@askexenow/exe-os 0.9.341 → 0.9.342

package/dist/{chunk-LEJ25726.js → chunk-YTCFACP4.js}

@@ -2,10 +2,10 @@ import {
   exportOrchestration,
   importOrchestration,
   validatePackage
-} from "./chunk-DPFQ2WQX.js";
+} from "./chunk-TLT7NZCW.js";
 import {
   runDriftProbes
-} from "./chunk-T2PYVVZ5.js";
+} from "./chunk-UUQBZPJJ.js";
 import {
   registerAddBugReportComment,
   registerGetBugReport,
@@ -18,7 +18,20 @@ import {
   registerTriageBugReport,
   registerTriageFeatureRequest,
   registerTriageReview
-} from "./chunk-6QW6JHRE.js";
+} from "./chunk-HV4KESRY.js";
+import {
+  persistSupportArtifact
+} from "./chunk-TTCUG2CF.js";
+import {
+  supportCommitSchema,
+  supportIdSchema,
+  supportProductSchema,
+  supportTaskIdSchema,
+  supportVersionSchema
+} from "./chunk-5H47VHB7.js";
+import {
+  StewardGate
+} from "./chunk-EUS4QUKP.js";
 import {
   DEFAULT_LIST_LIMIT,
   MAX_IMPORTANCE,
@@ -27,26 +40,11 @@ import {
   ingestDocument,
   listDocumentsByWorkspace,
   updateChunksImportance
-} from "./chunk-LOBCQXV5.js";
-import {
-  analyzeBlastRadius,
-  buildCodeContextIndex,
-  buildCodeContextIndexWithEmbeddings,
-  getCodeContextStats,
-  searchCodeContext,
-  searchCodeContextSemantic,
-  traceCodeSymbol
-} from "./chunk-U2MREVXQ.js";
-import {
-  StewardGate
-} from "./chunk-YHUNDGVV.js";
-import {
-  DreamingEngine
-} from "./chunk-L2YGXJGF.js";
+} from "./chunk-MKYFAKDW.js";
 import {
   isRerankerAvailable,
   rerankWithScores
-} from "./chunk-WNKVKNOM.js";
+} from "./chunk-UNXQBELK.js";
 import {
   getEntityByName,
   getEntityNeighbors,
@@ -55,28 +53,40 @@ import {
   getRelationships,
   searchEntities
 } from "./chunk-CRCB5S7I.js";
+import {
+  analyzeBlastRadius,
+  buildCodeContextIndex,
+  buildCodeContextIndexWithEmbeddings,
+  getCodeContextStats,
+  searchCodeContext,
+  searchCodeContextSemantic,
+  traceCodeSymbol
+} from "./chunk-S7QUM2UK.js";
 import {
   listRecentSessionEvents
-} from "./chunk-YLQXP7T7.js";
+} from "./chunk-NN2B2QKU.js";
+import {
+  DreamingEngine
+} from "./chunk-HAF2DJYV.js";
+import {
+  AUTO_WAKE_MAX_RETRIES
+} from "./chunk-CE7F6RHG.js";
 import {
   DEFAULT_EXPLORE_DURATION_MS,
   getPlayMode,
   listExploreSessions,
   setPlayMode
-} from "./chunk-PVYR4FCQ.js";
-import {
-  AUTO_WAKE_MAX_RETRIES
-} from "./chunk-BMHQPIJ2.js";
+} from "./chunk-4CMVFVFC.js";
 import {
   getCachedLicenseGate,
   refreshLicenseGate
-} from "./chunk-NDSNM5OH.js";
+} from "./chunk-P5HIWY2E.js";
 import {
   getToolUsageStats
-} from "./chunk-MC6VPZKS.js";
+} from "./chunk-JRM4TAGS.js";
 import {
   getToolCapabilityIndex
-} from "./chunk-3NCZKWPO.js";
+} from "./chunk-MGGOSFCR.js";
 import {
   isToolAllowed,
   isToolAllowedForPlan
@@ -84,58 +94,59 @@ import {
 import {
   loadOrchestrationPhase,
   setOrchestrationPhase
-} from "./chunk-32SXNM3G.js";
+} from "./chunk-C5QAPURN.js";
 import {
   createOrRefreshResumeTask
-} from "./chunk-MC4ATFJV.js";
+} from "./chunk-FPFPLPUY.js";
 import {
-  registerCreateTask
-} from "./chunk-GOGSWXNZ.js";
+  registerSendMessage
+} from "./chunk-JMYHW3AL.js";
+import {
+  registerCreateTask,
+  resolveProjectDir
+} from "./chunk-OZEBAGKR.js";
 import {
   registerListTasks
-} from "./chunk-CYA5S5OD.js";
+} from "./chunk-QOO5RW3K.js";
 import {
   registerUpdateTask
-} from "./chunk-HUSVERE6.js";
+} from "./chunk-Z6RSN7KS.js";
 import {
   registerCreateReminder
-} from "./chunk-CCPHEPLU.js";
+} from "./chunk-NX5INHHG.js";
 import {
   registerListReminders
-} from "./chunk-2YCFNBC4.js";
+} from "./chunk-4J4PMPXZ.js";
 import {
   registerCompleteReminder
-} from "./chunk-N7A5D25S.js";
-import {
-  registerDeactivateBehavior
-} from "./chunk-ZNE6H2JO.js";
+} from "./chunk-F27XXN6C.js";
 import {
   completeReminder,
   createReminder,
   listReminders
-} from "./chunk-PVIH3ZGV.js";
+} from "./chunk-UUEKJDK6.js";
 import {
-  registerImportConversations
-} from "./chunk-TIXTHUVJ.js";
+  registerDeactivateBehavior
+} from "./chunk-MZM6EJCU.js";
 import {
-  registerSendMessage
-} from "./chunk-WWNQFOSP.js";
+  registerImportConversations
+} from "./chunk-6WQ3NNCE.js";
 import {
   TOKENS_PER_IDLE_MINUTE,
   countKillsSince,
   sumTokensSavedSince
-} from "./chunk-IELUDZAA.js";
+} from "./chunk-L4A5DL6Z.js";
 import {
   createSchedule,
   parseHumanCron
-} from "./chunk-J6SEDDOR.js";
+} from "./chunk-SQKXKV2Y.js";
 import {
   status
-} from "./chunk-KP4PY2Z2.js";
+} from "./chunk-JPUZPAAF.js";
 import {
   evaluateGlobalSpendCap,
   getAgentSpend
-} from "./chunk-2WMTTIAZ.js";
+} from "./chunk-QRYVCDWS.js";
 import {
   exportGraphHTML,
   generateGraphReport
@@ -148,14 +159,14 @@ import {
   formatReport,
   runAudit,
   shouldFixShards
-} from "./chunk-IXBIVKWZ.js";
+} from "./chunk-QQ4E2RYW.js";
 import {
   formatDegradations,
   getRetrievalHealth
-} from "./chunk-6MVI4QH2.js";
+} from "./chunk-2KZNGDSW.js";
 import {
   runHealthCheck
-} from "./chunk-MJB5ZFQM.js";
+} from "./chunk-PDWS3E22.js";
 import {
   checkCpuStealSync
 } from "./chunk-SSC7EKY2.js";
@@ -163,7 +174,7 @@ import {
   hasFailures,
   runHealth,
   runTest
-} from "./chunk-UIU2DGRV.js";
+} from "./chunk-OTF44GXL.js";
 import {
   isSupportReportSentStatus,
   markSupportReportSent
@@ -174,28 +185,28 @@ import {
 } from "./chunk-2XZ6X3PJ.js";
 import {
   renderClientCOOTemplate
-} from "./chunk-K6KRBXQP.js";
+} from "./chunk-XHK3FS3W.js";
 import {
   deactivateGlobalProcedure,
   loadGlobalProcedures,
   storeGlobalProcedure
-} from "./chunk-6BQG7EKO.js";
+} from "./chunk-GJ26DULE.js";
 import {
   PLATFORM_PROCEDURES
-} from "./chunk-A47MXY2I.js";
+} from "./chunk-EQHQF5IM.js";
 import {
   clearCloudReuploadRequired,
   cloudSync,
   getCloudReuploadRequired,
   markCloudReuploadRequired
-} from "./chunk-YWQMWFYR.js";
+} from "./chunk-CNVBKDEY.js";
 import {
   createARecord
 } from "./chunk-X2Z5GT3V.js";
 import {
   findSimilarTrajectories,
   hashSignature
-} from "./chunk-GPW32HVB.js";
+} from "./chunk-QDGZJ653.js";
 import {
   GHOST_BEHAVIOR_SQL,
   deactivateBehavior,
@@ -204,40 +215,40 @@ import {
   reactivateBehavior,
   storeBehavior,
   storeReflexBehavior
-} from "./chunk-OUEFW4RK.js";
+} from "./chunk-KW2SD2FL.js";
 import {
   countUnconsolidated,
   groupMemories,
   runConsolidation,
   selectUnconsolidated
-} from "./chunk-WD55PEBM.js";
+} from "./chunk-6CH3TPHR.js";
 import {
   entityId,
   mergeEntities
-} from "./chunk-7UMCQQWS.js";
+} from "./chunk-A4DVMPYB.js";
 import {
   embed
-} from "./chunk-AP455LBW.js";
+} from "./chunk-XZXBB3TN.js";
 import {
   detectDcrIncompatibleConnectorsFromDisk,
   detectExternalMcpFailures,
   readMcpHttpEvents,
   summarizeMcpTransport,
   writeMcpTransportSummary
-} from "./chunk-5RACW3LX.js";
+} from "./chunk-RAXVPNMR.js";
 import {
   updateTask
-} from "./chunk-XSMRR4IW.js";
+} from "./chunk-QYZJHTNE.js";
 import {
   fastDbInit
-} from "./chunk-7YORGTXC.js";
+} from "./chunk-PWUFMX75.js";
 import {
   MAX_CONCURRENT_WORKERS
-} from "./chunk-2IWBY7XK.js";
+} from "./chunk-VPZHJCKW.js";
 import {
   hybridSearch,
   recentRecords
-} from "./chunk-FOV57K47.js";
+} from "./chunk-N7QJKQMX.js";
 import {
   buildFtsMatch,
   tokenizeForFts
@@ -247,16 +258,21 @@ import {
   flushBatch,
   initStore,
   writeMemory
-} from "./chunk-EDH54E5A.js";
+} from "./chunk-VSRPS3J7.js";
 import {
   getActiveAgent
-} from "./chunk-C445WRUX.js";
+} from "./chunk-5ERDIOV3.js";
 import {
   UPSTREAM_ATTACHMENT_MAX_CHARS,
   isTelemetryRedactionEnabled,
+  redactSecrets,
+  redactedToolResult,
+  sanitizeProductFilter,
+  sanitizeUpstreamId,
   sanitizeUpstreamPayload,
+  sanitizeVersionField,
   sanitizedUpstreamBody
-} from "./chunk-RP5GETX5.js";
+} from "./chunk-4QCFFW2H.js";
 import {
   getMySession,
   resolveExeSession,
@@ -265,13 +281,13 @@ import {
   sessionScopeFilter,
   updateTaskStatus,
   writeCheckpoint
-} from "./chunk-KKOLHBNC.js";
+} from "./chunk-UP75Z5X7.js";
 import {
   listSessions
-} from "./chunk-HNLXMD2V.js";
+} from "./chunk-KGWRTRKC.js";
 import {
   recordOrchestrationEventBestEffort
-} from "./chunk-WH7XN5ER.js";
+} from "./chunk-2WAVZ5UJ.js";
 import {
   DEFAULT_MODELS,
   KNOWN_RUNTIMES,
@@ -279,35 +295,33 @@ import {
   getAgentRuntime,
   loadAgentConfig,
   setAgentRuntime
-} from "./chunk-GFDGDFBF.js";
-import {
-  DEFAULT_RUNTIME
-} from "./chunk-NGP6LSV2.js";
+} from "./chunk-HA5R6USD.js";
 import {
   PlanLimitError,
   assertEmployeeLimit,
   assertFeature,
   assertMemoryLimit
-} from "./chunk-2UGGBIDL.js";
+} from "./chunk-JGIPOUIK.js";
 import {
   getProjectName
 } from "./chunk-OPU3NYOO.js";
 import {
   readDaemonToken
-} from "./chunk-3NGZ4PL7.js";
+} from "./chunk-X2Q5NLUL.js";
 import {
   getAgentContext
 } from "./chunk-GJV3WDWM.js";
 import {
+  _resetCache,
   getAccountByName,
   getDefaultAccount
-} from "./chunk-YGAAZN3E.js";
+} from "./chunk-GL57PO3K.js";
 import {
   createNewTrigger,
   isScheduledTrigger,
   loadTriggers,
   sanitizeParam
-} from "./chunk-IB336P52.js";
+} from "./chunk-KP3U5QGJ.js";
 import {
   pushConversationToCRM
 } from "./chunk-ML4S5SHZ.js";
@@ -325,10 +339,11 @@ import {
   isInitialized,
   listIdentities,
   loadEmployees,
+  loadEmployeesState,
   loadEmployeesSync,
   saveEmployees,
   updateIdentity
-} from "./chunk-RWSLVYTE.js";
+} from "./chunk-AOHXREB7.js";
 import {
   getEventLoopLagMs,
   isDaemonAlive,
@@ -336,10 +351,13 @@ import {
 } from "./chunk-7HLWBYH7.js";
 import {
   getMasterKey
-} from "./chunk-Z42MXYWW.js";
+} from "./chunk-QWVXN224.js";
+import {
+  DEFAULT_RUNTIME
+} from "./chunk-NGP6LSV2.js";
 import {
   checkForUpdate
-} from "./chunk-XQNNB5GY.js";
+} from "./chunk-F55P3H4S.js";
 import {
   PLAN_LIMITS,
   checkLicense,
@@ -350,16 +368,16 @@ import {
   refreshLicense,
   saveLicense,
   validateLicense
-} from "./chunk-7SEC2AG5.js";
+} from "./chunk-PQIDGXSG.js";
 import {
   EXE_AI_DIR,
   loadConfig
-} from "./chunk-7Y5UDEVM.js";
+} from "./chunk-WZHZCDDO.js";
 
 // src/mcp/register-tools.ts
 import { readFileSync as readFileSync7 } from "fs";
 import { join as join4 } from "path";
-import { homedir as homedir4 } from "os";
+import { homedir as homedir5 } from "os";
 
 // src/mcp/tools/memory.ts
 import { z as z12 } from "zod";
@@ -534,7 +552,7 @@ function registerRecallMyMemory(server) {
     }) => {
       try {
         if (!isInitialized()) {
-          const { fastDbInit: fastDbInit2 } = await import("./fast-db-init-JKJEEHUI.js");
+          const { fastDbInit: fastDbInit2 } = await import("./fast-db-init-4CWHSOOR.js");
           await fastDbInit2();
         }
