@askexenow/exe-os 0.9.341 → 0.9.342

package/dist/chunk-4QCFFW2H.js

@@ -0,0 +1,378 @@
+// src/lib/secret-redaction.ts
+import { validateMnemonic, wordlists } from "bip39";
+var URL_CREDENTIAL_PATTERNS = /* @__PURE__ */ new Set(["url_credentials"]);
+var SECRET_PATTERNS = [
+  // Any credentialed URL: scheme://user:pass@host. Generalized from the old
+  // postgres/mysql/mongodb/redis-only pattern so it also covers HTTP basic-auth
+  // (https://user:pass@host) and every other DB scheme (mssql, clickhouse, amqp,
+  // mongodb+srv, jdbc:*, ssh, …). Password is redacted; scheme+user preserved.
+  //
+  // The password class is `[^@\s]+` (NOT `[^@\s/]+`): real passwords frequently
+  // contain `/` (and `+`, `=`, percent-encodes), and per RFC 3986 userinfo runs
+  // up to the FIRST `@`, so stopping the password at `/` MISSED any password with
+  // a slash (e.g. `postgres://u:pa/ss@h` leaked `pa/ss`). Ending the class at `@`
+  // preserves the host/path (match stops at `@`; everything after is untouched).
+  // A `jdbc:postgresql://u:p@h` matches on the inner `postgresql://…` (the `\b`
+  // before `postgresql` after the `:`), and an IPv6 host `…@[::1]:5432` is after
+  // the `@` so it is preserved. See the url edge-case test rows.
+  //
+  // ReDoS: EVERY quantifier here is BOUNDED, never `*`/`+`. Two distinct O(n²)
+  // traps, both closed by caps:
+  //   (1) scheme `{0,30}` — with `*` and `-` in the class, hyphen-rich input
+  //       (`sk-sk-sk-…`) re-anchors at every word boundary and each start
+  //       greedily scans to EOF before failing to find `://`.
+  //   (2) userinfo `{1,64}` / `{1,1024}` — the password `[^@\s]` runs to the next
+  //       `@` or whitespace; adversarial `a://u:a://u:…` (no `@`, no space) made
+  //       each of the O(n) candidate URL starts scan+backtrack over the password
+  //       looking for `@` (measured 1212ms at 80 KB — textbook O(n²)). The cap
+  //       bounds each start's scan. It is 1024 (WIDENED from 256): a 256-cap MISSED
+  //       any credentialed URL whose password exceeded 256 chars — a long
+  //       token-as-password (a JWT or opaque bearer used as the userinfo password,
+  //       200–800+ chars) leaked ENTIRELY, since the rule failed to find `@` within
+  //       256 chars and gave up. 1024 covers every realistic password (incl. JWTs)
+  //       while keeping the `a://u:` ReDoS case comfortably under the time bound
+  //       (4096 measured ~1.1s — too slow; 1024 is ~1/4 of that, well within
+  //       margin). RESIDUAL (documented, accepted): a URL password LONGER than 1024
+  //       chars is not matched here — but that is beyond any realistic credential,
+  //       and a long password of a KNOWN shape (JWT, sk-…, etc.) is still caught by
+  //       its own rule independently. A miss is unrecoverable; we widen as far as
+  //       the ReDoS budget safely allows.
+  { name: "url_credentials", pattern: /\b([a-z][a-z0-9+.-]{0,30}):\/\/([^:\s/@]{1,64}):([^@\s]{1,1024})@/gi },
+  // Private-key PEM blocks. ENCRYPTED added — the old enum listed only the
+  // unencrypted variants so `-----BEGIN ENCRYPTED PRIVATE KEY-----` leaked.
+  //
+  // ReDoS: the body is BOUNDED `{0,8192}?`, not `*?`. With `*?`, many truncated
+  // `-----BEGIN … PRIVATE KEY-----` headers with NO matching `-----END` (a
+  // realistic pasted log) make the lazy scan rescan the tail from every BEGIN —
+  // O(n²), which becomes a multi-second hang on a large attachment. 8192 chars
+  // comfortably covers a real key body (RSA-4096 base64 ≈ 3.2 KB, incl. encrypted
+  // PKCS#8 headers), so each BEGIN gives up after ≤8 KB and the pass stays linear.
+  // PEM private-key block — ANY label (bug b4fc4a73 round 3, merged from
+  // fix/security-validation-20260711). Two deliberate widenings over the old
+  // fixed-alternation / 8 KiB form:
