await getRetrievalHealth2();
       const lines = [
         "",
@@ -13099,7 +13323,7 @@ function registerCodeContext(server) {
       const index = buildCodeContextIndex(opts);
       let graphExtract;
       try {
-        const { autoExtractGraphEntities } = await import("./graph-auto-extract-LKIQ57PL.js");
+        const { autoExtractGraphEntities } = await import("./graph-auto-extract-OURWMGBS.js");
         graphExtract = await autoExtractGraphEntities(opts.projectRoot);
       } catch {
       }
@@ -13173,355 +13397,8 @@ function registerCodeContext(server) {
   });
 }
 
-// src/mcp/tools/support-inbox.ts
-import { z as z95 } from "zod";
-import { readFileSync as readFileSync7 } from "fs";
-import { join as join4 } from "path";
-import { homedir as homedir4 } from "os";
-var DEFAULT_ENDPOINT = "https://api.askexe.com/admin/support/bug-reports";
-var DEFAULT_OWNER_ENDPOINT = "https://api.askexe.com/v1/support/bug-reports";
-var STATUS3 = z95.enum(["open", "triaged", "fixed", "closed", "wontfix"]);
-function adminToken() {
-  if (process.env.ASKEXE_SUPPORT_ADMIN_TOKEN) return process.env.ASKEXE_SUPPORT_ADMIN_TOKEN;
-  if (process.env.EXE_SUPPORT_ADMIN_TOKEN) return process.env.EXE_SUPPORT_ADMIN_TOKEN;
-  try {
-    const configPath = join4(process.env.EXE_OS_DIR ?? join4(homedir4(), ".exe-os"), "config.json");
-    const config = JSON.parse(readFileSync7(configPath, "utf-8"));
-    return config.support?.adminToken || config.support?.admin_token;
-  } catch {
-    return void 0;
-  }
-}
-function endpoint() {
-  return (process.env.ASKEXE_SUPPORT_ADMIN_ENDPOINT || DEFAULT_ENDPOINT).replace(/\/+$/, "");
-}
-function ownerEndpoint() {
-  const routerUrl = process.env.API_ROUTER_URL?.replace(/\/+$/, "");
-  let configured;
-  try {
-    const configPath = join4(process.env.EXE_OS_DIR ?? join4(homedir4(), ".exe-os"), "config.json");
-    const config = JSON.parse(readFileSync7(configPath, "utf-8"));
-    configured = config.support?.bugReportEndpoint;
-  } catch {
-  }
-  const base = configured || process.env.EXE_BUG_REPORT_ENDPOINT || (routerUrl ? `${routerUrl}/v1/support/bug-reports` : DEFAULT_OWNER_ENDPOINT);
-  return base.replace(/\/+$/, "");
-}
-function ownerAuthHeaders() {
-  let cloudApiKey;
-  try {
-    const configPath = join4(process.env.EXE_OS_DIR ?? join4(homedir4(), ".exe-os"), "config.json");
-    const config = JSON.parse(readFileSync7(configPath, "utf-8"));
-    cloudApiKey = config.cloud?.apiKey;
-  } catch {
-  }
-  const licenseKey = loadLicense() || process.env.EXE_LICENSE_KEY || cloudApiKey;
-  const licenseToken = readCachedLicenseToken();
-  const headers = {};
-  if (licenseKey) {
-    headers["x-exe-license-key"] = licenseKey;
-    headers.authorization = `Bearer ${licenseKey}`;
-  }
-  if (licenseToken) headers["x-exe-license-token"] = licenseToken;
-  return headers;
-}
-function assertInternal() {
-  const token = adminToken();
-  if (!token) throw new Error("AskExe support admin token not configured");
-  return token;
-}
-async function requestJson(url, init) {
-  const token = assertInternal();
-  const res = await fetch(url, {
-    ...init,
-    headers: {
-      "content-type": "application/json",
-      authorization: `Bearer ${token}`,
-      ...init?.headers ?? {}
-    },
-    signal: AbortSignal.timeout(1e4)
-  });
-  const text5 = await res.text();
-  let data = text5;
-  try {
-    data = text5 ? JSON.parse(text5) : {};
-  } catch {
-  }
-  if (!res.ok) throw new Error(`HTTP ${res.status}: ${typeof data === "string" ? data : JSON.stringify(data)}`);
-  return data;
-}
-async function fetchJson(url, headers, init) {
-  const res = await fetch(url, {
-    ...init,
-    headers: { "content-type": "application/json", ...headers, ...init?.headers ?? {} },
-    signal: AbortSignal.timeout(1e4)
-  });
-  const text5 = await res.text();
-  let data = text5;
-  try {
-    data = text5 ? JSON.parse(text5) : {};
-  } catch {
-  }
-  if (!res.ok) throw new Error(`HTTP ${res.status}: ${typeof data === "string" ? data : JSON.stringify(data)}`);
-  return data;
-}
-async function commentRequestJson(bugId, init) {
-  const token = adminToken();
-  if (token) {
-    const url2 = `${endpoint()}/${encodeURIComponent(bugId)}/comments`;
-    return fetchJson(url2, { authorization: `Bearer ${token}` }, init);
-  }
-  const ownerHeaders = ownerAuthHeaders();
-  if (!ownerHeaders.authorization && !ownerHeaders["x-exe-license-token"]) {
-    throw new Error(
-      "Not authenticated for support comments. Run `exe-os login` (GoTrue) or set a license key, or configure an AskExe admin token (ASKEXE_SUPPORT_ADMIN_TOKEN)."
