@askexenow/exe-os 0.9.341 → 0.9.342

package/dist/{chunk-HCJCW7X4.js → chunk-H7I47RS5.js}

@@ -1,6 +1,6 @@
 import {
   EXE_AI_DIR
-} from "./chunk-7Y5UDEVM.js";
+} from "./chunk-WZHZCDDO.js";
 
 // src/lib/memory-queue.ts
 import {
@@ -73,6 +73,38 @@ function retryQueueEntries(leasePath, entries) {
   }
   writeFileSync(leasePath, entries.map((entry) => JSON.stringify(entry)).join("\n") + "\n");
 }
+async function processQueueEntries(entries, writeEntry, options = {}) {
+  const batchSize = Math.max(1, options.batchSize ?? 1);
+  const yieldFn = options.yieldFn ?? (() => new Promise((resolve) => setImmediate(resolve)));
+  const isDraining = options.isDraining ?? (() => false);
+  const retryEntries = [];
+  let processed = 0;
+  let preserved = 0;
+  let sinceYield = 0;
+  for (let i = 0; i < entries.length; i++) {
+    if (isDraining()) {
+      const remaining = entries.slice(i).filter((e) => e.raw_text && e.raw_text.length >= 10);
+      retryEntries.push(...remaining);
+      preserved = remaining.length;
+      if (preserved > 0) options.onShutdownPreserve?.(preserved);
+      break;
+    }
+    const entry = entries[i];
+    if (!entry.raw_text || entry.raw_text.length < 10) continue;
+    try {
+      await writeEntry(entry);
+      processed++;
+    } catch (err) {
+      retryEntries.push(entry);
+      options.onWriteError?.(entry, err);
+    }
+    if (++sinceYield >= batchSize) {
+      sinceYield = 0;
+      await yieldFn();
+    }
+  }
+  return { processed, retryEntries, preserved };
+}
 function drainQueue() {
   const entries = [];
   while (true) {
@@ -185,6 +217,7 @@ export {
   claimQueue,
   ackQueue,
   retryQueueEntries,
+  processQueueEntries,
   drainQueue,
   queueDepth
 };

package/dist/{chunk-GFDGDFBF.js → chunk-HA5R6USD.js}

@@ -1,14 +1,19 @@
+import {
+  assertCodexModelForAuth,
+  describeCodexModelAvailability,
+  detectCodexAuthType
+} from "./chunk-AM7S2TY6.js";
 import {
   DEFAULT_RUNTIME,
   RUNTIME_TABLE
 } from "./chunk-NGP6LSV2.js";
 import {
   EXE_AI_DIR
-} from "./chunk-7Y5UDEVM.js";
+} from "./chunk-WZHZCDDO.js";
 import {
   atomicWriteJsonSync,
   ensurePrivateDirSync
-} from "./chunk-SHIICYJW.js";
+} from "./chunk-BYTDMAGB.js";
 
 // src/lib/agent-config.ts
 import { readFileSync, existsSync } from "fs";
@@ -16,6 +21,14 @@ import path from "path";
 var AGENT_CONFIG_PATH = path.join(EXE_AI_DIR, "agent-config.json");
 var KNOWN_RUNTIMES = {
   claude: ["claude-opus-4.8", "claude-opus-4.8-1m", "claude-opus-4.6", "claude-sonnet-4.8", "claude-sonnet-4.6", "claude-haiku-4.5", "claude-fable-5"],
+  // Bug fbf99272: this list MUST contain RUNTIME_TABLE.codex.defaultModel — the
+  // adapter's own default — or a default codex spawn boots an unlisted model that
+  // 400s and idles (asserted by an agent-config-models test so they cannot drift).