+  //   - LABEL: `[A-Z0-9 ]*PRIVATE KEY[A-Z ]*` admits plain PKCS8, ENCRYPTED, and
+  //     the PGP `PRIVATE KEY BLOCK` suffix. The old closed alternation missed any
+  //     label it did not enumerate — a miss here is a raw key shipped upstream.
+  //   - CAP 8192 -> 65536 (64 KiB): the body cap is what keeps this LINEAR (an
+  //     unbounded lazy body let repeated *unterminated* BEGIN headers rescan to
+  //     end-of-input, 6ms -> 572ms). But an 8 KiB cap is SMALLER than a
+  //     realistically-large key (RSA-16384, a bundled cert chain), so such a key
+  //     overran the window and LEAKED. 64 KiB covers them and is still linear.
+  { name: "private_key", pattern: /-----BEGIN [A-Z0-9 ]*PRIVATE KEY[A-Z ]*-----[\s\S]{0,65536}?-----END [A-Z0-9 ]*PRIVATE KEY[A-Z ]*-----/g, requires: "-----END" },
+  { name: "exe_license_key", pattern: /\bexe_sk_[A-Za-z0-9_-]{8,}\b/g },
+  { name: "anthropic_key", pattern: /\bsk-ant-[A-Za-z0-9_-]{20,}\b/g },
+  // OpenAI keys. FALSE-POSITIVE GUARD — done STRUCTURALLY, not by asserting the
+  // body contains any particular character class.
+  //
+  // Rejected approach (previous revision): requiring the body to contain an
+  // uppercase AND a digit. There is no published format contract guaranteeing
+  // that, so a short/unlucky all-lowercase-and-digits body would be MISSED — and
+  // for a last-line egress redactor a miss (a live key shipped upstream, silent
+  // and unrecoverable) is far worse than a false positive (a mangled bug report,
+  // visible and recoverable). We must never trade a miss for an FP.
+  //
+  // Structural discriminator (strategy A: length + charset):
+  //   - TYPED form — `sk-proj-`/`sk-svcacct-`/`sk-admin-` are unambiguous OpenAI
+  //     prefixes; match their long body regardless of its character mix.
+  //   - LEGACY bare `sk-` form — a real legacy key is `sk-` + a 40+ char base62
+  //     body with NO hyphens/underscores. A kebab identifier
+  //     (`sk-loading-spinner-container`) breaks at its first `-` (7 chars < 40)
+  //     so it cannot match, while an all-lowercase-and-digits real key
+  //     (`sk-abcdef0123…`, 40+ alnum) still does. This discriminates on
+  //     STRUCTURE (hyphen-free 40+ base62 run) — no assertion about which
+  //     character classes the body must contain — so the miss is closed.
+  { name: "openai_key", pattern: /\bsk-(?:proj|svcacct|admin)-[A-Za-z0-9_-]{20,}\b/g },
+  { name: "openai_key", pattern: /\bsk-[A-Za-z0-9]{40,}\b/g },
+  // Stripe secret + restricted keys (live and test are both secret).
+  { name: "stripe_key", pattern: /\b[sr]k_(?:live|test)_[A-Za-z0-9]{16,}\b/g },
+  // Slack bot/user/app tokens.
+  // No TRAILING \b (merged from fix/security-validation-20260711): a token whose
+  // last char is `-` has no word boundary before a following non-word char, so a
+  // trailing \b MISSED it. The leading \b + the b/a/p/r/s discriminator still keep
+  // ordinary "xox…" prose from matching.
+  { name: "slack_token", pattern: /\b(?:xox[baprs]|xapp)-[A-Za-z0-9-]{10,}/g },
+  // Slack incoming-webhook URL — the full path is the secret (no user:pass@, so
+  // url_credentials does not cover it).
+  { name: "slack_webhook", pattern: /\bhttps:\/\/hooks\.slack\.com\/services\/T[A-Z0-9]+\/B[A-Z0-9]+\/[A-Za-z0-9]+/g },
+  // npm automation/publish token: `npm_` + 36 base62.
+  { name: "npm_token", pattern: /\bnpm_[A-Za-z0-9]{36}\b/g },
+  // Google API key (AIza…, 39 chars) and OAuth access token (ya29.…).
+  // Negative lookahead, NOT a trailing \b (merged from
+  // fix/security-validation-20260711): a key ending in `-` or `_` has no word
+  // boundary before a following non-word char, so \b missed exactly those.
+  { name: "google_api_key", pattern: /\bAIza[0-9A-Za-z_-]{35}(?![A-Za-z0-9_-])/g },
+  { name: "google_oauth_token", pattern: /\bya29\.[0-9A-Za-z_-]{20,}\b/g },