-    );
-  }
-  const url = `${ownerEndpoint()}/${encodeURIComponent(bugId)}/comments`;
-  return fetchJson(url, ownerHeaders, init);
-}
-function registerListBugReports(server) {
-  server.registerTool(
-    "list_bug_reports",
-    {
-      title: "List Bug Reports",
-      description: "AskExe-internal only: list incoming customer bug reports from the support inbox.",
-      inputSchema: {
-        status: z95.enum(["all", "open", "triaged", "fixed", "closed", "wontfix"]).default("open"),
-        severity: z95.enum(["p0", "p1", "p2", "p3"]).optional(),
-        limit: z95.number().int().min(1).max(100).default(25)
-      }
-    },
-    async ({ status: status2, severity, limit }) => {
-      const url = new URL(endpoint());
-      url.searchParams.set("status", status2);
-      url.searchParams.set("limit", String(limit));
-      if (severity) url.searchParams.set("severity", severity);
-      const data = await requestJson(url.toString());
-      return { content: [{ type: "text", text: JSON.stringify(data, null, 2) }] };
-    }
-  );
-}
-function parseComments(row) {
-  if (!row || typeof row !== "object") return [];
-  const raw = row.progress_log;
-  if (typeof raw !== "string" || !raw.trim()) return [];
-  try {
-    const parsed = JSON.parse(raw);
-    return Array.isArray(parsed) ? parsed : [];
-  } catch {
-    return [];
-  }
-}
-function registerGetBugReport(server) {
-  server.registerTool(
-    "get_bug_report",
-    {
-      title: "Get Bug Report",
-      description: "AskExe-internal only: fetch one customer bug report with full markdown payload and comments thread.",
-      inputSchema: { id: z95.string().min(8) }
-    },
-    async ({ id }) => {
-      const data = await requestJson(`${endpoint()}/${encodeURIComponent(id)}`);
-      const comments = parseComments(data);
-      const enriched = data && typeof data === "object" ? { ...data, comments } : { id, comments };
-      return { content: [{ type: "text", text: JSON.stringify(enriched, null, 2) }] };
-    }
-  );
-}
-function registerAddBugReportComment(server) {
-  server.registerTool(
-    "add_bug_report_comment",
-    {
-      title: "Add Bug Report Comment",
-      description: "AskExe-internal only: append a comment to a bug report's thread (POST /comments). Non-destructive \u2014 does not touch triage_notes or status.",
-      inputSchema: {
-        id: z95.string().min(8),
-        comment: z95.string().min(1).describe("Comment text to append to the bug report thread")
-      }
-    },
-    async ({ id, comment }) => {
-      const data = await commentRequestJson(id, {
-        method: "POST",
-        body: JSON.stringify({ comment })
-      });
-      return { content: [{ type: "text", text: JSON.stringify(data, null, 2) }] };
-    }
-  );
-}
-function registerGetBugReportComments(server) {
-  server.registerTool(
-    "get_bug_report_comments",
-    {
-      title: "Get Bug Report Comments",
-      description: "AskExe-internal only: list the comments thread on a bug report (GET /comments).",
-      inputSchema: { id: z95.string().min(8) }
-    },
-    async ({ id }) => {
-      const data = await commentRequestJson(id);
-      return { content: [{ type: "text", text: JSON.stringify(data, null, 2) }] };
-    }
-  );
-}
-function registerTriageBugReport(server) {
-  server.registerTool(
-    "triage_bug_report",
-    {
-      title: "Triage Bug Report",
-      description: "AskExe-internal only: update bug report status and link task/commit/release metadata.",
-      inputSchema: {
-        id: z95.string().min(8),
-        status: STATUS3.optional(),
-        triage_notes: z95.string().optional(),
-        add_note: z95.string().optional().describe("Append a timestamped progress note without changing status or replacing triage_notes"),
-        linked_task_id: z95.string().optional(),
-        linked_commit: z95.string().optional(),
-        fixed_version: z95.string().optional(),
-        product: z95.string().optional().describe("Re-label this bug's product: exe-os, exe-create, exe-wiki, exe-gateway, exe-crm, exe-build, exe-chat, exe-auth, exe-monitor, exe-db, exe-erp")
-      }
-    },
-    async ({ id, status: status2, triage_notes, add_note, linked_task_id, linked_commit, fixed_version, product }) => {
-      const effectiveStatus = fixed_version && !status2 ? "closed" : status2;
-      const data = await requestJson(`${endpoint()}/${encodeURIComponent(id)}`, {
-        method: "PATCH",
-        body: JSON.stringify({ status: effectiveStatus, triage_notes, add_note, linked_task_id, linked_commit, fixed_version, product })
-      });
-      return { content: [{ type: "text", text: JSON.stringify(data, null, 2) }] };
-    }
-  );
-}
-var FEATURE_STATUS = z95.enum(["open", "planned", "in_progress", "shipped", "closed", "wontdo"]);
-function featureEndpoint() {
-  return endpoint().replace(/\/bug-reports\/?$/, "/feature-requests");
-}
-function registerListFeatureRequests(server) {
-  server.registerTool(
-    "list_feature_requests",
-    {
-      title: "List Feature Requests",
-      description: "AskExe-internal only: list incoming customer feature requests from the support inbox.",
-      inputSchema: {
-        status: z95.enum(["all", "open", "planned", "in_progress", "shipped", "closed", "wontdo"]).default("open"),
-        priority: z95.enum(["p0", "p1", "p2", "p3"]).optional(),
-        limit: z95.number().int().min(1).max(100).default(25)
-      }
-    },
-    async ({ status: status2, priority, limit }) => {
-      const url = new URL(featureEndpoint());
-      url.searchParams.set("status", status2);
-      url.searchParams.set("limit", String(limit));
-      if (priority) url.searchParams.set("priority", priority);
-      const data = await requestJson(url.toString());
-      return { content: [{ type: "text", text: JSON.stringify(data, null, 2) }] };
-    }
-  );
-}
-function registerGetFeatureRequest(server) {
-  server.registerTool(
-    "get_feature_request",
-    {
-      title: "Get Feature Request",
-      description: "AskExe-internal only: fetch one customer feature request with full payload.",
-      inputSchema: { id: z95.string().min(8) }
-    },
-    async ({ id }) => {
-      const data = await requestJson(`${featureEndpoint()}/${encodeURIComponent(id)}`);
-      return { content: [{ type: "text", text: JSON.stringify(data, null, 2) }] };
-    }
-  );
-}
-function registerTriageFeatureRequest(server) {
-  server.registerTool(
-    "triage_feature_request",
-    {
-      title: "Triage Feature Request",
-      description: "AskExe-internal only: update feature request status, response notes, and version metadata.",