+  // Codex model availability also depends on AUTH TYPE (ChatGPT account vs OpenAI
+  // API key); see codex-auth.ts for the auth-aware preflight. Do NOT add
+  // "gpt-5.6" here: VERIFIED 2026-07-10 to 400 ("not supported … with a ChatGPT
+  // account"). "gpt-5.3-codex" (the Codex CLI's own default) is likewise NOT
+  // whitelisted for the same reason — exe-start-codex pins a listed model instead.
   codex: ["gpt-5.4", "gpt-5.5", "gpt-5.3-codex-spark", "o3", "o4-mini"],
   opencode: ["anthropic/claude-opus-4-8", "anthropic/claude-sonnet-4-8", "anthropic/claude-sonnet-4-6", "openai/gpt-5.4", "google/gemini-2.5-pro", "deepseek/deepseek-r3", "minimax/minimax-m2.5", "xai/grok-4", "xai/grok-3", "xai/grok-2-latest", "xai/grok-2-1212", "xai/grok-beta"]
 };
@@ -125,7 +138,7 @@ function resolveSpawnRuntimeConfig(agentId, runtimeOverride, modelOverride) {
     ...modelOverride ? { model: modelOverride } : {}
   };
 }
-function assertRuntimeModelCompatible(runtime, model) {
+function assertRuntimeModelCompatible(runtime, model, opts) {
   const replacement = retiredModelReplacement(model);
   if (replacement) {
     return {
@@ -134,12 +147,16 @@ function assertRuntimeModelCompatible(runtime, model) {
     };
   }
   if (runtime === "codex" && model && isClaudeModel(model)) {
-    const codexModels = KNOWN_RUNTIMES.codex?.join(", ") ?? "gpt-* models";
     return {
       ok: false,
-      error: `Runtime/model mismatch: runtime "codex" cannot run Claude model "${model}". Codex (ChatGPT account) only supports OpenAI models (${codexModels}). Pass a Codex spawn_model, or set the agent's runtime to "claude". Rejected before spawn to avoid a silently dead session (bug a403e1f4).`
+      error: `Runtime/model mismatch: runtime "codex" cannot run Claude model "${model}". Codex needs an OpenAI model (${describeCodexModelAvailability(KNOWN_RUNTIMES.codex ?? [])}). Pass a Codex spawn_model, or set the agent's runtime to "claude". Rejected before spawn to avoid a silently dead session (bug a403e1f4).`
     };
   }
+  if (runtime === "codex" && model) {
+    const authType = opts?.codexAuthType ?? detectCodexAuthType();
+    const authCheck = assertCodexModelForAuth(model, authType, KNOWN_RUNTIMES.codex ?? []);
+    if (!authCheck.ok) return authCheck;
+  }
   if (model && KNOWN_RUNTIMES[runtime]) {
     const validated = validateRuntimeModel(runtime, model);
     if (!validated.ok) {

package/dist/{chunk-L2YGXJGF.js → chunk-HAF2DJYV.js}

@@ -1,10 +1,10 @@
 import {
   sessionScopeFilter
-} from "./chunk-KKOLHBNC.js";
+} from "./chunk-UP75Z5X7.js";
 import {
   getClient,
   getIdentity
-} from "./chunk-RWSLVYTE.js";
+} from "./chunk-AOHXREB7.js";
 import {
   getEmotionalBaseline
 } from "./chunk-PNQDP3OA.js";
@@ -643,7 +643,7 @@ var DreamingEngine = class {
     }
     let overdueProspective = [];
     try {
-      const { getOverdueProspective, completeProspective } = await import("./prospective-memory-UACFTYXK.js");
+      const { getOverdueProspective, completeProspective } = await import("./prospective-memory-6D2ASWM3.js");
       const overdue = await getOverdueProspective(agentId);
       overdueProspective = overdue.map((o) => ({
         id: o.id,

package/dist/chunk-HJ447YER.js

@@ -0,0 +1,224 @@
+// src/lib/daemon-restart-circuit-breaker.ts
+import { existsSync, readFileSync, writeFileSync, unlinkSync, mkdirSync, renameSync } from "fs";
+import path from "path";
+import os from "os";
+var RESTART_BREAKER_THRESHOLD = (() => {