         if (!recent && !query) {
@@ -581,7 +599,7 @@ function registerRecallMyMemory(server) {
         let federatedCount = 0;
         if (!recent && query && results.length < FEDERATION_THRESHOLD) {
           try {
-            const { searchCodeContextSemantic: searchCodeContextSemantic2 } = await import("./code-context-index-BNBHDXHW.js");
+            const { searchCodeContextSemantic: searchCodeContextSemantic2 } = await import("./code-context-index-WSOJQ72R.js");
             const codeResults = await Promise.race([
               searchCodeContextSemantic2(query, { limit: 5 }),
               new Promise((_, rej) => setTimeout(() => rej(new Error("timeout")), 2e3))
@@ -819,7 +837,7 @@ function registerStoreMemory(server) {
       }
       const { agentId, agentRole } = getActiveAgent();
       if (kind === "prospective") {
-        const { createProspectiveMemory } = await import("./prospective-memory-UACFTYXK.js");
+        const { createProspectiveMemory } = await import("./prospective-memory-6D2ASWM3.js");
         let sessionScope = null;
         try {
           const { resolveExeSession: resolveExeSession2 } = await import("./lib/tmux-routing.js");
@@ -919,7 +937,7 @@ function registerCommitMemory(server) {
         project: z4.string().optional().describe("Project name (auto-detected if omitted)"),
         key_decisions: z4.array(z4.string()).optional().describe("List of key decisions made in this session"),
         metadata_tags: z4.array(z4.string()).optional().describe("Tags for categorization (e.g., 'architecture', 'bugfix', 'design')"),
-        topic: z4.string().optional().describe("Topic heading, e.g. 'HYGO Phase 2 architecture decisions'"),
+        topic: z4.string().optional().describe("Topic heading, e.g. 'Acme Phase 2 architecture decisions'"),
         current_state: z4.string().optional().describe("What is true NOW \u2014 snapshot of current system state"),
         historical_context: z4.string().optional().describe("What led here \u2014 decisions, trade-offs, prior approaches"),
         importance: z4.number().min(1).max(10).optional().describe("Override importance (default 9)"),
@@ -1085,7 +1103,7 @@ async function searchConversations(query, limit) {
 }
 async function searchWiki(query, limit) {
   try {
-    const { createWikiClient, chatInWorkspace, listWorkspaces } = await import("./wiki-client-VNDOBK63.js");
+    const { createWikiClient, chatInWorkspace, listWorkspaces } = await import("./wiki-client-EAN7F5LV.js");
     const client = await createWikiClient();
     if (!client) return [];
     const workspaces = await listWorkspaces(client);
@@ -1481,7 +1499,7 @@ function registerGetMemoryCardinality(server) {
       title: "Get Memory Cardinality",
       description: "Get memory counts: total active memories and per-project breakdown. Optionally filter by agent.",
       inputSchema: {
-        agent_id: z9.string().optional().describe("Filter to a specific agent (e.g. 'tom', 'exe')")
+        agent_id: z9.string().optional().describe("Filter to a specific agent (e.g. 'engineer', 'coordinator')")
       }
     },
     async ({ agent_id }) => {
@@ -1805,7 +1823,7 @@ async function handleSupersede(input) {
   }
   try {
     const { getClient: getClient2 } = await import("./lib/database.js");
-    const { getActiveAgent: getActiveAgent2 } = await import("./active-agent-AIQP4DFL.js");
+    const { getActiveAgent: getActiveAgent2 } = await import("./active-agent-PVGE57FY.js");
     const { writeMemory: writeMemory2, flushBatch: flushBatch2 } = await import("./lib/store.js");
     const { randomUUID: randomUUID2 } = await import("crypto");
     const client = getClient2();
@@ -1858,7 +1876,7 @@ New memory id: ${newId}`
 }
 async function handleResonanceQuery(input) {
   try {
-    const { getHotPairs, getCoActivationNeighbors } = await import("./co-activation-QI5BK4RT.js");
+    const { getHotPairs, getCoActivationNeighbors } = await import("./co-activation-ZCHPLLP6.js");
     const subAction = input.resonance_action ?? "hot_pairs";
     const limit = input.limit ?? 20;
     if (subAction === "hot_pairs") {
@@ -1886,7 +1904,7 @@ function registerMemory(server) {
       title: "Memory",
       description: "Consolidated memory domain tool. Actions: recall, ask_team, store, commit, search, session_context, get_by_id, consolidate, cardinality, supersede, decision_store, decision_get, resonance_query. Legacy memory tools remain available during migration.",
       inputSchema: {
-        action: z12.enum(["recall", "ask_team", "store", "commit", "search", "session_context", "consolidate", "cardinality", "supersede", "core_get", "core_set", "core_delete", "update_working_memory", "get_working_memory", "decision_store", "decision_get", "resonance_query"]).describe("Memory operation to perform. core_get/core_set/core_delete manage always-in-context key facts. update_working_memory/get_working_memory manage the runtime scratchpad. decision_store/decision_get manage authoritative decisions. resonance_query queries co-activation network."),
+        action: z12.enum(["recall", "ask_team", "store", "commit", "search", "session_context", "get_by_id", "consolidate", "cardinality", "supersede", "core_get", "core_set", "core_delete", "update_working_memory", "get_working_memory", "decision_store", "decision_get", "resonance_query"]).describe("Memory operation to perform. core_get/core_set/core_delete manage always-in-context key facts. update_working_memory/get_working_memory manage the runtime scratchpad. decision_store/decision_get manage authoritative decisions. resonance_query queries co-activation network."),
         query: z12.string().optional().describe("Search query. Also accepted as store text alias."),
         text: z12.string().optional().describe("Memory text for action=store"),
         summary: z12.string().optional().describe("High-importance summary for action=commit"),
@@ -1917,6 +1935,9 @@ function registerMemory(server) {
         session_id: z12.string().optional().describe("Session ID for action=session_context"),
         target_timestamp: z12.string().optional().describe("Center timestamp for action=session_context"),
         window_size: z12.number().optional().describe("Window size for action=session_context"),
+        id: z12.string().optional().describe("Memory UUID for action=get_by_id."),
+        max_chars: z12.coerce.number().int().min(100).max(5e4).optional().describe("Max characters per memory body for action=recall/session_context. Use higher values for long runbooks."),
+        body_chars: z12.coerce.number().int().min(100).max(5e4).optional().describe("Alias for max_chars for action=recall/session_context."),
         max_clusters: z12.coerce.number().optional().describe("Max clusters for action=consolidate"),
         model: z12.string().optional().describe("Model for action=consolidate"),
         agent_id: z12.string().optional().describe("Agent filter for action=cardinality"),
@@ -1953,9 +1974,9 @@ function registerMemory(server) {
         return handleResonanceQuery(input);
       }
       if (action === "update_working_memory" || action === "get_working_memory") {
-        const { getActiveAgent: getActiveAgent2 } = await import("./active-agent-AIQP4DFL.js");
+        const { getActiveAgent: getActiveAgent2 } = await import("./active-agent-PVGE57FY.js");
         const { agentId } = getActiveAgent2();
-        const { readWorkingMemoryWithMeta, writeWorkingMemory, WORKING_MEMORY_MAX_BYTES } = await import("./working-memory-PY4AG577.js");
+        const { readWorkingMemoryWithMeta, writeWorkingMemory, WORKING_MEMORY_MAX_BYTES } = await import("./working-memory-NUVB5SFV.js");
         if (action === "get_working_memory") {
           const wm = readWorkingMemoryWithMeta(agentId);
           if (!wm) {
@@ -1979,9 +2000,9 @@ function registerMemory(server) {
         }
       }
       if (action === "core_get" || action === "core_set" || action === "core_delete") {
-        const { getActiveAgent: getActiveAgent2 } = await import("./active-agent-AIQP4DFL.js");
+        const { getActiveAgent: getActiveAgent2 } = await import("./active-agent-PVGE57FY.js");
         const { agentId } = getActiveAgent2();
-        const { getCoreMemory, setCoreMemory, deleteCoreMemory, formatCoreMemoryBlock } = await import("./core-memory-3IBWM4WR.js");
+        const { getCoreMemory, setCoreMemory, deleteCoreMemory, formatCoreMemoryBlock } = await import("./core-memory-GAC6EWOQ.js");
         if (action === "core_get") {
           const entries = await getCoreMemory(agentId);
           const block = formatCoreMemoryBlock(entries);
@@ -2033,12 +2054,12 @@ function registerMemory(server) {
           if (!storeTrigger || !storeTriggerAction) {
             return errorResult('memory action "store" with kind="reflex" requires trigger and trigger_action fields');
           }
-          const { formatReflexContent, storeReflexBehavior: storeReflexBehavior2 } = await import("./behaviors-EO7KCP3H.js");
+          const { formatReflexContent, storeReflexBehavior: storeReflexBehavior2 } = await import("./behaviors-KYRB3NGJ.js");
           const reflexText = formatReflexContent(storeTrigger, storeTriggerAction);
           legacyArgs.text ??= reflexText;
           legacyArgs.query ??= reflexText;
           try {
-            const { getActiveAgent: getActiveAgent2 } = await import("./active-agent-AIQP4DFL.js");
+            const { getActiveAgent: getActiveAgent2 } = await import("./active-agent-PVGE57FY.js");
             const { getProjectName: getProjectName2 } = await import("./project-name-EWG5KAZP.js");
             const agent = getActiveAgent2();
             const behaviorId = await storeReflexBehavior2({
@@ -2379,6 +2400,82 @@ function registerGetTask(server) {
 import { z as z15 } from "zod";
 var CLOSE_TASK_ALLOWED_ROLES = /* @__PURE__ */ new Set(["CTO"]);
 var CLOSEABLE_STATUSES = /* @__PURE__ */ new Set(["needs_review", "done"]);
+async function respawnAssigneeAfterClose(input) {
+  const { resolveExeSession: resolveExeSession2, employeeSessionName, ensureEmployee } = await import("./lib/tmux-routing.js");
+  const { shouldAutoInstance } = await import("./lib/employees.js");
+  const exeSession = input.taskScope ?? resolveExeSession2();
+  if (!exeSession) return { respawned: false, reason: "no coordinator session" };
+  if (!input.projectName) {
+    process.stderr.write(
+      `[close-task] respawn SKIPPED for ${input.assignee}: task has no project_name to resolve \u2014 never respawning into process.cwd().