-      inputSchema: {
-        id: z95.string().min(8),
-        status: FEATURE_STATUS.optional(),
-        response_notes: z95.string().optional(),
-        add_note: z95.string().optional().describe("Append a timestamped progress note without changing status or replacing response_notes"),
-        target_version: z95.string().optional(),
-        shipped_version: z95.string().optional()
-      }
-    },
-    async ({ id, status: status2, response_notes, add_note, target_version, shipped_version }) => {
-      const effectiveStatus = shipped_version && !status2 ? "shipped" : status2;
-      const data = await requestJson(`${featureEndpoint()}/${encodeURIComponent(id)}`, {
-        method: "PATCH",
-        body: JSON.stringify({ status: effectiveStatus, response_notes, add_note, target_version, shipped_version })
-      });
-      return { content: [{ type: "text", text: JSON.stringify(data, null, 2) }] };
-    }
-  );
-}
-var REVIEW_STATUS = z95.enum(["open", "in_review", "approved", "merged", "closed", "rejected"]);
-function reviewEndpoint() {
-  return endpoint().replace(/\/bug-reports\/?$/, "/reviews");
-}
-function registerListReviews(server) {
-  server.registerTool(
-    "list_reviews",
-    {
-      title: "List Reviews",
-      description: "AskExe-internal only: list incoming review requests from the support inbox.",
-      inputSchema: {
-        status: z95.enum(["all", "open", "in_review", "approved", "merged", "closed", "rejected"]).default("open"),
-        priority: z95.enum(["p0", "p1", "p2", "p3"]).optional(),
-        limit: z95.number().int().min(1).max(100).default(25)
-      }
-    },
-    async ({ status: status2, priority, limit }) => {
-      const url = new URL(reviewEndpoint());
-      url.searchParams.set("status", status2);
-      url.searchParams.set("limit", String(limit));
-      if (priority) url.searchParams.set("priority", priority);
-      const data = await requestJson(url.toString());
-      return { content: [{ type: "text", text: JSON.stringify(data, null, 2) }] };
-    }
-  );
-}
-function registerGetReview(server) {
-  server.registerTool(
-    "get_review",
-    {
-      title: "Get Review",
-      description: "AskExe-internal only: fetch one review with full payload.",
-      inputSchema: { id: z95.string().min(8) }
-    },
-    async ({ id }) => {
-      const data = await requestJson(`${reviewEndpoint()}/${encodeURIComponent(id)}`);
-      return { content: [{ type: "text", text: JSON.stringify(data, null, 2) }] };
-    }
-  );
-}
-function registerTriageReview(server) {
-  server.registerTool(
-    "triage_review",
-    {
-      title: "Triage Review",
-      description: "AskExe-internal only: update review status, response notes, and resolution.",
-      inputSchema: {
-        id: z95.string().min(8),
-        status: REVIEW_STATUS.optional(),
-        response_notes: z95.string().optional(),
-        add_note: z95.string().optional().describe("Append a timestamped progress note without changing status or replacing response_notes"),
-        resolution: z95.string().optional(),
-        pr_url: z95.string().optional()
-      }
-    },
-    async ({ id, status: status2, response_notes, add_note, resolution, pr_url }) => {
-      const data = await requestJson(`${reviewEndpoint()}/${encodeURIComponent(id)}`, {
-        method: "PATCH",
-        body: JSON.stringify({ status: status2, response_notes, add_note, resolution, pr_url })
-      });
-      return { content: [{ type: "text", text: JSON.stringify(data, null, 2) }] };
-    }
-  );
-}
-
 // src/mcp/tools/decision.ts
-import { z as z96 } from "zod";
+import { z as z95 } from "zod";
 function buildHandlers6() {
   const tools = /* @__PURE__ */ new Map();
   const fake = {
@@ -13545,12 +13422,12 @@ function registerDecision(server) {
       title: "Decision",
       description: "Store or retrieve authoritative decisions. Actions: store (persist a decision by domain), get (look up a decision by domain/query).",
       inputSchema: {
-        action: z96.enum(["store", "get"]).describe("Decision operation"),
-        domain: z96.string().optional().describe("Decision domain (e.g. 'architecture', 'hiring')"),
-        decision: z96.string().optional().describe("Decision text for action=store"),
-        rationale: z96.string().optional().describe("Why this decision was made (action=store)"),
-        query: z96.string().optional().describe("Search query for action=get"),
-        limit: z96.coerce.number().optional().describe("Max results for action=get")
+        action: z95.enum(["store", "get"]).describe("Decision operation"),
+        domain: z95.string().optional().describe("Decision domain (e.g. 'architecture', 'hiring')"),
+        decision: z95.string().optional().describe("Decision text for action=store"),
+        rationale: z95.string().optional().describe("Why this decision was made (action=store)"),
+        query: z95.string().optional().describe("Search query for action=get"),
+        limit: z95.coerce.number().optional().describe("Max results for action=get")
       }
     },
     async (input, extra) => {
@@ -13566,7 +13443,7 @@ function registerDecision(server) {
 }
 
 // src/mcp/tools/session.ts
-import { z as z97 } from "zod";
+import { z as z96 } from "zod";
 function buildHandlers7() {
   const tools = /* @__PURE__ */ new Map();
   const fake = {
@@ -13614,17 +13491,17 @@ function registerSession(server) {
       title: "Session",
       description: "Session tools. Actions: events (session event log), last_response (most recent assistant text), set_mode (enter explore or task mode), get_mode (query current mode and active explore sessions).",
       inputSchema: {
-        action: z97.enum(["events", "last_response", "set_mode", "get_mode"]).describe("Session operation"),
-        session_id: z97.string().optional().describe("Session ID for action=events"),
-        limit: z97.coerce.number().optional().describe("Max events for action=events"),
+        action: z96.enum(["events", "last_response", "set_mode", "get_mode"]).describe("Session operation"),
+        session_id: z96.string().optional().describe("Session ID for action=events"),
+        limit: z96.coerce.number().optional().describe("Max events for action=events"),
         // set_mode params
-        mode: z97.enum(["explore", "task"]).optional().describe(
+        mode: z96.enum(["explore", "task"]).optional().describe(
           "Mode for action=set_mode. 'explore' = divergent, no deliverable, nudges suppressed. 'task' = default convergent behaviour (resets any active explore session)."