+  const raw = Number(process.env.EXE_RESTART_BREAKER_THRESHOLD);
+  return Number.isFinite(raw) && raw >= 2 ? Math.floor(raw) : 5;
+})();
+var RESTART_BREAKER_WINDOW_MS = (() => {
+  const raw = Number(process.env.EXE_RESTART_BREAKER_WINDOW_MS);
+  return Number.isFinite(raw) && raw > 0 ? Math.floor(raw) : 60 * 60 * 1e3;
+})();
+var EXE_DIR = path.join(os.homedir(), ".exe-os");
+var STATE_PATH = path.join(EXE_DIR, "daemon-restart-breaker.json");
+var ALERT_PATH = path.join(EXE_DIR, "daemon-restart-breaker.ALERT.json");
+var LAST_EXIT_PATH = path.join(EXE_DIR, "daemon-last-exit.json");
+var DELIBERATE_REASON_SUBSTRINGS = ["deploy", "update", "install", "manual", "key-rotation", "config-reload"];
+var SELF_HEAL_REASON_SUBSTRINGS = ["self_heal", "self-heal", "event_loop", "event-loop", "lag", "rss", "stale-dist", "watchdog"];
+function writeStateAtomic(p, data) {
+  if (!existsSync(EXE_DIR)) mkdirSync(EXE_DIR, { recursive: true });
+  const tmp = `${p}.${process.pid}.${Math.random().toString(36).slice(2)}.tmp`;
+  writeFileSync(tmp, data, { mode: 384 });
+  renameSync(tmp, p);
+}
+var REAL_DEPS = {
+  statePath: STATE_PATH,
+  alertPath: ALERT_PATH,
+  lastExitPath: LAST_EXIT_PATH,
+  exists: existsSync,
+  read: (p) => readFileSync(p, "utf8"),
+  write: writeStateAtomic,
+  remove: (p) => {
+    if (existsSync(p)) unlinkSync(p);
+  },
+  now: () => Date.now()
+};
+function classifyBoot(lastExit) {
+  if (!lastExit) return { bootClass: "crash", label: "no-breadcrumb (SIGKILL/OOM/panic)" };
+  const reason = (lastExit.reason ?? "").toLowerCase();
+  const kind = (lastExit.kind ?? "").toLowerCase();
+  if (reason && DELIBERATE_REASON_SUBSTRINGS.some((s) => reason.includes(s))) {
+    return { bootClass: "deliberate", label: `deliberate:${reason}` };
+  }
+  if (kind === "self_heal" || SELF_HEAL_REASON_SUBSTRINGS.some((s) => reason.includes(s))) {
+    return { bootClass: "self_heal", label: `self_heal:${reason || kind}` };
+  }
+  if (kind === "clean" || lastExit.exitCode === 0 && !reason) {
+    return { bootClass: "deliberate", label: "clean-exit" };
+  }
+  return { bootClass: "crash", label: `crash:${kind}${reason ? `:${reason}` : ""}` };
+}
+function evaluateRestartBreaker(prev, now, bootClass, windowMs = RESTART_BREAKER_WINDOW_MS, threshold = RESTART_BREAKER_THRESHOLD) {
+  const recent = (Array.isArray(prev) ? prev : []).filter((e) => e && typeof e.t === "number" && Number.isFinite(e.t) && now - e.t < windowMs);
+  if (bootClass === "crash") recent.push({ t: now, c: "x" });
+  else if (bootClass === "self_heal") recent.push({ t: now, c: "s" });
+  recent.sort((a, b) => a.t - b.t);
+  const crashInWindow = recent.filter((e) => e.c === "x").length;
+  return { trip: crashInWindow >= threshold, crashInWindow, restartsInWindow: recent.length, entries: recent };
+}
+function loadStateEntries(deps) {
+  try {
+    if (!deps.exists(deps.statePath)) return [];
+    const parsed = JSON.parse(deps.read(deps.statePath));
+    if (!Array.isArray(parsed.restarts)) throw new Error("restarts is not an array");
+    return parsed.restarts.map((e) => {
+      if (typeof e === "number" && Number.isFinite(e)) return { t: e, c: "x" };
+      if (e && typeof e.t === "number") {
+        const c = e.c === "s" ? "s" : "x";
+        return { t: e.t, c };
+      }
+      return null;
+    }).filter((e) => e !== null);
+  } catch (err) {
+    process.stderr.write(
+      `[exed] Restart-breaker state file unreadable \u2014 FAILING OPEN (treating as empty, will not trip): ${err instanceof Error ? err.message : String(err)}