+  // GitHub tokens: classic (ghp_/gho_/ghs_/ghu_/ghr_) + fine-grained (github_pat_).
+  { name: "github_token", pattern: /\bgh[pousr]_[A-Za-z0-9_]{30,}\b/g },
+  { name: "github_pat", pattern: /\bgithub_pat_[A-Za-z0-9_]{20,}\b/g },
+  // AWS secret access key (the 40-char base64 secret, no distinguishing prefix).
+  // HIGH FALSE-POSITIVE CLASS: a bare 40-char base64-ish string also describes a
+  // git SHA (40 hex) and countless hashes/ids, so we NEVER blanket-redact one.
+  // We redact it in only two safe, high-signal contexts:
+  //   (1) LABELED — right after a `secret[-_]access[-_]key` label. The `aws`
+  //       prefix is OPTIONAL and the word-joiner is `[_-]?`, so this matches the
+  //       snake/UPPER env form (`AWS_SECRET_ACCESS_KEY=…`), the camelCase SDK/JSON
+  //       form (`"secretAccessKey":"…"` — an AWS SDK error body), AND the
+  //       positional CLI flag (`--secret-access-key <secret>`, no `=`). The `/i`
+  //       flag makes `secretAccessKey` match `secret[_-]?access[_-]?key`.
+  //   (2) PROXIMITY — within 120 chars of a raw AWS access-key id (AKIA/ASIA…).
+  //       This runs BEFORE the access-key-id patterns so the anchor is intact;
+  //       it preserves the id + gap and redacts ONLY the trailing secret, so the
+  //       id is still redacted afterward by `aws_access_key`/`aws_temp_access_key`.
+  // RESIDUAL (accepted): a BARE, unlabeled 40-char secret with no access-key id
+  // within 120 chars is NOT redacted — it is indistinguishable from a git SHA /
+  // hash / opaque id, and blanket-redacting every 40-char token would mangle
+  // ordinary bug reports. Likelihood of this exact shape leaking is LOW-TO-MEDIUM
+  // (not nil): it needs an unlabeled secret pasted alone. The negative table pins
+  // that a git SHA is left untouched so the trade-off is visible.
+  // LABELED form. Word-joiner is `[_ -]?` — it MUST admit a literal SPACE, so the
+  // human/UI form ("AWS Secret Access Key: …") is caught, not just the snake/env
+  // form (merged from fix/security-validation-20260711; HEAD's `[_-]?` MISSED the
+  // spaced label = a live-credential leak). Body charset includes `=` so a
+  // base64-padded 40-char secret matches; the lookbehind/lookahead keep it from
+  // biting into an adjacent longer token.
+  { name: "aws_secret_access_key", pattern: /\b(?:aws[_ -]?)?secret[_ -]?access[_ -]?key\b["'\s:=,]{1,5}["']?(?<![A-Za-z0-9/+=])[A-Za-z0-9/+=]{40}(?![A-Za-z0-9/+=])/gi },
+  { name: "aws_secret_access_key", pattern: /((?:AKIA|ASIA)[0-9A-Z]{16}[\s\S]{0,120}?)(?<![A-Za-z0-9/+])([A-Za-z0-9/+]{40})(?![A-Za-z0-9/+])/g },
+  // AWS access-key ids: ASIA = temporary STS creds; AKIA = long-lived.
+  { name: "aws_temp_access_key", pattern: /\bASIA[0-9A-Z]{16}\b/g },
+  { name: "aws_access_key", pattern: /\bAKIA[0-9A-Z]{16}\b/g },
+  // Azure Storage account key: `AccountKey=<base64>` inside a connection string
+  // (`DefaultEndpointsProtocol=…;AccountName=…;AccountKey=<88-char base64>==;…`).
+  // Real keys are 64 bytes → 88 base64 chars incl. `==` padding; {40,} is a safe
+  // floor. Not matched by any other rule.
+  { name: "azure_storage_key", pattern: /\bAccountKey=[A-Za-z0-9+/]{40,}={0,2}/g },
+  { name: "bearer_token", pattern: /\bBearer\s+[A-Za-z0-9._~+/=-]{20,}\b/gi },
+  { name: "jwt", pattern: /\beyJ[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{10,}\b/g },
+  // Generic catch-alls run LAST. The `(?!\[REDACTED:)` guard makes them refuse to
+  // re-enter an already-emitted `[REDACTED:name]` marker: without it,
+  // `OPENAI_API_KEY=sk-proj-…` first became `OPENAI_API_KEY=[REDACTED:openai_key]`
+  // and then env_secret re-matched the whole assignment, OVER-COUNTING and
+  // rewriting the specific marker to the generic one. With the guard the specific
+  // marker survives and redactedCount counts each secret exactly once.