         ),
-        duration_minutes: z97.number().optional().describe(
+        duration_minutes: z96.number().optional().describe(
           `How long to stay in explore mode in minutes (action=set_mode, mode=explore). Default: ${DEFAULT_EXPLORE_DURATION_MS / 6e4} minutes (1 hour).`
         ),
-        notes: z97.string().optional().describe("Optional notes about this explore session (action=set_mode)")
+        notes: z96.string().optional().describe("Optional notes about this explore session (action=set_mode)")
       }
     },
     async (input, extra) => {
@@ -13689,14 +13566,13 @@ All active explore sessions (${active.length}):
 }
 
 // src/mcp/tools/support-consolidated.ts
-import { z as z99 } from "zod";
+import { z as z98 } from "zod";
 
 // src/mcp/tools/create-review.ts
-import { z as z98 } from "zod";
+import { z as z97 } from "zod";
 import crypto6 from "crypto";
-import { mkdir as mkdir4, writeFile as writeFile6 } from "fs/promises";
 import path17 from "path";
-var PRIORITY2 = z98.enum(["p0", "p1", "p2", "p3"]);
+var PRIORITY2 = z97.enum(["p0", "p1", "p2", "p3"]);
 function slugify3(input) {
   return input.toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/^-+|-+$/g, "").slice(0, 80) || "review";
 }
@@ -13725,15 +13601,15 @@ function buildMarkdown3(input) {
 async function maybeSendUpstream3(payload) {
   const config = await loadConfig();
   const routerUrl = process.env.API_ROUTER_URL?.replace(/\/+$/, "");
-  const endpoint2 = config.support?.reviewEndpoint || process.env.EXE_REVIEW_ENDPOINT || (routerUrl ? `${routerUrl}/v1/support/reviews` : "https://api.askexe.com/v1/support/reviews");
+  const endpoint = config.support?.reviewEndpoint || process.env.EXE_REVIEW_ENDPOINT || (routerUrl ? `${routerUrl}/v1/support/reviews` : "https://api.askexe.com/v1/support/reviews");
   const token = config.support?.reviewToken || process.env.EXE_REVIEW_TOKEN;
   const licenseKey = loadLicense() || process.env.EXE_LICENSE_KEY || config.cloud?.apiKey;
   const licenseToken = readCachedLicenseToken();
-  if (!endpoint2) {
+  if (!endpoint) {
     return "not_configured";
   }
   try {
-    const parsed = new URL(endpoint2);
+    const parsed = new URL(endpoint);
     if (parsed.protocol !== "https:" && !["localhost", "127.0.0.1", "::1"].includes(parsed.hostname)) {
       return "failed: insecure endpoint rejected";
     }
@@ -13746,7 +13622,10 @@ async function maybeSendUpstream3(payload) {
         ...licenseToken ? { "x-exe-license-token": licenseToken } : {},
         ...supportAdminHeaders(config)
       },
-      body: JSON.stringify(payload),
+      // Egress redaction gate (dc16fee4) — redact secrets from description +
+      // rendered markdown before the network send. No disk outbox for reviews,
+      // so this direct send is the only path.
+      body: sanitizedUpstreamBody(payload, "create-review"),
       signal: AbortSignal.timeout(1e4)
     });
     if (!response.ok) return `failed: HTTP ${response.status}`;
@@ -13762,17 +13641,18 @@ function registerCreateReview(server) {
       title: "Create Review",
       description: "File a review request (code review, self-improvement findings, PR review needs). Writes a local report, stores memory, and optionally sends to AskExe support.",
       inputSchema: {
-        title: z98.string().min(3).describe("Short descriptive title"),
-        description: z98.string().optional().describe("What needs review and why"),
+        title: z97.string().min(3).describe("Short descriptive title"),
+        description: z97.string().optional().describe("What needs review and why"),
         priority: PRIORITY2.default("p1").describe("p0 critical -> p3 low"),
-        source: z98.string().optional().describe("Source: self-improve, manual, ci, etc."),
-        pr_url: z98.string().optional().describe("PR URL if applicable"),
-        product: z98.string().optional().describe("Product: exe-os (default), exe-create, exe-wiki, exe-gateway, exe-crm, exe-build"),
-        package_version: z98.string().optional().describe("Installed package version"),
-        project_name: z98.string().optional().describe("Project/customer context"),
-        send_upstream: z98.boolean().default(false).describe("Attempt to POST to configured AskExe support endpoint (disabled by default \u2014 review route not yet live)")
+        source: z97.string().optional().describe("Source: self-improve, manual, ci, etc."),
+        pr_url: z97.string().optional().describe("PR URL if applicable"),
+        product: supportProductSchema.optional().describe("Product: exe-os (default), exe-create, exe-wiki, exe-gateway, exe-crm, exe-build"),
+        package_version: z97.string().optional().describe("Installed package version"),
+        project_name: z97.string().optional().describe("Project/customer context"),
+        send_upstream: z97.boolean().default(false).describe("Attempt to POST to configured AskExe support endpoint (disabled by default \u2014 review route not yet live)")
       }
     },
+    // Structural sink guard (round 6): deep-redact the whole return object + errors.