+`
+    );
+    return [];
+  }
+}
+function readLastExit(deps) {
+  try {
+    if (!deps.exists(deps.lastExitPath)) return null;
+    const p = JSON.parse(deps.read(deps.lastExitPath));
+    if (typeof p.exitCode !== "number" || typeof p.kind !== "string") return null;
+    return {
+      exitCode: p.exitCode,
+      reason: typeof p.reason === "string" ? p.reason : null,
+      kind: p.kind,
+      ts: typeof p.ts === "number" ? p.ts : 0,
+      ...typeof p.uptimeMs === "number" ? { uptimeMs: p.uptimeMs } : {},
+      ...typeof p.lagMs === "number" ? { lagMs: p.lagMs } : {},
+      ...typeof p.timerName === "string" ? { timerName: p.timerName } : {},
+      ...typeof p.timerDurationMs === "number" ? { timerDurationMs: p.timerDurationMs } : {},
+      ...typeof p.rssBytes === "number" ? { rssBytes: p.rssBytes } : {}
+    };
+  } catch {
+    return null;
+  }
+}
+function recordDaemonRestart(deps = REAL_DEPS) {
+  const lastExit = readLastExit(deps);
+  const { bootClass, label } = classifyBoot(lastExit);
+  try {
+    deps.remove(deps.lastExitPath);
+  } catch {
+  }
+  const now = deps.now();
+  const ev = evaluateRestartBreaker(loadStateEntries(deps), now, bootClass);
+  try {
+    deps.write(deps.statePath, JSON.stringify({ restarts: ev.entries }));
+  } catch {
+  }
+  const decision = {
+    trip: ev.trip,
+    bootClass,
+    crashInWindow: ev.crashInWindow,
+    restartsInWindow: ev.restartsInWindow,
+    reasonLabel: label,
+    entries: ev.entries
+  };
+  if (decision.trip) writeBreakerAlert(decision, lastExit, deps);
+  return decision;
+}
+function crashBootsInWindow(deps = REAL_DEPS, windowMs = RESTART_BREAKER_WINDOW_MS) {
+  const now = deps.now();
+  return loadStateEntries(deps).filter((e) => e.c === "x" && now - e.t < windowMs).length;
+}
+function restartBootsInWindow(deps = REAL_DEPS, windowMs = RESTART_BREAKER_WINDOW_MS) {
+  const now = deps.now();
+  return loadStateEntries(deps).filter((e) => now - e.t < windowMs).length;
+}
+function writeBreakerAlert(decision, lastExit, deps = REAL_DEPS) {
+  const windowMin = Math.round(RESTART_BREAKER_WINDOW_MS / 6e4);
+  const alert = {
+    trippedAt: new Date(deps.now()).toISOString(),
+    crashRestartsInWindow: decision.crashInWindow,
+    totalRestartsInWindow: decision.restartsInWindow,
+    windowMs: RESTART_BREAKER_WINDOW_MS,
+    threshold: RESTART_BREAKER_THRESHOLD,
+    restartTimestamps: decision.entries.map((e) => ({ at: new Date(e.t).toISOString(), class: e.c === "x" ? "crash" : "self_heal" })),
+    lastBootClassification: decision.reasonLabel,
+    lastExit: lastExit ?? "none (SIGKILL/OOM left no breadcrumb)",
+    reason: `Daemon suffered ${decision.crashInWindow} CRASH restarts within ${windowMin}min \u2014 crash-loop circuit breaker OPEN. The daemon is now in DEGRADED mode (health endpoint only, no heavy work) to protect system memory (bug 2fee6110).`,
+    recovery: {
+      automatic: `Self-clears once ${windowMin}min pass with no further crashes.`,
+      manual: `Run 'exe-os daemon reset-breaker' (clears state + alert), then relaunch the daemon.`,
+      inspect: `'exe-os daemon status' shows the crash timestamps and last exit.`
+    }
+  };
+  try {
+    deps.write(deps.alertPath, JSON.stringify(alert, null, 2));
+  } catch {
+  }
+  process.stderr.write(
+    `
+[exed] ========================================================================
+[exed] RESTART CIRCUIT BREAKER TRIPPED \u2014 ${decision.crashInWindow} CRASH restarts in ${windowMin}min.