+`
+    );
+    return { respawned: false, reason: "task has no project_name" };
+  }
+  const { resolveProjectDir: resolveProjectDir2 } = await import("./mcp/tools/create-task.js");
+  const projectDir = await resolveProjectDir2(input.projectName, exeSession);
+  if (!projectDir) {
+    process.stderr.write(
+      `[close-task] respawn SKIPPED for ${input.assignee}: could not resolve project dir for "${input.projectName}" in scope ${exeSession} \u2014 never respawning into process.cwd(). Manual nudge can follow.
+`
+    );
+    return { respawned: false, reason: "project dir unresolved" };
+  }
+  const oldSession = employeeSessionName(input.assignee, exeSession);
+  const { execSync } = await import("child_process");
+  try {
+    execSync(`tmux kill-session -t ${oldSession} 2>/dev/null`, { timeout: 3e3 });
+  } catch {
+  }
+  try {
+    const { cleanupAgentWorktree } = await import("./worktree-sweep-WTK3MTKH.js");
+    const { getGitRoot } = await import("./worktree-LL62PLQB.js");
+    const root = getGitRoot(projectDir);
+    if (root) {
+      const notes = await cleanupAgentWorktree(root, input.assignee);
+      if (notes) process.stderr.write(`[close-task] Deferred worktree cleanup: ${notes.replace(/\n/g, "; ")}
+`);
+    }
+  } catch {
+  }
+  if (!input.topTaskId) {
+    process.stderr.write(
+      `[close-task] Deferred respawn SKIPPED for ${input.assignee} \u2014 no open task id to gate the claim on; auto-wake will cover any orphan
+`
+    );
+    return { respawned: false, reason: "no open task id to gate the claim on" };
+  }
+  const { tryAcquireDispatchClaim, releaseDispatchClaim } = await import("./dispatch-ack-VYH3ONSS.js");
+  if (!tryAcquireDispatchClaim(input.topTaskId, input.assignee, exeSession)) {
+    process.stderr.write(
+      `[close-task] Deferred respawn DEDUPED for ${input.assignee} task ${input.topTaskId} \u2014 another dispatch is already in flight
+`
+    );
+    return { respawned: false, reason: "another dispatch holds the claim" };
+  }
+  let result3;
+  try {
+    result3 = ensureEmployee(input.assignee, exeSession, projectDir, shouldAutoInstance(input.assignee));
+  } catch (spawnErr) {
+    try {
+      releaseDispatchClaim(input.topTaskId, input.assignee, "respawn threw");
+    } catch {
+    }
+    throw spawnErr;
+  }
+  if (result3.status === "failed") {
+    try {
+      releaseDispatchClaim(input.topTaskId, input.assignee, result3.error ?? "respawn failed");
+    } catch {
+    }
+    return { respawned: false, reason: result3.error ?? "respawn failed", projectDir };
+  }
+  process.stderr.write(
+    `[close-task] Deferred respawn complete: ${result3.sessionName ?? "fresh instance"} in ${projectDir}
+`
+  );
+  return { respawned: true, projectDir };
+}
 function registerCloseTask(server) {
   server.registerTool(
     "close_task",
@@ -2394,7 +2491,7 @@ function registerCloseTask(server) {
     async ({ task_id, result: result3, status: status2 }) => {
       const agent = getActiveAgent();
       try {
-        const { StewardGate: StewardGate2 } = await import("./steward-gate-4A2XHYFD.js");
+        const { StewardGate: StewardGate2 } = await import("./steward-gate-3GQ5XKMJ.js");
         const steward = new StewardGate2();
         const gateDecision = await steward.checkAuthority(agent.agentId || "unknown", "close_task", task_id);
         if (!gateDecision.allowed) {
@@ -2575,8 +2672,8 @@ ${preflightWarnings.join("\n")}`;
       if (mergeNote) text5 += mergeNote;
       if (status2 === "closed" && assignee) {
         try {
-          const { cleanupAgentWorktree } = await import("./worktree-sweep-5WKBU7E6.js");
-          const { getGitRoot } = await import("./worktree-YXBDRYOC.js");
+          const { cleanupAgentWorktree } = await import("./worktree-sweep-WTK3MTKH.js");
+          const { getGitRoot } = await import("./worktree-LL62PLQB.js");
           const repoRoot = getGitRoot(baseDir);
           if (repoRoot) {
             const cleanupNotes = await cleanupAgentWorktree(repoRoot, assignee);
@@ -2604,6 +2701,16 @@ ${preflightWarnings.join("\n")}`;
             });
             const count = Number(remaining.rows[0]?.cnt ?? 0);
             if (count > 0) {
+              let topOpenTaskId;
+              try {
+                const topRes = await client.execute({
+                  sql: `SELECT id FROM tasks WHERE assigned_to = ? AND status = 'open' ${respawnScope.sql}
+                        ORDER BY CASE priority WHEN 'p0' THEN 0 WHEN 'p1' THEN 1 WHEN 'p2' THEN 2 ELSE 3 END, created_at ASC LIMIT 1`,
+                  args: [closedAssignee, ...respawnScope.args]
+                });
+                topOpenTaskId = topRes.rows[0]?.id != null ? String(topRes.rows[0].id) : void 0;
+              } catch {
+              }
               try {
                 const { isMultiInstance } = await import("./lib/employees.js");
                 if (isMultiInstance(closedAssignee)) {
@@ -2611,37 +2718,14 @@ ${preflightWarnings.join("\n")}`;
 
 \u{1F504} Auto-respawn: ${closedAssignee} has ${count} more task(s). Respawn scheduled (deferred to avoid MCP disruption).`;
                   const _assignee = closedAssignee;
-                  const _baseDir = baseDir;
-                  setTimeout(async () => {
-                    try {
-                      const { resolveExeSession: resolveExeSession2, employeeSessionName, ensureEmployee } = await import("./lib/tmux-routing.js");
-                      const { shouldAutoInstance } = await import("./lib/employees.js");
-                      const exeSession = resolveExeSession2();
-                      if (!exeSession) return;
-                      const oldSession = employeeSessionName(_assignee, exeSession);
-                      const { execSync } = await import("child_process");
-                      try {
-                        execSync(`tmux kill-session -t ${oldSession} 2>/dev/null`, { timeout: 3e3 });
-                      } catch {
-                      }
-                      try {
-                        const { cleanupAgentWorktree } = await import("./worktree-sweep-5WKBU7E6.js");
-                        const { getGitRoot } = await import("./worktree-YXBDRYOC.js");
-                        const root = getGitRoot(_baseDir);
-                        if (root) {
-                          const notes = await cleanupAgentWorktree(root, _assignee);
-                          if (notes) process.stderr.write(`[close-task] Deferred worktree cleanup: ${notes.replace(/\n/g, "; ")}
-`);
-                        }
-                      } catch {
-                      }
-                      const result4 = ensureEmployee(_assignee, exeSession, _baseDir, shouldAutoInstance(_assignee));
-                      process.stderr.write(`[close-task] Deferred respawn complete: ${result4.sessionName ?? "fresh instance"}
-`);
-                    } catch (e) {
-                      process.stderr.write(`[close-task] Deferred respawn failed: ${e instanceof Error ? e.message : String(e)}
-`);
-                    }
+                  const _topTaskId = topOpenTaskId ?? null;
+                  const _projectName = row.project_name != null ? String(row.project_name) : null;
+                  const _taskScope = sanitizeSessionScope(row.session_scope == null ? null : String(row.session_scope));
+                  setTimeout(() => {
+                    respawnAssigneeAfterClose({ assignee: _assignee, projectName: _projectName, taskScope: _taskScope, topTaskId: _topTaskId }).catch((e) => process.stderr.write(
+                      `[close-task] Deferred respawn failed: ${e instanceof Error ? e.message : String(e)}
+`
+                    ));
                   }, 500);
                 }
               } catch {
@@ -2715,6 +2799,7 @@ function registerCheckpointTask(server) {
 
 // src/mcp/tools/resume-employee.ts
 import { z as z17 } from "zod";
+import { homedir } from "os";
 var RESUME_CONTEXT_TASK_LIMIT = 10;
 function registerResumeEmployee(server) {
   server.registerTool(
@@ -2729,7 +2814,7 @@ function registerResumeEmployee(server) {
     },
     async ({ agent_id, project_name }) => {
       if (!isInitialized()) {
-        const { fastDbInit: fastDbInit2 } = await import("./fast-db-init-JKJEEHUI.js");
+        const { fastDbInit: fastDbInit2 } = await import("./fast-db-init-4CWHSOOR.js");
         await fastDbInit2();
       }
       const client = getClient();
@@ -2755,7 +2840,7 @@ function registerResumeEmployee(server) {
         };
       }
       try {
-        const { isTmuxSessionAlive } = await import("./tasks-crud-6LBNU43G.js");
+        const { isTmuxSessionAlive } = await import("./tasks-crud-HBDKE6C5.js");
         const now = (/* @__PURE__ */ new Date()).toISOString();
         for (const row of openTasks.rows) {
           const status2 = String(row.status);
@@ -2783,7 +2868,7 @@ function registerResumeEmployee(server) {
       }
       let checkpointInfo = "";
       try {
-        const { readLatestCheckpoint } = await import("./tasks-crud-6LBNU43G.js");
+        const { readLatestCheckpoint } = await import("./tasks-crud-HBDKE6C5.js");
         const checkpoint = await readLatestCheckpoint(agent_id);
         if (checkpoint) {
           const filesTouched = checkpoint.files_touched?.length > 0 ? checkpoint.files_touched.join(", ") : "none";
@@ -2800,9 +2885,18 @@ function registerResumeEmployee(server) {
         }
       } catch {
       }
+      let callerScope;
+      try {
+        const { getAgentContext: getAgentContext2 } = await import("./agent-context-AZTTMUHP.js");
+        const hint = getAgentContext2()?.sessionHint;
+        if (hint) callerScope = hint;
+      } catch {
+      }
+      if (!callerScope) callerScope = process.env.EXE_SESSION_NAME || process.env.EXE_SESSION || void 0;
+      const resumeProjectDir = await resolveProjectDir(project_name, callerScope);
       const { created, taskId } = await createOrRefreshResumeTask(
         agent_id,
-        process.cwd(),
+        resumeProjectDir ?? homedir(),
         openTasks.rows