+  { name: "assignment_secret", pattern: /\b(api[_-]?key|secret|token|password|passwd|pwd|private[_-]?key|access[_-]?key)\s*[:=]\s*(['\"]?)(?!\[REDACTED:)[^\s'"]{8,}\2/gi },
+  { name: "env_secret", pattern: /\b[A-Z0-9_]*(?:API_KEY|SECRET|TOKEN|PASSWORD|PASSWD|PRIVATE_KEY|ACCESS_KEY)[A-Z0-9_]*\s*=\s*['\"]?(?!\[REDACTED:)[^'"\s]{8,}/g }
+];
+var REDACTION_CLASS_NAMES = [...new Set(SECRET_PATTERNS.map((p) => p.name)), "recovery_phrase"];
+var MNEMONIC_LENGTHS = [24, 21, 18, 15, 12];
+var BIP39_WORDS = new Set(wordlists.english);
+var WORD_TOKEN_RE = /\b[A-Za-z]{3,8}\b/g;
+function redactMnemonics(input) {
+  const tokens = [];
+  let m;
+  WORD_TOKEN_RE.lastIndex = 0;
+  while ((m = WORD_TOKEN_RE.exec(input)) !== null) {
+    const lower = m[0].toLowerCase();
+    tokens.push({ start: m.index, end: m.index + m[0].length, lower, isWordlist: BIP39_WORDS.has(lower) });
+  }
+  if (tokens.length < 12) return { text: input, count: 0 };
+  const spans = [];
+  let count = 0;
+  let segment = [];
+  const flushSegment = () => {
+    if (segment.length >= 12) {
+      let i = 0;
+      while (i < segment.length) {
+        let matchedLen = 0;
+        for (const len of MNEMONIC_LENGTHS) {
+          if (i + len > segment.length) continue;
+          const phrase = segment.slice(i, i + len).map((t) => t.lower).join(" ");
+          if (validateMnemonic(phrase)) {
+            matchedLen = len;
+            break;
+          }
+        }
+        if (matchedLen > 0) {
+          spans.push({ start: segment[i].start, end: segment[i + matchedLen - 1].end });
+          count++;
+          i += matchedLen;
+        } else {
+          i += 1;
+        }
+      }
+    }
+    segment = [];
+  };
+  for (const tok of tokens) {
+    if (!tok.isWordlist) {
+      flushSegment();
+      continue;
+    }
+    if (segment.length > 0) {
+      const gap = input.slice(segment[segment.length - 1].end, tok.start);
+      if (/[A-Za-z]/.test(gap)) flushSegment();
+    }
+    segment.push(tok);
+  }
+  flushSegment();
+  if (spans.length === 0) return { text: input, count: 0 };
+  let text = input;
+  for (let s = spans.length - 1; s >= 0; s--) {
+    text = text.slice(0, spans[s].start) + "[REDACTED:recovery_phrase]" + text.slice(spans[s].end);
+  }
+  return { text, count };
+}
+function redactSecrets(input) {
+  let text = input;
+  let redactedCount = 0;
+  for (const { name, pattern, requires } of SECRET_PATTERNS) {
+    if (requires !== void 0 && !text.includes(requires)) continue;
+    text = text.replace(pattern, (_match, ...args) => {
+      redactedCount++;
+      if (URL_CREDENTIAL_PATTERNS.has(name) && typeof args[0] === "string" && typeof args[1] === "string") {
+        return `${args[0]}://${args[1]}:[REDACTED:${name}]@`;
+      }
+      if (name === "aws_secret_access_key" && typeof args[0] === "string" && typeof args[1] === "string") {
+        return `${args[0]}[REDACTED:${name}]`;
+      }
+      return `[REDACTED:${name}]`;
+    });
+  }
+  const mnemonic = redactMnemonics(text);
+  text = mnemonic.text;
+  redactedCount += mnemonic.count;
+  return { text, redactedCount };
+}
+var UPSTREAM_ATTACHMENT_MAX_CHARS = 4096;
+function sanitizeUpstreamPayload(payload) {
+  let redactedCount = 0;
+  let truncatedCount = 0;
+  const walk = (value, keyHint) => {
+    if (typeof value === "string") {
+      const r = redactSecrets(value);
+      redactedCount += r.redactedCount;
+      let out = r.text;
+      if (keyHint === "content" && out.length > UPSTREAM_ATTACHMENT_MAX_CHARS) {
+        out = out.slice(0, UPSTREAM_ATTACHMENT_MAX_CHARS) + `
+... [truncated, ${out.length} chars total]`;
+        truncatedCount++;
+      }
+      return out;
+    }
+    if (Array.isArray(value)) {
+      return value.map((item) => walk(item, keyHint));
+    }
+    if (value && typeof value === "object") {
+      const out = {};