+[exed] Entering DEGRADED mode (no backups/DB/embeddings) to avoid an OOM machine crash (bug 2fee6110).
+[exed] Alert: ${deps.alertPath}
+[exed] Recover: 'exe-os daemon reset-breaker' then relaunch. Inspect: 'exe-os daemon status'.
+[exed] ========================================================================
+
+`
+  );
+}
+function isRestartBreakerTripped(deps = REAL_DEPS) {
+  try {
+    return deps.exists(deps.alertPath);
+  } catch {
+    return false;
+  }
+}
+function readBreakerAlert(deps = REAL_DEPS) {
+  try {
+    if (!deps.exists(deps.alertPath)) return null;
+    return JSON.parse(deps.read(deps.alertPath));
+  } catch {
+    return null;
+  }
+}
+function restartBreakerAlertPath() {
+  return ALERT_PATH;
+}
+function restartBreakerStatePath() {
+  return STATE_PATH;
+}
+function daemonLastExitPath() {
+  return LAST_EXIT_PATH;
+}
+function resetRestartBreaker(deps = REAL_DEPS) {
+  try {
+    deps.remove(deps.statePath);
+  } catch {
+  }
+  try {
+    deps.remove(deps.alertPath);
+  } catch {
+  }
+}
+function writeDaemonExitBreadcrumb(info, deps = REAL_DEPS) {
+  try {
+    deps.write(deps.lastExitPath, JSON.stringify(info));
+  } catch {
+  }
+}
+
+export {
+  RESTART_BREAKER_THRESHOLD,
+  RESTART_BREAKER_WINDOW_MS,
+  classifyBoot,
+  evaluateRestartBreaker,
+  recordDaemonRestart,
+  crashBootsInWindow,
+  restartBootsInWindow,
+  writeBreakerAlert,
+  isRestartBreakerTripped,
+  readBreakerAlert,
+  restartBreakerAlertPath,
+  restartBreakerStatePath,
+  daemonLastExitPath,
+  resetRestartBreaker,
+  writeDaemonExitBreadcrumb
+};

package/dist/{chunk-6QW6JHRE.js → chunk-HV4KESRY.js}

@@ -1,10 +1,20 @@
 import {
+  supportCommitSchema,
+  supportIdSchema,
+  supportProductSchema,
+  supportTaskIdSchema,
+  supportVersionSchema
+} from "./chunk-5H47VHB7.js";
+import {
+  SUPPORT_PRODUCTS,
+  sanitizeProductFilter,
+  sanitizeUpstreamId,
   sanitizedUpstreamBody
-} from "./chunk-RP5GETX5.js";
+} from "./chunk-4QCFFW2H.js";
 import {
   loadLicense,
   readCachedLicenseToken
-} from "./chunk-7SEC2AG5.js";
+} from "./chunk-PQIDGXSG.js";
 
 // src/mcp/tools/support-inbox.ts
 import { z } from "zod";
@@ -101,7 +111,7 @@ async function fetchJson(url, headers, init) {
 async function commentRequestJson(bugId, init) {
   const token = adminToken();
   if (token) {
-    const url2 = `${endpoint()}/${encodeURIComponent(bugId)}/comments`;
+    const url2 = `${endpoint()}/${encodeURIComponent(sanitizeUpstreamId(bugId))}/comments`;
     return fetchJson(url2, { authorization: `Bearer ${token}` }, init);
   }
   const ownerHeaders = ownerAuthHeaders();
@@ -110,7 +120,7 @@ async function commentRequestJson(bugId, init) {
       "Not authenticated for support comments. Run `exe-os login` (GoTrue) or set a license key, or configure an AskExe admin token (ASKEXE_SUPPORT_ADMIN_TOKEN)."