       );
       if (checkpointInfo && taskId) {
@@ -2824,7 +2918,7 @@ function registerResumeEmployee(server) {
       }
       let dispatchStatus = "";
       try {
-        const { ensureEmployee, resolveExeSession: resolveExeSession2 } = await import("./lib/tmux-routing.js");
+        const { ensureEmployeeAsync, resolveExeSession: resolveExeSession2 } = await import("./lib/tmux-routing.js");
         let taskScope = null;
         if (taskId) {
           try {
@@ -2840,17 +2934,60 @@ function registerResumeEmployee(server) {
         }
         const exeSession = taskScope ?? resolveExeSession2();
         if (!exeSession) throw new Error("No coordinator session found");
+        if (!resumeProjectDir) {
+          throw new Error(
+            `could not resolve project dir for "${project_name}" within scope \u2014 RESUME task left for manual dispatch`
+          );
+        }
         process.stderr.write(
           `[resume_employee] dispatch lane=${exeSession} source=${taskScope ? "task.session_scope" : "caller.resolveExeSession (task has no scope)"} task=${taskId} agent=${agent_id}
 `
         );
         const { shouldAutoInstance } = await import("./lib/employees.js");
-        const result3 = ensureEmployee(agent_id, exeSession, process.cwd(), shouldAutoInstance(agent_id));
+        const { tryAcquireDispatchClaim, releaseDispatchClaim } = await import("./dispatch-ack-VYH3ONSS.js");
+        let claimedResume = false;
+        if (taskId) {
+          claimedResume = tryAcquireDispatchClaim(taskId, agent_id, exeSession);
+          if (!claimedResume) {
+            dispatchStatus = `
+Dispatched: deduped \u2014 another dispatch for task ${taskId} is already in flight`;
+            process.stderr.write(`[resume_employee] DEDUPED spawn for ${agent_id} task ${taskId} \u2014 a fresh dispatch is already in flight
+`);
+            throw new Error("dispatch deduped");
+          }
+        }
+        let result3;
+        try {
+          result3 = await ensureEmployeeAsync(
+            agent_id,
+            exeSession,
+            resumeProjectDir,
+            shouldAutoInstance(agent_id)
+          );
+        } catch (spawnErr) {
+          if (taskId && claimedResume) {
+            try {
+              releaseDispatchClaim(taskId, agent_id, "resume spawn threw");
+            } catch {
+            }
+          }
+          throw spawnErr;
+        }
+        if (result3.status === "failed" && taskId && claimedResume) {
+          try {
+            releaseDispatchClaim(taskId, agent_id, result3.error ?? "resume spawn failed");
+          } catch {
+          }
+        }
         switch (result3.status) {
           case "intercom_sent":
             dispatchStatus = `
 Dispatched: intercom sent to ${result3.sessionName}`;
             break;
+          case "intercom_unprocessed":
+            dispatchStatus = `
+Dispatched: intercom delivered to ${result3.sessionName}`;
+            break;
           case "spawned":
             dispatchStatus = `
 Dispatched: spawned ${result3.sessionName}`;
@@ -3134,6 +3271,8 @@ function registerTask(server) {
         budget_fallback_model: z19.string().optional().describe("Fallback model for action=create"),
         spawn_runtime: z19.string().optional().describe("Override runtime for spawned session (e.g., 'claude', 'codex', 'opencode') for action=create"),
         spawn_model: z19.string().optional().describe("Override model for spawned session (e.g., 'claude-sonnet-4.6') for action=create"),
+        idempotency_key: z19.string().optional().describe("Idempotency key for action=create (bug c06a8803): retrying with the SAME key returns the ORIGINAL task instead of creating a duplicate + duplicate spawn. Must be stable across the original call and its retry \u2014 no timestamp. Optional; omitted = no dedup."),
+        idempotency_window: z19.string().optional().describe("Optional nonce to DERIVE an idempotency key for action=create when idempotency_key is not given. Reuse the same window on a retry to dedup."),
         status: z19.enum(["open", "in_progress", "done", "needs_review", "blocked", "cancelled", "closed"]).optional().describe("Status for action=update/list/close"),
         result: z19.string().optional().describe("Result summary for action=update or action=close"),
         step: z19.string().optional().describe("Checkpoint step for action=checkpoint"),
@@ -3148,6 +3287,7 @@ function registerTask(server) {
         // Reminder params (absorbed from standalone reminder tool)
         text: z19.string().optional().describe("Reminder text for action=reminder_create"),
         due_date: z19.string().optional().describe("Optional due date \u2014 ISO date (2026-04-01) or null for persistent (reminder_create)"),
+        daily_push: z19.string().optional().describe('Optional daily push schedule for action=reminder_create \u2014 JSON {"hours":[9,18]} (0\u201323, founder timezone). A gateway channel pushes this reminder at those hours. Omit for a normal boot-brief-only reminder.'),
         reminder_id: z19.string().optional().describe("Reminder UUID or text substring to match (reminder_complete)"),
         include_completed: z19.boolean().optional().describe("Include completed reminders (reminder_list). Default: false.")
       }
@@ -3158,9 +3298,15 @@ function registerTask(server) {
         const args = input;
         const reminderText = args.text;
         if (!reminderText) return errorResult2('task action "reminder_create" requires text');
-        const reminder = await createReminder(reminderText, args.due_date);
+        let reminder;
+        try {
+          reminder = await createReminder(reminderText, args.due_date, args.daily_push);
+        } catch (err) {
+          return errorResult2(err instanceof Error ? err.message : String(err));
+        }
         const dueStr = reminder.dueDate ? ` (due: ${reminder.dueDate})` : "";
-        return { content: [{ type: "text", text: `Reminder set: "${reminder.text}"${dueStr}` }] };
+        const pushStr = reminder.dailyPush ? ` (daily push: ${reminder.dailyPush})` : "";
+        return { content: [{ type: "text", text: `Reminder set: "${reminder.text}"${dueStr}${pushStr}` }] };
       }
       if (action === "reminder_list") {
         const args = input;
@@ -3168,8 +3314,9 @@ function registerTask(server) {
         if (reminders.length === 0) return { content: [{ type: "text", text: "No active reminders." }] };
         const lines = reminders.map((r) => {
           const due = r.dueDate ? ` (due: ${r.dueDate})` : "";
+          const push = r.dailyPush ? ` (daily push: ${r.dailyPush})` : "";
           const done = r.completedAt ? " [DONE]" : "";
-          return `\u2022 ${r.text}${due}${done}  [id: ${r.id.slice(0, 8)}]`;
+          return `\u2022 ${r.text}${due}${push}${done}  [id: ${r.id.slice(0, 8)}]`;
         });
         return { content: [{ type: "text", text: lines.join("\n") }] };
       }
@@ -3185,7 +3332,7 @@ function registerTask(server) {
         const taskId = input.task_id;
         if (!taskId) return errorResult2("verify_dispatch requires task_id");
         try {
-          const { checkDispatchStatus } = await import("./dispatch-ack-4S44HBWB.js");
+          const { checkDispatchStatus } = await import("./dispatch-ack-VYH3ONSS.js");
           const result4 = checkDispatchStatus(taskId);
           return {
             content: [{ type: "text", text: JSON.stringify(result4, null, 2) }]
@@ -3199,7 +3346,7 @@ function registerTask(server) {
         const missing2 = missingRequiredFields2(args, REQUIRED_FIELDS2.create_group);
         if (missing2.length > 0) return errorResult2(`task action "create_group" missing required field(s): ${missing2.join(", ")}`);
         try {
-          const { createTaskGroup } = await import("./tasks-crud-6LBNU43G.js");
+          const { createTaskGroup } = await import("./tasks-crud-HBDKE6C5.js");
           const group = await createTaskGroup({
             title: args.title,
             coordinator: args.coordinator,
@@ -3218,7 +3365,7 @@ function registerTask(server) {
         const missing2 = missingRequiredFields2(args, REQUIRED_FIELDS2.group_status);
         if (missing2.length > 0) return errorResult2(`task action "group_status" missing required field(s): ${missing2.join(", ")}`);
         try {
-          const { getGroupStatus } = await import("./tasks-crud-6LBNU43G.js");
+          const { getGroupStatus } = await import("./tasks-crud-HBDKE6C5.js");
           const status2 = await getGroupStatus(args.group_id);
           return { content: [{ type: "text", text: JSON.stringify(status2, null, 2) }] };
         } catch (err) {
@@ -3230,7 +3377,7 @@ function registerTask(server) {
         const missing2 = missingRequiredFields2(args, REQUIRED_FIELDS2.group_results);
         if (missing2.length > 0) return errorResult2(`task action "group_results" missing required field(s): ${missing2.join(", ")}`);
         try {
-          const { getGroupResults } = await import("./tasks-crud-6LBNU43G.js");
+          const { getGroupResults } = await import("./tasks-crud-HBDKE6C5.js");
           const results = await getGroupResults(args.group_id);
           return { content: [{ type: "text", text: JSON.stringify(results, null, 2) }] };
         } catch (err) {
@@ -3481,7 +3628,7 @@ function registerMessage(server) {
       if (msgType && msgPayload) {
         try {
           const { buildTypedMessage, serializeMessage } = await import("./typed-messages-TKDGVPHS.js");
-          const { getActiveAgent: getActiveAgent2 } = await import("./active-agent-AIQP4DFL.js");
+          const { getActiveAgent: getActiveAgent2 } = await import("./active-agent-PVGE57FY.js");
           const { sendMessage } = await import("./lib/messaging.js");
           const { agentId } = getActiveAgent2();
           const envelope = buildTypedMessage({
@@ -3515,9 +3662,11 @@ ID: ${msg.id}`
     if (action === "read") {
       try {
         const { getPendingMessages } = await import("./lib/messaging.js");