     async ({
       title,
       description,
@@ -13783,11 +13663,11 @@ function registerCreateReview(server) {
       package_version,
       project_name,
       send_upstream
-    }) => {
+    }) => redactedToolResult(async () => {
       const { agentId, agentRole } = getActiveAgent();
       const id = crypto6.randomUUID();
       const resolvedProduct = product ?? "exe-os";
-      const version = package_version ?? "unknown";
+      const version = sanitizeVersionField(package_version) ?? "unknown";
       const markdown = buildMarkdown3({
         id,
         title,
@@ -13802,36 +13682,29 @@ function registerCreateReview(server) {
         projectName: project_name
       });
       const outDir = path17.join(EXE_AI_DIR, "reviews");
-      await mkdir4(outDir, { recursive: true });
-      const reportPath = path17.join(outDir, `${(/* @__PURE__ */ new Date()).toISOString().slice(0, 10)}-${slugify3(title)}-${id.slice(0, 8)}.md`);
-      await writeFile6(reportPath, markdown, "utf-8");
-      let vector = null;
-      try {
-        vector = await embed(markdown);
-      } catch {
-        vector = null;
-      }
-      await writeMemory({
-        id,
-        agent_id: agentId,
-        agent_role: agentRole,
-        session_id: process.env.SESSION_ID ?? "manual",
-        timestamp: (/* @__PURE__ */ new Date()).toISOString(),
-        tool_name: "create_review",
-        project_name: project_name ?? "support",
-        has_error: false,
-        raw_text: markdown,
-        vector,
-        source_path: reportPath,
-        source_type: "review",
-        memory_type: "review",
-        tier: 1,
-        importance: priority === "p0" ? 10 : priority === "p1" ? 9 : priority === "p2" ? 7 : 5,
-        intent: "review",
-        domain: "support",
-        file_paths: null
+      const reportPath = path17.join(outDir, `${(/* @__PURE__ */ new Date()).toISOString().slice(0, 10)}-${slugify3(redactSecrets(title).text)}-${id.slice(0, 8)}.md`);
+      await persistSupportArtifact({
+        memoryText: markdown,
+        file: { path: reportPath, content: markdown },
+        memory: {
+          id,
+          agent_id: agentId,
+          agent_role: agentRole,
+          session_id: process.env.SESSION_ID ?? "manual",
+          timestamp: (/* @__PURE__ */ new Date()).toISOString(),
+          tool_name: "create_review",
+          project_name: project_name ?? "support",
+          has_error: false,
+          source_path: reportPath,
+          source_type: "review",
+          memory_type: "review",
+          tier: 1,
+          importance: priority === "p0" ? 10 : priority === "p1" ? 9 : priority === "p2" ? 7 : 5,
+          intent: "review",
+          domain: "support",
+          file_paths: null
+        }
       });
-      await flushBatch();
       const upstreamPayload = {
         id,
         title,
@@ -13864,7 +13737,7 @@ Upstream status: ${upstreamStatus}`
           }
         ]
       };
-    }
+    })
   );
 }
 
@@ -13924,9 +13797,9 @@ function registerSupportConsolidated(server) {
     "support",
     {
       title: "Support",
-      description: "Bug reports, feature requests, reviews, and support system. Actions: create_bug, create_feature, create_review, update_bug, update_feature, list_my_bugs, list_my_features, list_my_reviews, list_bugs, get_bug, add_comment, get_comments, triage_bug, list_features, get_feature, triage_feature, list_reviews, get_review, triage_review, health, test. Use 'product' param to file bugs for any AskExe product.",
+      description: "Bug reports, feature requests, reviews, and support system. Actions: create_bug, create_feature, create_review, update_bug, update_feature, list_my_bugs, list_my_features, list_my_reviews, list_bugs, get_bug, add_comment, get_comments, triage_bug, list_features, get_feature, triage_feature, list_reviews, get_review, triage_review, health, test. Use 'product' param to file/route bugs AND feature requests for any AskExe product.",
       inputSchema: {
-        action: z99.enum([
+        action: z98.enum([
           "create_bug",
           "create_feature",
           "create_review",
@@ -13949,40 +13822,68 @@ function registerSupportConsolidated(server) {
           "health",
           "test"
         ]).describe("Support operation"),
-        title: z99.string().optional().describe("Bug/feature title"),
-        description: z99.string().optional().describe("Bug/feature description"),
-        steps_to_reproduce: z99.string().optional().describe("Steps to reproduce (bugs)"),
-        expected_behavior: z99.string().optional().describe("Expected behavior (bugs)"),
-        actual_behavior: z99.string().optional().describe("Actual behavior (bugs)"),
-        severity: z99.string().optional().describe("Severity: p0/p1/p2/p3"),
-        product: z99.string().optional().describe("Product (create_bug default exe-os; also re-labels a bug via update_bug, admin only): exe-os, exe-create, exe-wiki, exe-gateway, exe-crm, exe-build, exe-chat, exe-auth, exe-monitor, exe-db, exe-erp"),
-        use_case: z99.string().optional().describe("Use case (features)"),
-        proposed_solution: z99.string().optional().describe("Proposed solution (features)"),
-        priority: z99.string().optional().describe("Priority (features)"),
-        on_behalf_of_email: z99.string().email().optional().describe("ADMIN ONLY: file this request owned by another customer's license email; ignored unless caller holds the support admin token (create_bug/create_feature)"),
-        id: z99.string().optional().describe("Bug/feature ID for get/triage/add_comment/get_comments"),
-        comment: z99.string().optional().describe("Comment text to append to a bug report thread (add_comment)"),
-        status: z99.string().optional().describe("Filter by status"),
-        classification: z99.string().optional().describe("Triage classification"),
-        resolution: z99.string().optional().describe("Triage resolution"),
-        notes: z99.string().optional().describe("Triage notes (mapped to triage_notes for bug/feature triage)"),
-        triage_notes: z99.string().optional().describe("Triage notes (legacy field name)"),
-        linked_task_id: z99.string().optional().describe("Linked task ID for triage"),
-        linked_commit: z99.string().optional().describe("Linked commit hash for triage"),
-        fixed_version: z99.string().optional().describe("Version that fixes this bug"),
-        shipped_version: z99.string().optional().describe("Version that ships this feature (features only)"),
-        add_evidence: z99.string().optional().describe("Owner self-service: additional evidence (logs, repro, stack traces) for update_bug"),
-        reopen_request: z99.boolean().optional().describe("Owner self-service: request a reopen on a recurring fixed bug (update_bug)"),
-        reopen_reason: z99.string().optional().describe("Owner self-service: why the bug should be reopened (update_bug)"),
-        attachments: z99.array(z99.object({
-          filename: z99.string().min(1).describe("Filename for the attachment"),
-          content: z99.string().min(1).describe("File content \u2014 plain text")
+        title: z98.string().optional().describe("Bug/feature title"),
+        description: z98.string().optional().describe("Bug/feature description"),
+        steps_to_reproduce: z98.string().optional().describe("Steps to reproduce (bugs)"),
+        expected_behavior: z98.string().optional().describe("Expected behavior (bugs)"),
+        actual_behavior: z98.string().optional().describe("Actual behavior (bugs)"),
+        // Round 10: these are ENUM fields — on list actions they reach the vendor URL
+        // query, and on triage/create the body. Constrained to the UNION of valid values
+        // across bug/feature/review actions so a non-enum value is rejected at ingress.