     );
   }
-  const url = `${ownerEndpoint()}/${encodeURIComponent(bugId)}/comments`;
+  const url = `${ownerEndpoint()}/${encodeURIComponent(sanitizeUpstreamId(bugId))}/comments`;
   return fetchJson(url, ownerHeaders, init);
 }
 function registerListBugReports(server) {
@@ -122,14 +132,21 @@ function registerListBugReports(server) {
       inputSchema: {
         status: z.enum(["all", "open", "triaged", "fixed", "closed", "wontfix"]).default("open"),
         severity: z.enum(["p0", "p1", "p2", "p3"]).optional(),
-        limit: z.number().int().min(1).max(100).default(25)
+        // Round 8: constrain to the known enum at the schema — a `product` filter is
+        // NOT free text, and it was sent raw as a query param.
+        product: z.enum(SUPPORT_PRODUCTS).optional().describe("Filter by product"),
+        limit: z.number().int().min(1).max(500).default(25),
+        offset: z.number().int().min(0).default(0).describe("Number of results to skip for pagination. Use next_offset from a prior response.")
       }
     },
-    async ({ status, severity, limit }) => {
+    async ({ status, severity, product, limit, offset }) => {
       const url = new URL(endpoint());
       url.searchParams.set("status", status);
       url.searchParams.set("limit", String(limit));
+      url.searchParams.set("offset", String(offset));
       if (severity) url.searchParams.set("severity", severity);
+      const safeProduct = sanitizeProductFilter(product);
+      if (safeProduct) url.searchParams.set("product", safeProduct);
       const data = await requestJson(url.toString());
       return { content: [{ type: "text", text: JSON.stringify(data, null, 2) }] };
     }
@@ -152,10 +169,10 @@ function registerGetBugReport(server) {
     {
       title: "Get Bug Report",
       description: "AskExe-internal only: fetch one customer bug report with full markdown payload and comments thread.",
-      inputSchema: { id: z.string().min(8) }
+      inputSchema: { id: supportIdSchema }
     },
     async ({ id }) => {
-      const data = await requestJson(`${endpoint()}/${encodeURIComponent(id)}`);
+      const data = await requestJson(`${endpoint()}/${encodeURIComponent(sanitizeUpstreamId(id))}`);
       const comments = parseComments(data);
       const enriched = data && typeof data === "object" ? { ...data, comments } : { id, comments };
       return { content: [{ type: "text", text: JSON.stringify(enriched, null, 2) }] };
@@ -169,7 +186,7 @@ function registerAddBugReportComment(server) {
       title: "Add Bug Report Comment",
       description: "AskExe-internal only: append a comment to a bug report's thread (POST /comments). Non-destructive \u2014 does not touch triage_notes or status.",
       inputSchema: {
-        id: z.string().min(8),
+        id: supportIdSchema,
         comment: z.string().min(1).describe("Comment text to append to the bug report thread")
       }
     },
@@ -188,7 +205,7 @@ function registerGetBugReportComments(server) {
     {
       title: "Get Bug Report Comments",
       description: "AskExe-internal only: list the comments thread on a bug report (GET /comments).",
-      inputSchema: { id: z.string().min(8) }
+      inputSchema: { id: supportIdSchema }
     },
     async ({ id }) => {
       const data = await commentRequestJson(id);
@@ -203,19 +220,19 @@ function registerTriageBugReport(server) {
       title: "Triage Bug Report",
       description: "AskExe-internal only: update bug report status and link task/commit/release metadata.",
       inputSchema: {
-        id: z.string().min(8),
+        id: supportIdSchema,
         status: STATUS.optional(),
         triage_notes: z.string().optional(),
         add_note: z.string().optional().describe("Append a timestamped progress note without changing status or replacing triage_notes"),
-        linked_task_id: z.string().optional(),
-        linked_commit: z.string().optional(),
-        fixed_version: z.string().optional(),