-        const { getActiveAgent: getActiveAgent2 } = await import("./active-agent-AIQP4DFL.js");
+        const { getActiveAgent: getActiveAgent2 } = await import("./active-agent-PVGE57FY.js");
+        const { resolveExeSession: resolveExeSession2 } = await import("./lib/tmux-routing.js");
         const { agentId } = getActiveAgent2();
-        const messages = await getPendingMessages(agentId);
+        const callerScope = resolveExeSession2() ?? void 0;
+        const messages = await getPendingMessages(agentId, callerScope);
         if (messages.length === 0) {
           return {
             content: [{ type: "text", text: `No pending messages for ${agentId}.` }]
@@ -3878,8 +4027,8 @@ function registerIngestDocument(server) {
     },
     async (input) => {
       try {
-        const { assertFeature: assertFeature2 } = await import("./plan-limits-WLQZTCSF.js");
-        const { assertMemoryLimit: assertMemoryLimit2 } = await import("./plan-limits-WLQZTCSF.js");
+        const { assertFeature: assertFeature2 } = await import("./plan-limits-2FEY2GOS.js");
+        const { assertMemoryLimit: assertMemoryLimit2 } = await import("./plan-limits-2FEY2GOS.js");
         await assertFeature2("wiki");
         await assertMemoryLimit2();
         const result3 = await ingestDocument(input);
@@ -3950,8 +4099,8 @@ function registerPurgeDocument(server) {
     },
     async ({ document_id }) => {
       try {
-        const { StewardGate: StewardGate2 } = await import("./steward-gate-4A2XHYFD.js");
-        const { getActiveAgent: getActiveAgent2 } = await import("./active-agent-AIQP4DFL.js");
+        const { StewardGate: StewardGate2 } = await import("./steward-gate-3GQ5XKMJ.js");
+        const { getActiveAgent: getActiveAgent2 } = await import("./active-agent-PVGE57FY.js");
         const steward = new StewardGate2();
         const agent = getActiveAgent2();
         const gateDecision = await steward.checkAuthority(agent.agentId || "unknown", "purge_document", document_id);
@@ -4121,7 +4270,7 @@ function registerDocument(server) {
       const { action: _action, ...legacyArgs } = input;
       if (action === "list" && (legacyArgs.workspace_id === void 0 || legacyArgs.workspace_id === null || legacyArgs.workspace_id === "")) {
         try {
-          const { resolveDefaultWorkspaceId, listWorkspaces } = await import("./documents-FA6N7QDA.js");
+          const { resolveDefaultWorkspaceId, listWorkspaces } = await import("./documents-23WX2FPQ.js");
           const defaultId = await resolveDefaultWorkspaceId();
           if (defaultId) {
             legacyArgs.workspace_id = defaultId;
@@ -4159,14 +4308,14 @@ ${lines.join("\n")}`
 
 // src/mcp/tools/gateway.ts
 import { z as z40 } from "zod";
-import { existsSync as existsSync2, readFileSync as readFileSync2, writeFileSync as writeFileSync3, mkdirSync } from "fs";
+import { chmodSync, existsSync as existsSync2, readFileSync as readFileSync2, writeFileSync as writeFileSync3, mkdirSync } from "fs";
 import { join as join2 } from "path";
-import { homedir as homedir2 } from "os";
+import { homedir as homedir3 } from "os";
 
 // src/mcp/tools/send-whatsapp.ts
 import { z as z33 } from "zod";
 import { existsSync, readFileSync } from "fs";
-import { homedir } from "os";
+import { homedir as homedir2 } from "os";
 import { join } from "path";
 var GRAPH_API_VERSION = "v21.0";
 var GRAPH_API_BASE = `https://graph.facebook.com/${GRAPH_API_VERSION}`;
@@ -4222,7 +4371,7 @@ function normalizeGatewaySendUrl(value) {
   return `${raw}/api/send`;
 }
 function loadGatewayJson() {
-  const configPath = process.env.EXE_GATEWAY_CONFIG?.trim() || process.env.EXE_GATEWAY_CONFIG_PATH?.trim() || join(homedir(), ".exe-os", "gateway.json");
+  const configPath = process.env.EXE_GATEWAY_CONFIG?.trim() || process.env.EXE_GATEWAY_CONFIG_PATH?.trim() || join(homedir2(), ".exe-os", "gateway.json");
   if (!existsSync(configPath)) return {};
   try {
     return JSON.parse(readFileSync(configPath, "utf8"));
@@ -5121,7 +5270,7 @@ async function handleStatus() {
     detail: wikiUrl ? `API at ${wikiUrl}` : "EXE_WIKI_API_URL not set"
   };
   try {
-    await import("./graph-rag-WAK2BRJH.js");
+    await import("./graph-rag-JZZAB7PC.js");
     sinks.entity_extraction = { configured: true, detail: "GraphRAG available" };
   } catch {
     sinks.entity_extraction = { configured: false, detail: "graph-rag module unavailable" };
@@ -5148,7 +5297,7 @@ async function handleTrigger(limit) {
     if (rows.rows.length === 0) {
       return text3("No conversations found to re-process.");
     }
-    const { ingest } = await import("./pipeline-router-RTLAGZTA.js");
+    const { ingest } = await import("./pipeline-router-LM53NMWJ.js");
     const results = [];
     for (const row of rows.rows) {
       const r = row;
@@ -5240,7 +5389,7 @@ function registerPipeline(server) {
 }
 
 // src/mcp/tools/gateway.ts
-var GATEWAY_CONFIG_PATH = join2(homedir2(), ".exe-os", "gateway.json");
+var GATEWAY_CONFIG_PATH = join2(homedir3(), ".exe-os", "gateway.json");
 function okResult(text5) {
   return { content: [{ type: "text", text: text5 }] };
 }
@@ -5270,9 +5419,17 @@ function loadGatewayConfig() {
   return {};
 }
 function saveGatewayConfig(config) {
-  const dir = join2(homedir2(), ".exe-os");
-  mkdirSync(dir, { recursive: true });
-  writeFileSync3(GATEWAY_CONFIG_PATH, JSON.stringify(config, null, 2), "utf8");
+  const dir = join2(homedir3(), ".exe-os");
+  mkdirSync(dir, { recursive: true, mode: 448 });
+  try {
+    chmodSync(dir, 448);
+  } catch {
+  }
+  writeFileSync3(GATEWAY_CONFIG_PATH, JSON.stringify(config, null, 2), { encoding: "utf8", mode: 384 });
+  try {
+    chmodSync(GATEWAY_CONFIG_PATH, 384);
+  } catch {
+  }
 }
 function registerGateway(server) {
   const legacy = buildHandlers3();
@@ -5330,7 +5487,7 @@ function registerGateway(server) {
           'gateway action "configure_whatsapp" requires phone_number_id, access_token, and verify_token'
         );
       }
-      const { configureWhatsApp } = await import("./whatsapp-config-GOSELKTE.js");
+      const { configureWhatsApp } = await import("./whatsapp-config-FAX6EA5K.js");
       const result3 = await configureWhatsApp({
         phoneNumberId,
         accessToken,
@@ -5351,7 +5508,7 @@ Phone: ${result3.phoneDisplay ?? "verified"}
       );
     }
     if (action === "whatsapp_status") {
-      const { getWhatsAppStatus } = await import("./whatsapp-config-GOSELKTE.js");
+      const { getWhatsAppStatus } = await import("./whatsapp-config-FAX6EA5K.js");
       const status2 = getWhatsAppStatus();
       if (!status2.connected) {
         return okResult(
@@ -5390,6 +5547,7 @@ Accounts: ${status2.accounts}
       adapterConfig.accounts = accounts;
       config.adapters = adapters;
       saveGatewayConfig(config);
+      _resetCache();
       return okResult(
         `Account "${accountName}" added to ${accountPlatform} in gateway.json.
 Note: Restart the gateway process for changes to take effect.`
@@ -5418,6 +5576,7 @@ Note: Restart the gateway process for changes to take effect.`
       }
       config.adapters = adapters;
       saveGatewayConfig(config);
+      _resetCache();
       return okResult(
         `Account "${accountName}" removed from gateway.json.
 Note: Restart the gateway process for changes to take effect.`
@@ -5779,8 +5938,8 @@ function registerMergeEntities(server) {
     },
     async ({ source_name, source_type, target_name, target_type }) => {
       try {
-        const { StewardGate: StewardGate2 } = await import("./steward-gate-4A2XHYFD.js");
-        const { getActiveAgent: getActiveAgent2 } = await import("./active-agent-AIQP4DFL.js");
+        const { StewardGate: StewardGate2 } = await import("./steward-gate-3GQ5XKMJ.js");
+        const { getActiveAgent: getActiveAgent2 } = await import("./active-agent-PVGE57FY.js");
         const steward = new StewardGate2();
         const agent = getActiveAgent2();
         const gateDecision = await steward.checkAuthority(agent.agentId || "unknown", "merge_entities", `${source_name}\u2192${target_name}`);
@@ -5988,7 +6147,7 @@ async function handleExtractFromDocument(args) {
     return errorResult7('graph action "extract_from_document" requires document_id');
   }
   try {
-    const { extractGraphFromExistingDocument } = await import("./doc-graph-extractor-LR5KMPH7.js");
+    const { extractGraphFromExistingDocument } = await import("./doc-graph-extractor-F6ODFIID.js");
     const result3 = await extractGraphFromExistingDocument(documentId);
     const lines = [
       `## Graph Extraction for Document ${documentId}`,
@@ -6015,7 +6174,7 @@ async function handleCleanupGarbage(args) {
   const doMerge = !garbageOnly;
   let mod;
   try {
-    mod = await import("./cleanup-graph-garbage-MXQ4Q2MA.js");
+    mod = await import("./cleanup-graph-garbage-XWUFAMFO.js");
   } catch (err) {
     return errorResult7(`cleanup_garbage: failed to load cleanup module \u2014 ${err instanceof Error ? err.message : String(err)}`);
   }
@@ -6169,7 +6328,7 @@ function registerSetAgentConfig(server) {
       inputSchema: {
         agent_id: z48.string().optional().describe("Agent name, or 'default' for org-wide default. Omit to view all agents."),
         runtime: z48.string().optional().describe(`Runtime: ${Object.keys(KNOWN_RUNTIMES).join(", ")}`),
-        model: z48.string().optional().describe("Model name (e.g. claude-opus-4, gpt-5.4, anthropic/claude-sonnet-4-6)"),
+        model: z48.string().optional().describe("Model name (e.g. claude-opus-4, gpt-5.5, anthropic/claude-sonnet-4-6). Codex model availability depends on auth type (ChatGPT account vs OpenAI API key); gpt-5.5 is the verified-usable Codex default."),
         reasoning_effort: z48.string().optional().describe("Codex reasoning effort: low, medium, high, xhigh. Per-agent override for thinking/reasoning depth."),
         mcps: z48.array(z48.string()).optional().describe("MCP server allowlist. Only these servers load for this agent. exe-os always included. Omit to load all MCPs.")