+        severity: z98.enum(["p0", "p1", "p2", "p3"]).optional().describe("Severity: p0/p1/p2/p3"),
+        // bug b8e990ed: product works for BOTH bugs and features (create default exe-os;
+        // list_bugs/list_features filter; triage_bug/triage_feature admin re-label).
+        // Kept on the strict ingress schema (round 10) rather than a loose string.
+        product: supportProductSchema.optional().describe("Product \u2014 works for BOTH bugs and features (create default exe-os; list_bugs/list_features filter; triage_bug/triage_feature admin re-label): exe-os, exe-create, exe-wiki, exe-gateway, exe-crm, exe-build, exe-chat, exe-auth, exe-monitor, exe-db, exe-erp"),
+        use_case: z98.string().optional().describe("Use case (features)"),
+        proposed_solution: z98.string().optional().describe("Proposed solution (features)"),
+        priority: z98.enum(["p0", "p1", "p2", "p3"]).optional().describe("Priority (features)"),
+        on_behalf_of_email: z98.string().email().optional().describe("ADMIN ONLY: file this request owned by another customer's license email; ignored unless caller holds the support admin token (create_bug/create_feature)"),
+        // Round 10: constrained fields are shape-validated at ingress (this is the
+        // DEFAULT surface and calls handlers directly, bypassing their per-tool schemas).
+        id: supportIdSchema.optional().describe("Bug/feature ID for get/triage/add_comment/get_comments"),
+        comment: z98.string().optional().describe("Comment text to append to a bug report thread (add_comment)"),
+        status: z98.enum([
+          "all",
+          "open",
+          "triaged",
+          "fixed",
+          "closed",
+          "wontfix",
+          "planned",
+          "in_progress",
+          "shipped",
+          "wontdo",
+          "in_review",
+          "approved",
+          "merged",
+          "rejected"
+        ]).optional().describe("Filter by status (union across bug/feature/review)"),
+        classification: z98.enum([
+          "upstream_bug",
+          "customer_customization",
+          "emergency_hotfix",
+          "unclear"
+        ]).optional().describe("Triage classification"),
+        resolution: z98.string().optional().describe("Triage resolution"),
+        notes: z98.string().optional().describe("Triage notes (mapped to triage_notes for bug/feature triage)"),
+        triage_notes: z98.string().optional().describe("Triage notes (legacy field name)"),
+        linked_task_id: supportTaskIdSchema.optional().describe("Linked task ID for triage"),
+        linked_commit: supportCommitSchema.optional().describe("Linked commit hash for triage"),
+        fixed_version: supportVersionSchema.optional().describe("Version that fixes this bug"),
+        shipped_version: supportVersionSchema.optional().describe("Version that ships this feature (features only)"),
+        add_evidence: z98.string().optional().describe("Owner self-service: additional evidence (logs, repro, stack traces) for update_bug"),
+        reopen_request: z98.boolean().optional().describe("Owner self-service: request a reopen on a recurring fixed bug (update_bug)"),
+        reopen_reason: z98.string().optional().describe("Owner self-service: why the bug should be reopened (update_bug)"),
+        attachments: z98.array(z98.object({
+          filename: z98.string().min(1).describe("Filename for the attachment"),
+          content: z98.string().min(1).describe("File content \u2014 plain text")
         })).optional().describe("File attachments for bug reports / feature requests (diffs, logs, config snippets)"),
-        source: z99.string().optional().describe("Review source: self-improve, manual, ci"),
-        pr_url: z99.string().optional().describe("PR URL (reviews)"),
-        review_resolution: z99.string().optional().describe("Resolution text (reviews)"),
-        limit: z99.coerce.number().optional().describe("Max results per page (up to 500)"),
-        offset: z99.coerce.number().optional().describe("Number of results to skip for pagination (list_my_bugs/list_my_features). Use next_offset from a prior response.")
+        source: z98.string().optional().describe("Review source: self-improve, manual, ci"),
+        pr_url: z98.string().optional().describe("PR URL (reviews)"),
+        review_resolution: z98.string().optional().describe("Resolution text (reviews)"),
+        limit: z98.coerce.number().int().min(1).max(500).optional().describe("Max results per page (up to 500)"),
+        offset: z98.coerce.number().int().min(0).optional().describe("Number of results to skip for pagination (list_bugs, list_features, list_reviews, list_my_bugs, list_my_features). Use next_offset from a prior response.")