-        product: z.string().optional().describe("Re-label this bug's product: exe-os, exe-create, exe-wiki, exe-gateway, exe-crm, exe-build, exe-chat, exe-auth, exe-monitor, exe-db, exe-erp")
+        linked_task_id: supportTaskIdSchema.optional(),
+        linked_commit: supportCommitSchema.optional(),
+        fixed_version: supportVersionSchema.optional(),
+        product: supportProductSchema.optional().describe("Re-label this bug's product: exe-os, exe-create, exe-wiki, exe-gateway, exe-crm, exe-build, exe-chat, exe-auth, exe-monitor, exe-db, exe-erp")
       }
     },
     async ({ id, status, triage_notes, add_note, linked_task_id, linked_commit, fixed_version, product }) => {
       const effectiveStatus = fixed_version && !status ? "closed" : status;
-      const data = await requestJson(`${endpoint()}/${encodeURIComponent(id)}`, {
+      const data = await requestJson(`${endpoint()}/${encodeURIComponent(sanitizeUpstreamId(id))}`, {
         method: "PATCH",
         body: sanitizedUpstreamBody({ status: effectiveStatus, triage_notes, add_note, linked_task_id, linked_commit, fixed_version, product }, "support-inbox:triage_bug")
       });
@@ -236,14 +253,19 @@ function registerListFeatureRequests(server) {
       inputSchema: {
         status: z.enum(["all", "open", "planned", "in_progress", "shipped", "closed", "wontdo"]).default("open"),
         priority: z.enum(["p0", "p1", "p2", "p3"]).optional(),
-        limit: z.number().int().min(1).max(100).default(25)
+        product: z.string().optional().describe("Filter by product: exe-os, exe-create, exe-wiki, exe-gateway, exe-crm, exe-build, exe-chat, exe-auth, exe-monitor, exe-db, exe-erp"),
+        limit: z.number().int().min(1).max(500).default(25),
+        offset: z.number().int().min(0).default(0).describe("Number of results to skip for pagination. Use next_offset from a prior response.")
       }
     },
-    async ({ status, priority, limit }) => {
+    async ({ status, priority, product, limit, offset }) => {
       const url = new URL(featureEndpoint());
       url.searchParams.set("status", status);
       url.searchParams.set("limit", String(limit));
+      url.searchParams.set("offset", String(offset));
       if (priority) url.searchParams.set("priority", priority);
+      const safeProduct = sanitizeProductFilter(product);
+      if (safeProduct) url.searchParams.set("product", safeProduct);
       const data = await requestJson(url.toString());
       return { content: [{ type: "text", text: JSON.stringify(data, null, 2) }] };
     }
@@ -255,10 +277,10 @@ function registerGetFeatureRequest(server) {
     {
       title: "Get Feature Request",
       description: "AskExe-internal only: fetch one customer feature request with full payload.",
-      inputSchema: { id: z.string().min(8) }
+      inputSchema: { id: supportIdSchema }
     },
     async ({ id }) => {
-      const data = await requestJson(`${featureEndpoint()}/${encodeURIComponent(id)}`);
+      const data = await requestJson(`${featureEndpoint()}/${encodeURIComponent(sanitizeUpstreamId(id))}`);
       return { content: [{ type: "text", text: JSON.stringify(data, null, 2) }] };
     }
   );
@@ -270,19 +292,22 @@ function registerTriageFeatureRequest(server) {
       title: "Triage Feature Request",
       description: "AskExe-internal only: update feature request status, response notes, and version metadata.",
       inputSchema: {
-        id: z.string().min(8),
+        id: supportIdSchema,
         status: FEATURE_STATUS.optional(),
         response_notes: z.string().optional(),
         add_note: z.string().optional().describe("Append a timestamped progress note without changing status or replacing response_notes"),
-        target_version: z.string().optional(),
-        shipped_version: z.string().optional()
+        target_version: supportVersionSchema.optional(),
+        shipped_version: supportVersionSchema.optional(),
+        // bug b8e990ed: allow admin re-label of a feature's product. Typed with the
+        // strict product schema (round 10 ingress validation), not a loose string.