       }
@@ -6377,7 +6536,7 @@ function registerGetAgentSpend(server) {
       description: "Get per-agent token spend attribution. Shows input, output, and cache tokens consumed by each agent over a time period, with estimated cost.",
       inputSchema: {
         period: z50.enum(["24h", "7d", "30d"]).default("7d").describe("Time period to query"),
-        agent_id: z50.string().optional().describe("Filter to a specific agent (e.g. 'tom', 'yoshi')")
+        agent_id: z50.string().optional().describe("Filter to a specific agent (e.g. 'engineer', 'architect')")
       }
     },
     async ({ period, agent_id }) => {
@@ -6660,8 +6819,8 @@ ${extHealth.remediation}`);
         } catch {
         }
         try {
-          const { homedir: homedir5 } = await import("os");
-          const dcrConnectors = detectDcrIncompatibleConnectorsFromDisk(homedir5());
+          const { homedir: homedir6 } = await import("os");
+          const dcrConnectors = detectDcrIncompatibleConnectorsFromDisk(homedir6());
           if (dcrConnectors.length > 0) {
             lines.push("\n### Google MCP connectors (auth-incompatible)");
             lines.push("| Connector | Endpoint |");
@@ -6895,7 +7054,7 @@ async function getAgentSessionLoad() {
       return { sessions: [], totalLive: 0, busySessions: 0, idleSessions: 0 };
     }
     const { getClient: getClient2 } = await import("./lib/database.js");
-    const { sessionScopeFilter: sessionScopeFilter2 } = await import("./task-scope-EKYDCVUF.js");
+    const { sessionScopeFilter: sessionScopeFilter2 } = await import("./task-scope-FOIW25HR.js");
     const client = getClient2();
     const scope = sessionScopeFilter2();
     for (const s of liveAgentSessions) {
@@ -6994,27 +7153,40 @@ function registerRunMemoryAudit(server) {
         agent_id: z57.string().optional().describe("Filter audit to a specific agent"),
         project_name: z57.string().optional().describe("Filter audit to a specific project"),
         fix: z57.boolean().optional().default(false).describe("Apply fixes: delete duplicates, chunk bloated records, rebuild FTS, archive shards"),
-        dry_run: z57.boolean().optional().default(false).describe("Preview fixes without applying them")
+        dry_run: z57.boolean().optional().default(false).describe("Preview fixes without applying them"),
+        bounded: z57.boolean().optional().default(true).describe("Cap expensive scans so large memory DBs return promptly. Set false for full CLI-equivalent audit."),
+        duplicate_group_limit: z57.number().int().positive().max(500).optional().describe("Bounded mode: maximum duplicate candidate buckets to inspect"),
+        duplicate_member_limit: z57.number().int().positive().max(1e4).optional().describe("Bounded mode: maximum rows to inspect inside each duplicate candidate bucket")
       }
     },
-    async ({ agent_id, project_name, fix, dry_run }) => {
+    async ({ agent_id, project_name, fix, dry_run, bounded, duplicate_group_limit, duplicate_member_limit }) => {
       try {
         const client = getClient();
         const shouldFix = fix === true;
         const isDryRun = dry_run === true;
+        const boundedAudit = bounded !== false;
         const flags = {
           fix: shouldFix,
           dryRun: isDryRun,
-          verbose: true,
+          verbose: !boundedAudit,
           conflicts: false,
           // O(n²) — opt-in only via CLI --conflicts
           restarts: false,
           // daemon restart report is a separate CLI mode
           agent: agent_id,
-          project: project_name
+          project: project_name,
+          bounded: boundedAudit,
+          duplicateGroupLimit: duplicate_group_limit,
+          duplicateMemberLimit: duplicate_member_limit,
+          deleteLocalSecretResidue: false
         };
         const report = await runAudit(client, flags);
         let formatted = formatReport(report, flags);
+        if (boundedAudit) {
+          formatted += `
+
+Bounded MCP mode: duplicate scan is capped (${duplicate_group_limit ?? 25} bucket(s), ${duplicate_member_limit ?? 250} row(s)/bucket). Set bounded=false for a full audit or run \`exe-os doctor --verbose\` locally.`;
+        }
         if (shouldFix || isDryRun) {
           const mode = isDryRun ? "[dry-run]" : "[fix]";
           const fixLog = [`
@@ -7022,7 +7194,7 @@ ${mode} Applying repairs...
 `];
           if (!isDryRun) {
             try {
-              const { createBackup: createBackup2 } = await import("./db-backup-MX2G3CEK.js");
+              const { createBackup: createBackup2 } = await import("./db-backup-W2QFSYQC.js");
               const backupPath = await createBackup2("pre-fix");
               if (backupPath) {
                 fixLog.push(`  Backup created: ${backupPath.split("/").pop()}`);
@@ -7261,7 +7433,7 @@ async function cloudStatusText() {
   if (lastReuploadedAt) lines.push(`- Last re-upload: ${lastReuploadedAt}`);
   lines.push("");
   try {
-    const { getRetrievalHealth: getRetrievalHealth2, formatDegradations: formatDegradations2 } = await import("./retrieval-health-4C2PO6HH.js");
+    const { getRetrievalHealth: getRetrievalHealth2, formatDegradations: formatDegradations2 } = await import("./retrieval-health-4Z242P3B.js");
     const h = await getRetrievalHealth2();
     lines.push(formatDegradations2(h.degradations, "Health / Degradations"));
     lines.push("");
@@ -8756,7 +8928,7 @@ function registerCreateTrigger(server) {
       }
     },
     async ({ name, event, conditions, actions, project, enabled, schedule, query }) => {
-      const { assertFeature: assertFeature2 } = await import("./plan-limits-WLQZTCSF.js");
+      const { assertFeature: assertFeature2 } = await import("./plan-limits-2FEY2GOS.js");
       const gatedActions = {
         send_whatsapp: "external_agents",
         update_wiki: "wiki"
@@ -9215,8 +9387,8 @@ ${err.message}`
 import { z as z72 } from "zod";
 import { readFileSync as readFileSync4, readdirSync as readdirSync3, statSync } from "fs";
 import path10 from "path";
-import { homedir as homedir3 } from "os";
-var SKILLS_DIR = path10.join(homedir3(), ".claude", "skills");
+import { homedir as homedir4 } from "os";
+var SKILLS_DIR = path10.join(homedir4(), ".claude", "skills");
 function listAvailableSkills() {
   try {
     const entries = readdirSync3(SKILLS_DIR);
@@ -9726,8 +9898,8 @@ function buildHandlers5() {
 }
 async function handleDreaming(action, args) {
   try {
-    const { DreamingEngine: DreamingEngine2 } = await import("./dreaming-UKGTQT6I.js");
-    const { getActiveAgent: getActiveAgent2 } = await import("./active-agent-AIQP4DFL.js");
+    const { DreamingEngine: DreamingEngine2 } = await import("./dreaming-NWD22UQ5.js");
+    const { getActiveAgent: getActiveAgent2 } = await import("./active-agent-PVGE57FY.js");
     const { getClient: getClient2 } = await import("./lib/database.js");
     const agentId = args.agent_id ?? getActiveAgent2().agentId;
     if (action === "dreaming_run") {
@@ -9885,8 +10057,8 @@ function registerConfig(server) {
     }
     if (action === "closeout") {
       try {
-        const { DreamingEngine: DreamingEngine2 } = await import("./dreaming-UKGTQT6I.js");
-        const { getActiveAgent: getActiveAgent2 } = await import("./active-agent-AIQP4DFL.js");
+        const { DreamingEngine: DreamingEngine2 } = await import("./dreaming-NWD22UQ5.js");
+        const { getActiveAgent: getActiveAgent2 } = await import("./active-agent-PVGE57FY.js");
         const { writeMemory: writeMemory2, flushBatch: flushBatch2 } = await import("./lib/store.js");
         const { randomUUID: randomUUID2 } = await import("crypto");
         const { getProjectName: getProjectName2 } = await import("./project-name-EWG5KAZP.js");
@@ -9957,7 +10129,7 @@ function registerConfig(server) {
     }
     if (action === "capability_cards") {
       try {
-        const { getAllCapabilityCards, findAgentForTask } = await import("./capability-cards-OBYQNAKZ.js");
+        const { getAllCapabilityCards, findAgentForTask } = await import("./capability-cards-DN5UIKVN.js");
         const cards = getAllCapabilityCards();
         const taskQuery = args.query;
         if (taskQuery) {
@@ -10008,7 +10180,7 @@ function registerConfig(server) {
         const existing = loadEmployeesSync2();
         if (existing.some((e) => e.name === employeeName)) return errorResult8(`Employee "${employeeName}" already exists.`);
         try {
-          const { assertEmployeeLimit: assertEmployeeLimit2 } = await import("./plan-limits-WLQZTCSF.js");
+          const { assertEmployeeLimit: assertEmployeeLimit2 } = await import("./plan-limits-2FEY2GOS.js");
           await assertEmployeeLimit2();
         } catch (e) {
           return errorResult8(e instanceof Error ? e.message : "Employee limit reached.");
@@ -10049,7 +10221,7 @@ You are ${employeeName}. Role: ${role}.`, "utf-8");
         }
         try {
           const { generateSessionWrappers } = await import("./lib/session-wrappers.js");
-          const { resolvePackageRoot } = await import("./installer-T2LGHZKL.js");
+          const { resolvePackageRoot } = await import("./installer-L7EVH5U5.js");
           generateSessionWrappers(resolvePackageRoot());
         } catch {
         }
@@ -10136,7 +10308,7 @@ function registerListWikiPages(server) {
       }
     },
     async ({ workspace, folder }) => {
-      const { assertFeature: assertFeature2 } = await import("./plan-limits-WLQZTCSF.js");
+      const { assertFeature: assertFeature2 } = await import("./plan-limits-2FEY2GOS.js");
       await assertFeature2("wiki");
       const apiUrl = process.env.EXE_WIKI_API_URL;
       const apiKey = process.env.EXE_WIKI_API_KEY;
@@ -10236,7 +10408,7 @@ function registerGetWikiPage(server) {
       }
     },
     async ({ workspace, document_id, title }) => {
-      const { assertFeature: assertFeature2 } = await import("./plan-limits-WLQZTCSF.js");
+      const { assertFeature: assertFeature2 } = await import("./plan-limits-2FEY2GOS.js");
       await assertFeature2("wiki");
       const apiUrl = process.env.EXE_WIKI_API_URL;
       const apiKey = process.env.EXE_WIKI_API_KEY;
@@ -10430,10 +10602,10 @@ async function handleWikiSearch(input) {
   const userId = input.user_id;
   if (!workspace) return errorResult9('wiki action "search" requires workspace');
   if (!query) return errorResult9('wiki action "search" requires query');
-  const { assertFeature: assertFeature2 } = await import("./plan-limits-WLQZTCSF.js");
+  const { assertFeature: assertFeature2 } = await import("./plan-limits-2FEY2GOS.js");
   await assertFeature2("wiki");
   if (userId) {
-    const { checkWikiAccess } = await import("./wiki-acl-7CROE3MJ.js");
+    const { checkWikiAccess } = await import("./wiki-acl-74BLWG6J.js");
     const { allowed } = await checkWikiAccess(String(userId), String(workspace), "read");
     if (!allowed) {
       return errorResult9(`Access denied: user "${userId}" does not have read access to workspace "${workspace}"`);
@@ -10536,7 +10708,7 @@ function registerWiki(server) {
         return errorResult9('wiki action "document_rerank" requires at least one candidate');
       }
       if (user_id && legacyArgs.workspace) {
-        const { checkWikiAccess } = await import("./wiki-acl-7CROE3MJ.js");
+        const { checkWikiAccess } = await import("./wiki-acl-74BLWG6J.js");
         const { allowed } = await checkWikiAccess(
           String(user_id),
           String(legacyArgs.workspace),
@@ -10717,12 +10889,22 @@ ${lines.join("\n")}`
           };
         }
         const caller2 = getActiveAgent();
-        const roster = loadEmployeesSync();
+        const rosterState = loadEmployeesState();
+        const roster = rosterState.employees;
         const rawAgent = agent_id ?? caller2.agentId;
         const resolvedAgent = baseAgentName(rawAgent, roster);
         const callerBase = baseAgentName(caller2.agentId, roster);
         const isCrossAgentWrite = resolvedAgent !== callerBase;
         if (isCrossAgentWrite) {
+          if (rosterState.status === "error") {
+            return {
+              content: [{
+                type: "text",
+                text: `Permission denied: the employee roster is unreadable or corrupt, so the chain of command cannot be verified. Cross-agent behavior writes are blocked until the roster (exe-employees.json) is repaired.`
+              }],
+              isError: true
+            };
+          }
           const allowed2 = canManage(callerBase, caller2.agentRole, resolvedAgent, roster);