       }
     },
     async (input, extra) => {
@@ -14068,7 +13969,7 @@ function registerSupportConsolidated(server) {
 }
 
 // src/mcp/tools/diagnostics.ts
-import { z as z100 } from "zod";
+import { z as z99 } from "zod";
 function buildHandlers9() {
   const tools = /* @__PURE__ */ new Map();
   const fake = {
@@ -14082,28 +13983,28 @@ function buildHandlers9() {
 function registerDiagnostics(server) {
   const handlers = buildHandlers9();
   const toolNames = Array.from(handlers.keys());
-  toolNames.push("tool_search", "drift", "merge_agent_memories", "agent_liveness", "steward_check", "steward_audit_log", "steward_override", "daemon_restarts", "spawn_failures", "orchestration_health", "work_map");
+  toolNames.push("tool_search", "drift", "merge_agent_memories", "agent_liveness", "steward_check", "steward_audit_log", "steward_override", "daemon_restarts", "timers", "spawn_failures", "orchestration_health", "work_map");
   server.registerTool(
     "diagnostics",
     {
       title: "Diagnostics",
-      description: `System diagnostics and admin operations. Actions: ${toolNames.join(", ")}. Covers health checks, update status, cloud status, key management, employee rename, semantic tool discovery (tool_search), identity drift detection (drift), agent liveness monitoring (agent_liveness), agent memory reassignment (merge_agent_memories), steward identity gate (steward_check, steward_audit_log, steward_override), daemon restart forensics (daemon_restarts \u2014 'why did the daemon restart?': restart-cause breakdown, slowest-timer leaderboard, event-loop-block frequency), and orchestration-health visibility: spawn_failures ('why did dispatch fail?': tmux spawn fail count + cause breakdown path_not_found/claude_launch_failed/timeout + success-vs-fail ratio), orchestration_health ('is the box healthy / is the spiral happening?': load/core, event-loop lag, direct-SQLite-fallback count, event-loop blocks), and work_map ('who's doing what / who died and why?': live sessions \xD7 role \xD7 task \xD7 worktree flag, plus recent session deaths with cause/load + worktree violations).`,
+      description: `System diagnostics and admin operations. Actions: ${toolNames.join(", ")}. Covers health checks, update status, cloud status, key management, employee rename, semantic tool discovery (tool_search), identity drift detection (drift), agent liveness monitoring (agent_liveness), agent memory reassignment (merge_agent_memories), steward identity gate (steward_check, steward_audit_log, steward_override), daemon restart forensics (daemon_restarts \u2014 'why did the daemon restart?': restart-cause breakdown, slowest-timer leaderboard, event-loop-block frequency), timer health dashboard (timers \u2014 'which background timer is about to take the daemon down?': per-timer last/avg/p95/max tick duration, watchdog trips past the 10s event-loop-block budget, whether the timer is executing right now, projected next fire \u2014 sorted worst-first; read-only over already-emitted daemon health logs), and orchestration-health visibility: spawn_failures ('why did dispatch fail?': tmux spawn fail count + cause breakdown path_not_found/claude_launch_failed/timeout + success-vs-fail ratio), orchestration_health ('is the box healthy / is the spiral happening?': load/core, event-loop lag, direct-SQLite-fallback count, event-loop blocks), and work_map ('who's doing what / who died and why?': live sessions \xD7 role \xD7 task \xD7 worktree flag, plus recent session deaths with cause/load + worktree violations).`,
       inputSchema: {
-        action: z100.string().describe(`Diagnostic operation: ${toolNames.join(", ")}`),
+        action: z99.string().describe(`Diagnostic operation: ${toolNames.join(", ")}`),
         // Pass-through params used by various sub-tools
-        agent_id: z100.string().optional().describe("Agent to probe (drift). Defaults to all agents."),
-        name: z100.string().optional().describe("Employee name (rename_employee)"),
-        new_name: z100.string().optional().describe("New employee name (rename_employee)"),
-        query: z100.string().optional().describe("Search/filter query, or natural language for tool_search"),
-        format: z100.string().optional().describe("Output format"),
-        limit: z100.coerce.number().int().min(1).max(100).optional().describe("Max results for tool_search (default 20)"),
-        from_agent_id: z100.string().optional().describe("Source agent ID to merge from (merge_agent_memories)"),
-        to_agent_id: z100.string().optional().describe("Target agent ID to merge into (merge_agent_memories)"),
-        dry_run: z100.boolean().optional().default(true).describe("Preview mode \u2014 show count without changing (merge_agent_memories). Default: true"),
+        agent_id: z99.string().optional().describe("Agent to probe (drift). Defaults to all agents."),
+        name: z99.string().optional().describe("Employee name (rename_employee)"),
+        new_name: z99.string().optional().describe("New employee name (rename_employee)"),
+        query: z99.string().optional().describe("Search/filter query, or natural language for tool_search"),
+        format: z99.string().optional().describe("Output format"),
+        limit: z99.coerce.number().int().min(1).max(100).optional().describe("Max results for tool_search (default 20)"),
+        from_agent_id: z99.string().optional().describe("Source agent ID to merge from (merge_agent_memories)"),
+        to_agent_id: z99.string().optional().describe("Target agent ID to merge into (merge_agent_memories)"),
+        dry_run: z99.boolean().optional().default(true).describe("Preview mode \u2014 show count without changing (merge_agent_memories). Default: true"),
         // Steward params (absorbed from steward tool)
-        operation: z100.string().optional().describe("Operation name for steward_check/steward_override"),
-        target: z100.string().optional().describe("Target resource for steward_check/steward_override"),
-        reason: z100.string().optional().describe("Override reason for steward_override")
+        operation: z99.string().optional().describe("Operation name for steward_check/steward_override"),
+        target: z99.string().optional().describe("Target resource for steward_check/steward_override"),
+        reason: z99.string().optional().describe("Override reason for steward_override")
       }
     },
     async (input, extra) => {
@@ -14136,6 +14037,21 @@ function registerDiagnostics(server) {
           return { content: [{ type: "text", text: `daemon_restarts failed: ${err instanceof Error ? err.message : String(err)}` }], isError: true };
         }
       }
+      if (action === "timers") {
+        try {
+          const { buildLiveTimerReport, formatTimerReport } = await import("./daemon-timer-report-NM44WQRH.js");
+          const report = await buildLiveTimerReport();
+          const asJson = input.format === "json";
+          return {
+            content: [{
+              type: "text",
+              text: asJson ? JSON.stringify(report, null, 2) : formatTimerReport(report)
+            }]
+          };
+        } catch (err) {
+          return { content: [{ type: "text", text: `timers failed: ${err instanceof Error ? err.message : String(err)}` }], isError: true };
+        }
+      }
       if (action === "spawn_failures") {
         return handleSpawnFailures();
       }
@@ -14268,7 +14184,7 @@ async function handleMergeAgentMemories(input) {
 }
 async function handleSpawnFailures() {
   try {
-    const { getOrchestrationMetrics } = await import("./orchestration-events-5SIJOE4H.js");
+    const { getOrchestrationMetrics } = await import("./orchestration-events-WV4NWKZH.js");
     const metrics = await getOrchestrationMetrics();
     const c = metrics.counts;
     const attempted = c.tmuxSpawnAttempted;
@@ -14370,7 +14286,7 @@ async function handleOrchestrationHealth() {
 async function handleWorkMap() {
   try {
     const { getAgentLivenessReport } = await import("./agent-heartbeat-I5UPGXAU.js");
-    const { classifyRole } = await import("./session-kill-telemetry-CZSPN5V6.js");
+    const { classifyRole } = await import("./session-kill-telemetry-AELE4JDK.js");
     const { buildSessionDeathSummary } = await import("./orchestration-health-read-EJWVUARG.js");
     const { getPaneCwd } = await import("./lib/tmux-status.js");
     const live = getAgentLivenessReport();
@@ -14505,7 +14421,7 @@ async function handleDrift(input) {
 }
 async function handleSteward(action, input) {
   const gate = new StewardGate();
-  const { getActiveAgent: getActiveAgent2 } = await import("./active-agent-EC6M7KTX.js");
+  const { getActiveAgent: getActiveAgent2 } = await import("./active-agent-PVGE57FY.js");
   const inputAgent = input.agent_id;
   const operation = input.operation;
   const target = input.target;
@@ -14553,7 +14469,7 @@ async function handleSteward(action, input) {
 }
 
 // src/mcp/tools/dreaming.ts
-import { z as z101 } from "zod";
+import { z as z100 } from "zod";
 function registerDreaming(server) {
   server.registerTool(
     "dreaming",
@@ -14561,10 +14477,10 @@ function registerDreaming(server) {
       title: "Dreaming",
       description: "Self-improvement loop \u2014 reviews recent work, identifies patterns, proposes behavior changes, and detects identity drift. Actions: run (execute dream cycle), status (last cycle result), history (past cycles).",
       inputSchema: {
-        action: z101.enum(["run", "status", "history"]).describe("Action to perform"),
-        agent_id: z101.string().optional().describe("Agent to analyze. Defaults to calling agent."),
-        hours: z101.coerce.number().min(1).max(720).optional().describe("Lookback window in hours (run). Default 24."),
-        limit: z101.coerce.number().int().min(1).max(50).optional().describe("Max results for history. Default 10.")