+      for (const [k, v] of Object.entries(value)) {
+        out[k] = walk(v, k);
+      }
+      return out;
+    }
+    return value;
+  };
+  const sanitized = walk(payload);
+  return { payload: sanitized, redactedCount, truncatedCount };
+}
+function isTelemetryRedactionEnabled(env = process.env) {
+  const raw = (env.EXE_TELEMETRY_REDACT ?? "").trim().toLowerCase();
+  return !(raw === "off" || raw === "0" || raw === "false");
+}
+function sanitizedUpstreamBody(payload, label = "support") {
+  if (!isTelemetryRedactionEnabled()) {
+    console.error(`[${label}] WARNING: EXE_TELEMETRY_REDACT=off \u2014 sending UNREDACTED payload upstream`);
+    return JSON.stringify(payload);
+  }
+  return JSON.stringify(sanitizeUpstreamPayload(payload).payload);
+}
+var CANONICAL_UUID_RE = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
+var SHORT_HEX_ID_RE = /^[0-9a-f]{8}$/i;
+function isWellFormedSupportId(id) {
+  const s = (id ?? "").trim();
+  return CANONICAL_UUID_RE.test(s) || SHORT_HEX_ID_RE.test(s);
+}
+var VERSION_RE = /^v?\d{1,5}(\.\d{1,5}){1,3}(-[0-9A-Za-z][0-9A-Za-z.]{0,14})?$/;
+function isWellFormedVersion(v) {
+  const s = (v ?? "").trim();
+  return s.length > 0 && s.length <= 40 && VERSION_RE.test(s);
+}
+var GIT_SHA_RE = /^[0-9a-f]{7,40}$/i;
+function isWellFormedCommit(c) {
+  return GIT_SHA_RE.test((c ?? "").trim());
+}
+function sanitizeVersionField(v) {
+  return typeof v === "string" && isWellFormedVersion(v) ? v : void 0;
+}
+function sanitizeUpstreamId(id) {
+  const s = (id ?? "").trim();
+  if (isWellFormedSupportId(s)) return s;
+  const redacted = redactSecrets(s).text;
+  return redacted !== s ? redacted : "invalid-id";
+}
+var SUPPORT_COLLECTIONS = /* @__PURE__ */ new Set(["bug-reports", "feature-requests", "reviews"]);
+function decodeSafe(seg) {
+  try {
+    return decodeURIComponent(seg);
+  } catch {
+    return seg;
+  }
+}
+function sanitizeSupportEndpointPath(endpointPath) {
+  const parts = String(endpointPath ?? "").replace(/^\/+|\/+$/g, "").split("/");
+  const collection = parts[0];
+  const id = parts[1];
+  if (!collection || !SUPPORT_COLLECTIONS.has(collection) || !id || parts.length < 2 || parts.length > 3) {
+    return "invalid/invalid-id";
+  }
+  const safeId = encodeURIComponent(sanitizeUpstreamId(decodeSafe(id)));
+  if (parts.length === 3) {
+    if (parts[2] !== "comments") return "invalid/invalid-id";
+    return `${collection}/${safeId}/comments`;
+  }
+  return `${collection}/${safeId}`;
+}
+var SUPPORT_PRODUCTS = [
+  "exe-os",
+  "exe-create",
+  "exe-wiki",
+  "exe-gateway",
+  "exe-crm",
+  "exe-build",
+  "exe-chat",
+  "exe-auth",
+  "exe-monitor",
+  "exe-db",
+  "exe-erp"
+];
+var SUPPORT_PRODUCT_SET = new Set(SUPPORT_PRODUCTS);
+function sanitizeProductFilter(product) {
+  return product && SUPPORT_PRODUCT_SET.has(product) ? product : void 0;
+}
+function redactDeepValue(value) {
+  const walk = (v) => {
+    if (typeof v === "string") return redactSecrets(v).text;
+    if (Array.isArray(v)) return v.map(walk);
+    if (v && typeof v === "object") {
+      const out = {};
+      for (const [k, val] of Object.entries(v)) {
+        out[redactSecrets(k).text] = walk(val);
+      }
+      return out;
+    }
+    return v;
+  };
+  return walk(value);
+}
+async function redactedToolResult(run) {
+  try {
+    return redactDeepValue(await run());
+  } catch (err) {
+    throw new Error(redactSecrets(err instanceof Error ? err.message : String(err)).text);
+  }
+}
+
+export {
+  redactSecrets,
+  UPSTREAM_ATTACHMENT_MAX_CHARS,
+  sanitizeUpstreamPayload,
+  isTelemetryRedactionEnabled,
+  sanitizedUpstreamBody,
+  isWellFormedSupportId,
+  isWellFormedVersion,
+  isWellFormedCommit,
+  sanitizeVersionField,
+  sanitizeUpstreamId,
+  sanitizeSupportEndpointPath,
+  SUPPORT_PRODUCTS,
+  sanitizeProductFilter,
+  redactedToolResult
+};