           if (!allowed2) {
             return {
@@ -10857,7 +11039,7 @@ Use /exe-forget to remove any that this supersedes.`;
                 }]
               };
             }
-            const { bulkPurgeGhostBehaviors } = await import("./behaviors-EO7KCP3H.js");
+            const { bulkPurgeGhostBehaviors } = await import("./behaviors-KYRB3NGJ.js");
             const res = await bulkPurgeGhostBehaviors({ batchSize: 5e3, vacuum: true });
             return {
               content: [{
@@ -10968,7 +11150,7 @@ Use /exe-forget to remove any that this supersedes.`;
           return { content: [{ type: "text", text: `Behavior not found: ${behavior_id}` }], isError: true };
         }
         const row2 = result4.rows[0];
-        const { reactivateBehavior: reactivateBehavior2 } = await import("./behaviors-EO7KCP3H.js");
+        const { reactivateBehavior: reactivateBehavior2 } = await import("./behaviors-KYRB3NGJ.js");
         const wasReactivated = await reactivateBehavior2(behavior_id);
         if (!wasReactivated) {
           return { content: [{ type: "text", text: `Behavior ${behavior_id} is already active.` }] };
@@ -11049,11 +11231,12 @@ function registerReminder(server) {
         action: z82.enum(["create", "list", "complete"]).describe("Action to perform"),
         text: z82.string().optional().describe("What to remind about (create)"),
         due_date: z82.string().optional().describe("Optional due date \u2014 ISO date (2026-04-01) or null for persistent (create)"),
+        daily_push: z82.string().optional().describe('Optional daily push schedule (create) \u2014 JSON {"hours":[9,18]} (0\u201323, founder timezone). A gateway channel pushes this reminder at those hours.'),
         reminder_id: z82.string().optional().describe("Reminder UUID or text substring to match (complete)"),
         include_completed: z82.boolean().optional().default(false).describe("Include completed reminders (list)")
       }
     },
-    async ({ action, text: text5, due_date, reminder_id, include_completed }) => {
+    async ({ action, text: text5, due_date, daily_push, reminder_id, include_completed }) => {
       if (action === "create") {
         if (!text5) {
           return {
@@ -11061,10 +11244,19 @@ function registerReminder(server) {
             isError: true
           };
         }
-        const reminder2 = await createReminder(text5, due_date);
+        let reminder2;
+        try {
+          reminder2 = await createReminder(text5, due_date, daily_push);
+        } catch (err) {
+          return {
+            content: [{ type: "text", text: err instanceof Error ? err.message : String(err) }],
+            isError: true
+          };
+        }
         const dueStr = reminder2.dueDate ? ` (due: ${reminder2.dueDate})` : "";
+        const pushStr = reminder2.dailyPush ? ` (daily push: ${reminder2.dailyPush})` : "";
         return {
-          content: [{ type: "text", text: `Reminder set: "${reminder2.text}"${dueStr}` }]
+          content: [{ type: "text", text: `Reminder set: "${reminder2.text}"${dueStr}${pushStr}` }]
         };
       }
       if (action === "list") {
@@ -11076,8 +11268,9 @@ function registerReminder(server) {
         }
         const lines = reminders.map((r) => {
           const due = r.dueDate ? ` (due: ${r.dueDate})` : "";
+          const push = r.dailyPush ? ` (daily push: ${r.dailyPush})` : "";
           const done = r.completedAt ? " [DONE]" : "";
-          return `\u2022 ${r.text}${due}${done}  [id: ${r.id.slice(0, 8)}]`;
+          return `\u2022 ${r.text}${due}${push}${done}  [id: ${r.id.slice(0, 8)}]`;
         });
         return {
           content: [{ type: "text", text: lines.join("\n") }]
@@ -11489,7 +11682,7 @@ function registerWorkflowTool(server) {
         getWorkflowInstance,
         listWorkflowInstances,
         approveWorkflowStep
-      } = await import("./workflow-engine-MMEHKUN4.js");
+      } = await import("./workflow-engine-YITHXZR5.js");
       try {
         switch (input.action) {
           case "create_workflow": {
@@ -11614,7 +11807,6 @@ function formatInstanceStatus(inst, def) {
 // src/mcp/tools/create-bug-report.ts
 import { z as z88 } from "zod";
 import crypto4 from "crypto";
-import { mkdir as mkdir2, writeFile as writeFile2 } from "fs/promises";
 import path13 from "path";
 var CLASSIFICATION = z88.enum([
   "upstream_bug",
@@ -11738,7 +11930,7 @@ function registerCreateBugReport(server) {
         files_changed: z88.array(z88.string()).optional().describe("Files changed or suspected"),
         workaround: z88.string().optional().describe("Temporary local workaround/hotfix, if any"),
         local_patch_diff: z88.string().optional().describe("Small local diff or patch summary"),
-        product: z88.string().optional().describe("Product this bug is for: exe-os, exe-create, exe-wiki, exe-gateway, exe-crm, exe-build. Defaults to exe-os."),
+        product: supportProductSchema.optional().describe("Product this bug is for: exe-os, exe-create, exe-wiki, exe-gateway, exe-crm, exe-build. Defaults to exe-os."),
         package_version: z88.string().optional().describe("Installed package version"),
         project_name: z88.string().optional().describe("Project/customer context"),
         implementing_branch: z88.string().optional().describe("Branch name or PR URL that implements/fixes this bug. Recorded on the report so future work can find existing fixes instead of redoing them (bug e324f244)."),
@@ -11750,6 +11942,7 @@ function registerCreateBugReport(server) {
         on_behalf_of_email: z88.string().email().optional().describe("ADMIN ONLY: file this request owned by another customer's license email; ignored unless caller holds the support admin token")
       }
     },
+    // Structural sink guard (round 6): deep-redact the whole return object + errors.
     async ({
       title,
       classification,
@@ -11769,7 +11962,7 @@ function registerCreateBugReport(server) {
       attachments,
       send_upstream,
       on_behalf_of_email
-    }) => {
+    }) => redactedToolResult(async () => {
       if (!summary || summary.trim().length === 0) {
         return {
           content: [{
@@ -11782,10 +11975,10 @@ function registerCreateBugReport(server) {
       const { agentId, agentRole } = getActiveAgent();
       const id = crypto4.randomUUID();
       const resolvedProduct = product ?? "exe-os";
-      const version = package_version ?? "unknown";
+      const version = sanitizeVersionField(package_version) ?? "unknown";
       let metricsSnapshot = "";
       try {
-        const { getOrchestrationMetrics, formatOrchestrationMetrics } = await import("./orchestration-events-ZG7O4HRY.js");
+        const { getOrchestrationMetrics, formatOrchestrationMetrics } = await import("./orchestration-events-WV4NWKZH.js");
         const sinceIso = new Date(Date.now() - 60 * 60 * 1e3).toISOString();
         const metrics = await getOrchestrationMetrics({ sinceIso });
         if (metrics.totalEvents > 0) {
@@ -11831,46 +12024,38 @@ ${formatOrchestrationMetrics(metrics)}
       }
       const fullMarkdown = markdown + metricsSnapshot + attachmentSection;
       const outDir = path13.join(EXE_AI_DIR, "bug-reports");
-      await mkdir2(outDir, { recursive: true });
-      const reportPath = path13.join(outDir, `${(/* @__PURE__ */ new Date()).toISOString().slice(0, 10)}-${slugify(title)}-${id.slice(0, 8)}.md`);
-      await writeFile2(reportPath, fullMarkdown, "utf-8");
-      if (attachments && attachments.length > 0) {
-        const attachDir = path13.join(outDir, `${id.slice(0, 8)}-attachments`);
-        await mkdir2(attachDir, { recursive: true });
-        for (const att of attachments) {
-          const safeName = att.filename.replace(/[/\\]/g, "_").replace(/\.\./g, "_");
-          const attPath = path13.join(attachDir, safeName);
-          await writeFile2(attPath, att.content, "utf-8");
-          savedAttachmentPaths.push(attPath);
+      const reportPath = path13.join(outDir, `${(/* @__PURE__ */ new Date()).toISOString().slice(0, 10)}-${slugify(redactSecrets(title).text)}-${id.slice(0, 8)}.md`);
+      const attachDir = path13.join(outDir, `${id.slice(0, 8)}-attachments`);
+      const persistAttachments = (attachments ?? []).map((att) => ({
+        // Sanitize filename — redact secrets first (F6: filename lands on disk),
+        // then strip path separators to prevent directory traversal.
+        path: path13.join(attachDir, redactSecrets(att.filename).text.replace(/[/\\]/g, "_").replace(/\.\./g, "_")),
+        content: att.content
+      }));
+      const persisted = await persistSupportArtifact({
+        memoryText: fullMarkdown,
+        file: { path: reportPath, content: fullMarkdown },
+        attachments: persistAttachments,
+        memory: {
+          id,
+          agent_id: agentId,
+          agent_role: agentRole,
+          session_id: process.env.SESSION_ID ?? "manual",
+          timestamp: (/* @__PURE__ */ new Date()).toISOString(),
+          tool_name: "create_bug_report",
+          project_name: project_name ?? "support",
+          has_error: classification === "upstream_bug" || classification === "emergency_hotfix",
+          source_path: reportPath,
+          source_type: "bug_report",
+          memory_type: "bug_report",
+          tier: 1,
+          importance: severity === "p0" ? 10 : severity === "p1" ? 9 : 7,
+          intent: "report",
+          domain: "support",
+          file_paths: files_changed ? JSON.stringify(files_changed) : null
         }
-      }
-      let vector = null;
-      try {
-        vector = await embed(fullMarkdown);
-      } catch {
-        vector = null;
-      }
-      await writeMemory({
-        id,
-        agent_id: agentId,
-        agent_role: agentRole,
-        session_id: process.env.SESSION_ID ?? "manual",
-        timestamp: (/* @__PURE__ */ new Date()).toISOString(),
-        tool_name: "create_bug_report",
-        project_name: project_name ?? "support",
-        has_error: classification === "upstream_bug" || classification === "emergency_hotfix",
-        raw_text: fullMarkdown,
-        vector,
-        source_path: reportPath,
-        source_type: "bug_report",
-        memory_type: "bug_report",
-        tier: 1,
-        importance: severity === "p0" ? 10 : severity === "p1" ? 9 : 7,
-        intent: "report",
-        domain: "support",
-        file_paths: files_changed ? JSON.stringify(files_changed) : null
       });
-      await flushBatch();
+      savedAttachmentPaths.push(...persisted.attachmentPaths);
       const upstreamAttachments = attachments?.map((att) => ({
         filename: att.filename,
         content: att.content,
@@ -11919,14 +12104,13 @@ Upstream status: ${upstreamStatus}`
           }
         ]
       };
-    }
+    })
   );
 }
 
 // src/mcp/tools/create-feature-request.ts
 import { z as z89 } from "zod";
 import crypto5 from "crypto";
-import { mkdir as mkdir3, writeFile as writeFile3 } from "fs/promises";
 import path14 from "path";
 var CATEGORY = z89.enum([
   "upstream_feature",
@@ -12033,7 +12217,7 @@ function registerCreateFeatureRequest(server) {
         current_workaround: z89.string().optional().describe("How the need is currently addressed, if at all"),
         proposed_solution: z89.string().optional().describe("Suggested implementation approach"),
         business_impact: z89.string().optional().describe("Impact on business/workflow if this ships"),
-        product: z89.string().optional().describe("Product this feature is for: exe-os, exe-create, exe-wiki, exe-gateway, exe-crm, exe-build. Defaults to exe-os."),
+        product: supportProductSchema.optional().describe("Product this feature is for: exe-os, exe-create, exe-wiki, exe-gateway, exe-crm, exe-build. Defaults to exe-os."),
         package_version: z89.string().optional().describe("Installed package version"),
         project_name: z89.string().optional().describe("Project/customer context"),
         implementing_branch: z89.string().optional().describe("Branch name or PR URL that implements this feature. Recorded on the request so future work can find existing implementations instead of redoing them (bug e324f244)."),
@@ -12045,6 +12229,7 @@ function registerCreateFeatureRequest(server) {
         on_behalf_of_email: z89.string().email().optional().describe("ADMIN ONLY: file this request owned by another customer's license email; ignored unless caller holds the support admin token")
       }
     },
+    // Structural sink guard (round 6): deep-redact the whole return object + errors.