+        action: z100.enum(["run", "status", "history"]).describe("Action to perform"),
+        agent_id: z100.string().optional().describe("Agent to analyze. Defaults to calling agent."),
+        hours: z100.coerce.number().min(1).max(720).optional().describe("Lookback window in hours (run). Default 24."),
+        limit: z100.coerce.number().int().min(1).max(50).optional().describe("Max results for history. Default 10.")
       }
     },
     async ({ action, agent_id, hours, limit }) => {
@@ -14687,7 +14603,7 @@ ${String(row.raw_text)}`
 }
 
 // src/mcp/tools/steward.ts
-import { z as z102 } from "zod";
+import { z as z101 } from "zod";
 function errorResult11(text5) {
   return { content: [{ type: "text", text: text5 }], isError: true };
 }
@@ -14699,12 +14615,12 @@ function registerSteward(server) {
       title: "Steward Identity Gate",
       description: "Constitutional check before destructive operations. action=check: verify agent authority for an operation. action=audit_log: query the audit trail. action=override: coordinator-only bypass with reason.",
       inputSchema: {
-        action: z102.enum(["check", "audit_log", "override"]).describe("Steward operation to perform"),
-        agent: z102.string().optional().describe("Agent to check (defaults to calling agent for action=check)"),
-        operation: z102.string().optional().describe("Operation name (required for check/override)"),
-        target: z102.string().optional().describe("Target resource (required for check/override)"),
-        reason: z102.string().optional().describe("Override reason (required for action=override)"),
-        limit: z102.number().optional().describe("Max audit entries to return (default: 50)")
+        action: z101.enum(["check", "audit_log", "override"]).describe("Steward operation to perform"),
+        agent: z101.string().optional().describe("Agent to check (defaults to calling agent for action=check)"),
+        operation: z101.string().optional().describe("Operation name (required for check/override)"),
+        target: z101.string().optional().describe("Target resource (required for check/override)"),
+        reason: z101.string().optional().describe("Override reason (required for action=override)"),
+        limit: z101.number().optional().describe("Max audit entries to return (default: 50)")
       }
     },
     async (input) => {
@@ -14787,7 +14703,7 @@ function registerSteward(server) {
 }
 
 // src/mcp/tools/resonance.ts
-import { z as z103 } from "zod";
+import { z as z102 } from "zod";
 function text4(content, isError = false) {
   return { content: [{ type: "text", text: content }], ...isError ? { isError: true } : {} };
 }
@@ -14796,14 +14712,14 @@ function registerResonance(server) {
     title: "Resonance Network",
     description: "Co-activation network queries. Actions: hot_pairs (top co-activated memory pairs), neighbors (co-activation neighbors for a specific memory).",
     inputSchema: {
-      action: z103.enum(["hot_pairs", "neighbors"]).describe("Resonance query type"),
-      memory_id: z103.string().optional().describe("Memory ID for neighbors action"),
-      entity_id: z103.string().optional().describe("Deprecated alias for memory_id on neighbors action"),
-      limit: z103.number().optional().describe("Max results (default 20)")
+      action: z102.enum(["hot_pairs", "neighbors"]).describe("Resonance query type"),
+      memory_id: z102.string().optional().describe("Memory ID for neighbors action"),
+      entity_id: z102.string().optional().describe("Deprecated alias for memory_id on neighbors action"),
+      limit: z102.number().optional().describe("Max results (default 20)")
     }
   }, async ({ action, memory_id, entity_id, limit }) => {
     try {
-      const { getHotPairs, getCoActivationNeighbors } = await import("./co-activation-XMPHKGHR.js");
+      const { getHotPairs, getCoActivationNeighbors } = await import("./co-activation-ZCHPLLP6.js");
       if (action === "hot_pairs") {
         const pairs = await getHotPairs(limit ?? 20);
         if (pairs.length === 0) return text4("No co-activation data yet. Pairs are recorded as memories are accessed together in searches.");
@@ -15217,7 +15133,7 @@ ${err.stack ?? ""}` : String(err);
     gate("registerSupportTools", registerSupportTools);
     const hasAdminToken = !!(process.env.ASKEXE_SUPPORT_ADMIN_TOKEN || process.env.EXE_SUPPORT_ADMIN_TOKEN || (() => {
       try {
-        const c = JSON.parse(readFileSync8(join5(process.env.EXE_OS_DIR ?? join5(homedir5(), ".exe-os"), "config.json"), "utf-8"));
+        const c = JSON.parse(readFileSync7(join4(process.env.EXE_OS_DIR ?? join4(homedir5(), ".exe-os"), "config.json"), "utf-8"));
         return c.support?.adminToken || c.support?.admin_token;
       } catch {
         return "";