+        product: supportProductSchema.optional().describe("Re-label this feature's product: exe-os, exe-create, exe-wiki, exe-gateway, exe-crm, exe-build, exe-chat, exe-auth, exe-monitor, exe-db, exe-erp")
       }
     },
-    async ({ id, status, response_notes, add_note, target_version, shipped_version }) => {
+    async ({ id, status, response_notes, add_note, target_version, shipped_version, product }) => {
       const effectiveStatus = shipped_version && !status ? "shipped" : status;
-      const data = await requestJson(`${featureEndpoint()}/${encodeURIComponent(id)}`, {
+      const data = await requestJson(`${featureEndpoint()}/${encodeURIComponent(sanitizeUpstreamId(id))}`, {
         method: "PATCH",
-        body: sanitizedUpstreamBody({ status: effectiveStatus, response_notes, add_note, target_version, shipped_version }, "support-inbox:triage_feature")
+        body: sanitizedUpstreamBody({ status: effectiveStatus, response_notes, add_note, target_version, shipped_version, product }, "support-inbox:triage_feature")
       });
       return { content: [{ type: "text", text: JSON.stringify(data, null, 2) }] };
     }
@@ -301,13 +326,15 @@ function registerListReviews(server) {
       inputSchema: {
         status: z.enum(["all", "open", "in_review", "approved", "merged", "closed", "rejected"]).default("open"),
         priority: z.enum(["p0", "p1", "p2", "p3"]).optional(),
-        limit: z.number().int().min(1).max(100).default(25)
+        limit: z.number().int().min(1).max(500).default(25),
+        offset: z.number().int().min(0).default(0).describe("Number of results to skip for pagination. Use next_offset from a prior response.")
       }
     },
-    async ({ status, priority, limit }) => {
+    async ({ status, priority, limit, offset }) => {
       const url = new URL(reviewEndpoint());
       url.searchParams.set("status", status);
       url.searchParams.set("limit", String(limit));
+      url.searchParams.set("offset", String(offset));
       if (priority) url.searchParams.set("priority", priority);
       const data = await requestJson(url.toString());
       return { content: [{ type: "text", text: JSON.stringify(data, null, 2) }] };
@@ -320,10 +347,10 @@ function registerGetReview(server) {
     {
       title: "Get Review",
       description: "AskExe-internal only: fetch one review with full payload.",
-      inputSchema: { id: z.string().min(8) }
+      inputSchema: { id: supportIdSchema }
     },
     async ({ id }) => {
-      const data = await requestJson(`${reviewEndpoint()}/${encodeURIComponent(id)}`);
+      const data = await requestJson(`${reviewEndpoint()}/${encodeURIComponent(sanitizeUpstreamId(id))}`);
       return { content: [{ type: "text", text: JSON.stringify(data, null, 2) }] };
     }
   );
@@ -335,7 +362,7 @@ function registerTriageReview(server) {
       title: "Triage Review",
       description: "AskExe-internal only: update review status, response notes, and resolution.",
       inputSchema: {
-        id: z.string().min(8),
+        id: supportIdSchema,
         status: REVIEW_STATUS.optional(),
         response_notes: z.string().optional(),
         add_note: z.string().optional().describe("Append a timestamped progress note without changing status or replacing response_notes"),
@@ -344,7 +371,7 @@ function registerTriageReview(server) {
       }
     },
     async ({ id, status, response_notes, add_note, resolution, pr_url }) => {
-      const data = await requestJson(`${reviewEndpoint()}/${encodeURIComponent(id)}`, {
+      const data = await requestJson(`${reviewEndpoint()}/${encodeURIComponent(sanitizeUpstreamId(id))}`, {
         method: "PATCH",
         body: sanitizedUpstreamBody({ status, response_notes, add_note, resolution, pr_url }, "support-inbox:triage_review")
       });