package/dist/{chunk-6MVC43X7.js → chunk-4VSV5P4D.js}

@@ -1,11 +1,11 @@
 import {
   ingest
-} from "./chunk-TWXZM34M.js";
+} from "./chunk-GBTTBXAF.js";
 import {
   listWorkflowDefinitions,
   runWorkflow,
   startWorkflow
-} from "./chunk-DNVFWFYF.js";
+} from "./chunk-AJYCFKJR.js";
 import {
   initCRMBridge
 } from "./chunk-ML4S5SHZ.js";

package/dist/{chunk-HJX6NCJF.js → chunk-4ZCD2UWW.js}

@@ -1,6 +1,6 @@
 import {
   routeTask
-} from "./chunk-HAZO7TRD.js";
+} from "./chunk-G5T6KDG4.js";
 import {
   createTaskCore,
   employeeSessionName,
@@ -9,11 +9,11 @@ import {
   isEmployeeAlive,
   sessionScopeFilter,
   updateTaskStatus
-} from "./chunk-KKOLHBNC.js";
+} from "./chunk-UP75Z5X7.js";
 import {
   DEFAULT_COORDINATOR_TEMPLATE_NAME,
   getCoordinatorName
-} from "./chunk-RWSLVYTE.js";
+} from "./chunk-AOHXREB7.js";
 
 // src/runtime/orchestrator.ts
 var STALE_THRESHOLD_MS = 2 * 60 * 60 * 1e3;
@@ -52,8 +52,9 @@ ${task.context}`,
       targetEmployee = routed.employee;
       routingScore = routed.score;
     }
+    let createdTaskId;
     try {
-      await createTaskCore({
+      const created = await createTaskCore({
         title: task.title,
         assignedTo: targetEmployee.name,
         assignedBy: getCoordinatorName(),
@@ -63,6 +64,7 @@ ${task.context}`,
         baseDir: this.config.projectDir,
         skipDispatch: true
       });
+      createdTaskId = created?.id;
     } catch (err) {
       return {
         employee: targetEmployee.name,
@@ -72,12 +74,39 @@ ${task.context}`,
         error: `Task creation failed: ${err instanceof Error ? err.message : String(err)}`
       };
     }
-    const result = ensureEmployee(
-      targetEmployee.name,
-      this.config.exeSession,
-      this.config.projectDir,
-      task.spawnOpts
-    );
+    const { tryAcquireDispatchClaim, releaseDispatchClaim } = await import("./dispatch-ack-VYH3ONSS.js");
+    if (createdTaskId && !tryAcquireDispatchClaim(createdTaskId, targetEmployee.name, this.config.exeSession)) {
+      return {
+        employee: targetEmployee.name,
+        sessionName: "",
+        status: "already_running",
+        routingScore,
+        error: void 0
+      };
+    }
+    let result;
+    try {
+      result = ensureEmployee(
+        targetEmployee.name,
+        this.config.exeSession,
+        this.config.projectDir,
+        task.spawnOpts
+      );
+    } catch (spawnErr) {
+      if (createdTaskId) {
+        try {
+          releaseDispatchClaim(createdTaskId, targetEmployee.name, "dispatch threw");
+        } catch {
+        }
+      }
+      throw spawnErr;
+    }
+    if (result.status === "failed" && createdTaskId) {
+      try {
+        releaseDispatchClaim(createdTaskId, targetEmployee.name, result.error ?? "dispatch failed");
+      } catch {
+      }
+    }
     return {
       employee: targetEmployee.name,
       sessionName: result.sessionName,

package/dist/{chunk-C445WRUX.js → chunk-5ERDIOV3.js}

@@ -9,10 +9,10 @@ import {
   getCoordinatorEmployee,
   getEmployee,
   loadEmployeesSync
-} from "./chunk-RWSLVYTE.js";
+} from "./chunk-AOHXREB7.js";
 import {
   EXE_AI_DIR
-} from "./chunk-7Y5UDEVM.js";
+} from "./chunk-WZHZCDDO.js";
 
 // src/lib/active-agent.ts
 import { readFileSync, writeFileSync, mkdirSync, unlinkSync, readdirSync } from "fs";

package/dist/chunk-5H47VHB7.js

@@ -0,0 +1,30 @@
+import {
+  SUPPORT_PRODUCTS,
+  isWellFormedCommit,
+  isWellFormedSupportId,
+  isWellFormedVersion
+} from "./chunk-4QCFFW2H.js";
+
+// src/lib/support-schemas.ts
+import { z } from "zod";
+var supportProductSchema = z.enum(SUPPORT_PRODUCTS);
+var supportIdSchema = z.string().refine(isWellFormedSupportId, {
+  message: "id must be a canonical UUID (8-4-4-4-12 hex) or an 8-character hex prefix"
+});
+var supportVersionSchema = z.string().refine(isWellFormedVersion, {
+  message: "version must look like 1.2.3 (optionally v-prefixed, optional -prerelease), max 40 chars"
+});
+var supportCommitSchema = z.string().refine(isWellFormedCommit, {
+  message: "commit must be a 7\u201340 character hex SHA"
+});
+var supportTaskIdSchema = z.string().refine(isWellFormedSupportId, {
+  message: "linked_task_id must be a canonical UUID or an 8-character hex prefix"
+});
+
+export {
+  supportProductSchema,
+  supportIdSchema,
+  supportVersionSchema,
+  supportCommitSchema,
+  supportTaskIdSchema
+};

package/dist/{chunk-BJ23BNED.js → chunk-5TY4FPH6.js}

@@ -6,7 +6,7 @@ import {
   connectEmbedDaemon,
   isClientConnected,
   sendDaemonRequest
-} from "./chunk-UU4UINUX.js";
+} from "./chunk-G4RGKBCA.js";
 
 // src/lib/db-daemon-client.ts
 function normalizeStatement(stmt) {

package/dist/{chunk-WD55PEBM.js → chunk-6CH3TPHR.js}

@@ -1,20 +1,20 @@
 import {
   cleanupCardsForMemories,
   cleanupGraphLinksForMemories
-} from "./chunk-7UMCQQWS.js";
+} from "./chunk-A4DVMPYB.js";
 import {
   resolveAnthropicAuth
 } from "./chunk-VGMACSEV.js";
 import {
   vectorToBlob
-} from "./chunk-EDH54E5A.js";
+} from "./chunk-VSRPS3J7.js";
 import {
   extractKeywords,
   keywordsToString
 } from "./chunk-CHCA3ZM2.js";
 import {
   isCoordinatorName
-} from "./chunk-RWSLVYTE.js";
+} from "./chunk-AOHXREB7.js";
 
 // src/lib/consolidation.ts
 import { randomUUID } from "crypto";

package/dist/{chunk-TIXTHUVJ.js → chunk-6WQ3NNCE.js}

@@ -1,16 +1,16 @@
 import {
   extractMemoryGraph
-} from "./chunk-ITMEE7PQ.js";
+} from "./chunk-7V4JADD6.js";
 import {
   flushBatch,
   writeMemory
-} from "./chunk-EDH54E5A.js";
+} from "./chunk-VSRPS3J7.js";
 import {
   extractKeywords
 } from "./chunk-CHCA3ZM2.js";
 import {
   getActiveAgent
-} from "./chunk-C445WRUX.js";
+} from "./chunk-5ERDIOV3.js";
 
 // src/mcp/tools/import-conversations.ts
 import { z } from "zod";

package/dist/{chunk-7LF5DS3A.js → chunk-6XWTQUO4.js}

@@ -1,6 +1,6 @@
 import {
   redactSecrets
-} from "./chunk-RP5GETX5.js";
+} from "./chunk-4QCFFW2H.js";
 
 // src/lib/memory-write-governor.ts
 import { createHash } from "crypto";

package/dist/chunk-76CJBM36.js

@@ -0,0 +1,88 @@
+// src/lib/current-task-cache.ts
+import { existsSync, mkdirSync, readFileSync, unlinkSync, writeFileSync } from "fs";
+import path from "path";
+function sessionCacheDir() {
+  const base = process.env.EXE_OS_DIR ?? path.join(process.env.HOME ?? "", ".exe-os");
+  return path.join(base, "session-cache");
+}
+function normalizeSessionScope(hint) {
+  if (!hint) return void 0;
+  const trimmed = String(hint).trim();
+  if (!trimmed) return void 0;
+  const dash = trimmed.lastIndexOf("-");
+  const scope = dash > 0 ? trimmed.slice(dash + 1) : trimmed;
+  const safe = scope.replace(/[^a-zA-Z0-9_]/g, "");
+  return safe.length > 0 ? safe : void 0;
+}
+function currentTaskMarkerPaths(agent, sessionScope) {
+  const dir = sessionCacheDir();
+  const scope = normalizeSessionScope(sessionScope);
+  return {
+    legacy: path.join(dir, `current-task-${agent}.json`),
+    scoped: scope ? path.join(dir, `current-task-${agent}--${scope}.json`) : null
+  };
+}
+function readMarker(file) {
+  try {
+    if (!existsSync(file)) return null;
+    const parsed = JSON.parse(readFileSync(file, "utf8"));
+    return parsed.taskId ? parsed : null;
+  } catch {
+    return null;
+  }
+}
+function writeCurrentTask(input) {
+  const { agent, taskId, title } = input;
+  const scope = normalizeSessionScope(input.sessionScope);
+  const { legacy, scoped } = currentTaskMarkerPaths(agent, scope);
+  const payload = {
+    taskId,
+    title,
+    sessionScope: scope,
+    updatedAt: (/* @__PURE__ */ new Date()).toISOString()
+  };
+  const body = JSON.stringify(payload);
+  try {
+    mkdirSync(sessionCacheDir(), { recursive: true });
+    writeFileSync(legacy, body, { mode: 384 });
+    if (scoped) writeFileSync(scoped, body, { mode: 384 });
+  } catch {
+  }
+}
+function resolveCurrentTask(agent, sessionScope) {
+  const { legacy, scoped } = currentTaskMarkerPaths(agent, sessionScope);
+  if (scoped) {
+    const hit = readMarker(scoped);
+    if (hit) return hit;
+    const fallback = readMarker(legacy);
+    if (fallback?.sessionScope && fallback.sessionScope !== normalizeSessionScope(sessionScope)) {
+      return null;
+    }
+    return fallback;
+  }
+  return readMarker(legacy);
+}
+function clearCurrentTask(input) {
+  const { agent, taskId } = input;
+  const { legacy, scoped } = currentTaskMarkerPaths(agent, input.sessionScope);
+  if (scoped) {
+    try {
+      unlinkSync(scoped);
+    } catch {
+    }
+  }
+  const legacyMarker = readMarker(legacy);
+  if (!legacyMarker) return;
+  if (taskId && legacyMarker.taskId !== taskId) return;
+  try {
+    unlinkSync(legacy);
+  } catch {
+  }
+}
+
+export {
+  normalizeSessionScope,
+  writeCurrentTask,
+  resolveCurrentTask,
+  clearCurrentTask
+};