     async ({
       title,
       category,
@@ -12061,11 +12246,11 @@ function registerCreateFeatureRequest(server) {
       attachments,
       send_upstream,
       on_behalf_of_email
-    }) => {
+    }) => redactedToolResult(async () => {
       const { agentId, agentRole } = getActiveAgent();
       const id = crypto5.randomUUID();
       const resolvedProduct = product ?? "exe-os";
-      const version = package_version ?? "unknown";
+      const version = sanitizeVersionField(package_version) ?? "unknown";
       const markdownBase = buildMarkdown2({
         id,
         title,
@@ -12095,46 +12280,37 @@ function registerCreateFeatureRequest(server) {
       }
       const markdown = markdownBase + attachmentSection;
       const outDir = path14.join(EXE_AI_DIR, "feature-requests");
-      await mkdir3(outDir, { recursive: true });
-      const reportPath = path14.join(outDir, `${(/* @__PURE__ */ new Date()).toISOString().slice(0, 10)}-${slugify2(title)}-${id.slice(0, 8)}.md`);
-      await writeFile3(reportPath, markdown, "utf-8");
-      if (attachments && attachments.length > 0) {
-        const attachDir = path14.join(outDir, `${id.slice(0, 8)}-attachments`);
-        await mkdir3(attachDir, { recursive: true });
-        for (const att of attachments) {
-          const safeName = att.filename.replace(/[/\\]/g, "_").replace(/\.\./g, "_");
-          const attPath = path14.join(attachDir, safeName);
-          await writeFile3(attPath, att.content, "utf-8");
-          savedAttachmentPaths.push(attPath);
+      const reportPath = path14.join(outDir, `${(/* @__PURE__ */ new Date()).toISOString().slice(0, 10)}-${slugify2(redactSecrets(title).text)}-${id.slice(0, 8)}.md`);
+      const attachDir = path14.join(outDir, `${id.slice(0, 8)}-attachments`);
+      const persistAttachments = (attachments ?? []).map((att) => ({
+        // F6: redact secrets from the filename before it lands on disk.
+        path: path14.join(attachDir, redactSecrets(att.filename).text.replace(/[/\\]/g, "_").replace(/\.\./g, "_")),
+        content: att.content
+      }));
+      const persisted = await persistSupportArtifact({
+        memoryText: markdown,
+        file: { path: reportPath, content: markdown },
+        attachments: persistAttachments,
+        memory: {
+          id,
+          agent_id: agentId,
+          agent_role: agentRole,
+          session_id: process.env.SESSION_ID ?? "manual",
+          timestamp: (/* @__PURE__ */ new Date()).toISOString(),
+          tool_name: "create_feature_request",
+          project_name: project_name ?? "support",
+          has_error: false,
+          source_path: reportPath,
+          source_type: "feature_request",
+          memory_type: "feature_request",
+          tier: 1,
+          importance: priority === "p0" ? 10 : priority === "p1" ? 9 : priority === "p2" ? 7 : 5,
+          intent: "request",
+          domain: "support",
+          file_paths: null
         }
-      }
-      let vector = null;
-      try {
-        vector = await embed(markdown);
-      } catch {
-        vector = null;
-      }
-      await writeMemory({
-        id,
-        agent_id: agentId,
-        agent_role: agentRole,
-        session_id: process.env.SESSION_ID ?? "manual",
-        timestamp: (/* @__PURE__ */ new Date()).toISOString(),
-        tool_name: "create_feature_request",
-        project_name: project_name ?? "support",
-        has_error: false,
-        raw_text: markdown,
-        vector,
-        source_path: reportPath,
-        source_type: "feature_request",
-        memory_type: "feature_request",
-        tier: 1,
-        importance: priority === "p0" ? 10 : priority === "p1" ? 9 : priority === "p2" ? 7 : 5,
-        intent: "request",
-        domain: "support",
-        file_paths: null
       });
-      await flushBatch();
+      savedAttachmentPaths.push(...persisted.attachmentPaths);
       const upstreamAttachments = attachments?.map((att) => ({
         filename: att.filename,
         content: att.content,
@@ -12191,13 +12367,13 @@ Upstream status: ${upstreamStatus}`
           }
         ]
       };
-    }
+    })
   );
 }
 
 // src/mcp/tools/update-bug-report.ts
 import { z as z90 } from "zod";
-import { readdir, readFile as readFile2, writeFile as writeFile4 } from "fs/promises";
+import { readdir, readFile as readFile2 } from "fs/promises";
 import path15 from "path";
 var STATUS = z90.enum(["open", "triaged", "fixed", "closed", "wontfix"]);
 var UUID_RE = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/;
@@ -12247,8 +12423,13 @@ async function findReportFile(id) {
   }
   return null;
 }
-async function appendUpdateSection(filePath, opts) {
-  const existing = await readFile2(filePath, "utf-8");
+async function buildUpdateSection(filePath, opts) {
+  let existing = "";
+  try {
+    existing = await readFile2(filePath, "utf-8");
+  } catch {
+    existing = "";
+  }
   const heading = opts.reopen ? "Reopen Request" : "Status Update";
   const updateBlock = [
     "",
@@ -12260,8 +12441,7 @@ async function appendUpdateSection(filePath, opts) {
     ...opts.evidence ? [``, `Evidence: ${opts.evidence}`] : []
   ].join("\n");
   const titleMatch = existing.match(/^# Bug Report — (.+)$/m);
-  await writeFile4(filePath, existing + updateBlock, "utf-8");
-  return titleMatch?.[1] ?? "Unknown bug";
+  return { title: titleMatch?.[1] ?? "Unknown bug", updateBlock };
 }
 async function sendUpstream(payload, isAdmin) {
   const config = await loadConfig();
@@ -12274,7 +12454,7 @@ async function sendUpstream(payload, isAdmin) {
   if (!baseEndpoint) return "not_configured";
   try {
     const base = baseEndpoint.replace(/\/+$/, "");
-    const url = `${base}/${encodeURIComponent(payload.id)}`;
+    const url = `${base}/${encodeURIComponent(sanitizeUpstreamId(payload.id))}`;
     const parsed = new URL(url);
     if (parsed.protocol !== "https:" && !["localhost", "127.0.0.1", "::1"].includes(parsed.hostname)) {
       return "failed: insecure endpoint rejected";
@@ -12309,12 +12489,12 @@ function registerUpdateBugReport(server) {
       title: "Update Bug Report",
       description: "Update a previously filed bug report. As the filing customer (owner) you can add follow-up notes (notes/add_note), attach additional evidence (add_evidence), and request a reopen on a recurring fixed bug (reopen_request). AskExe support (with an admin token) can also move status: open \u2192 triaged \u2192 fixed \u2192 closed (or wontfix). Updates the local file, POSTs the change to AskExe support, and stores a memory.",
       inputSchema: {
-        id: z90.string().min(8).describe("Bug report UUID (full or 8-char prefix)"),
+        id: supportIdSchema.describe("Bug report UUID (full or 8-char prefix)"),
         status: STATUS.optional().describe(
           "New status (admin only): open, triaged, fixed, closed, wontfix. Owners cannot set this \u2014 use reopen_request instead."
         ),
-        fix_version: z90.string().optional().describe("Version that fixes this bug (admin only, e.g. '0.9.161')"),
-        product: z90.string().optional().describe("Re-label this bug's product (admin only): exe-os, exe-create, exe-wiki, exe-gateway, exe-crm, exe-build, exe-chat, exe-auth, exe-monitor, exe-db, exe-erp"),
+        fix_version: supportVersionSchema.optional().describe("Version that fixes this bug (admin only, e.g. '0.9.161')"),
+        product: supportProductSchema.optional().describe("Re-label this bug's product (admin only): exe-os, exe-create, exe-wiki, exe-gateway, exe-crm, exe-build, exe-chat, exe-auth, exe-monitor, exe-db, exe-erp"),
         notes: z90.string().optional().describe("Follow-up notes about the bug or status change"),
         add_note: z90.string().optional().describe("Owner follow-up note (alias of notes)"),
         add_evidence: z90.string().optional().describe("Additional evidence: logs, repro details, stack traces"),
@@ -12323,7 +12503,7 @@ function registerUpdateBugReport(server) {
         send_upstream: z90.boolean().default(true).describe("POST the change to AskExe support endpoint")
       }
     },
-    async ({ id, status: status2, fix_version, product, notes, add_note, add_evidence, reopen_request, reopen_reason, send_upstream }) => {
+    async ({ id, status: status2, fix_version, product, notes, add_note, add_evidence, reopen_request, reopen_reason, send_upstream }) => redactedToolResult(async () => {
       const { agentId, agentRole } = getActiveAgent();
       const config = await loadConfig();
       const isAdmin = !!resolveSupportAdminToken(config);
@@ -12349,67 +12529,69 @@ These do not match \u2014 not updating to avoid mutating the wrong bug. Verify t
       }
       const fullId = resolved?.fullId ?? id;
       let localTitle = "Unknown bug";
+      let updateBlock = null;
       if (localFile) {
         try {
-          localTitle = await appendUpdateSection(localFile, {
+          const built = await buildUpdateSection(localFile, {
             status: reopen ? "open" : status2,
             notes: followUpNote,
             fixVersion: fix_version,
             evidence: add_evidence,
             reopen
           });
+          localTitle = built.title;
+          updateBlock = built.updateBlock;
         } catch {
         }
       }
       const changeParts = [];
       if (reopen) changeParts.push("reopen requested");
       else if (status2) changeParts.push(`marked ${status2}`);
-      if (fix_version) changeParts.push(`fix v${fix_version}`);
+      if (fix_version) changeParts.push(`fix v ${fix_version}`);
       if (product) changeParts.push(`product \u2192 ${product}`);
       if (add_evidence) changeParts.push("evidence added");
       if (followUpNote && !reopen && !status2) changeParts.push("note added");
       const change = changeParts.length > 0 ? changeParts.join(", ") : "updated";
       const memoryText = `Bug "${localTitle}" (${fullId.slice(0, 8)}) ${change}` + (reopen_reason ? `. Reopen reason: ${reopen_reason}` : "") + (followUpNote ? `. Notes: ${followUpNote}` : "");
-      let vector = null;
-      try {
-        vector = await embed(memoryText);
-      } catch {
-        vector = null;
-      }
       const memoryId = `${fullId}-update-${Date.now()}`;
-      await writeMemory({
-        id: memoryId,
-        agent_id: agentId,
-        agent_role: agentRole,
-        session_id: process.env.SESSION_ID ?? "manual",
-        timestamp: (/* @__PURE__ */ new Date()).toISOString(),
-        tool_name: "update_bug_report",
-        project_name: "support",
-        has_error: false,
-        raw_text: memoryText,
-        vector,
-        source_path: localFile ?? null,
-        source_type: "bug_report",
-        memory_type: "bug_report",
-        tier: 1,
-        importance: status2 === "fixed" || status2 === "closed" ? 8 : 6,
-        intent: "update",
-        domain: "support",
-        file_paths: null
+      await persistSupportArtifact({
+        memoryText,
+        file: localFile && updateBlock !== null ? { path: localFile, content: updateBlock, append: true } : void 0,
+        memory: {
+          id: memoryId,
+          agent_id: agentId,
+          agent_role: agentRole,
+          session_id: process.env.SESSION_ID ?? "manual",
+          timestamp: (/* @__PURE__ */ new Date()).toISOString(),
+          tool_name: "update_bug_report",
+          project_name: "support",
+          has_error: false,
+          source_path: localFile ?? null,
+          source_type: "bug_report",
+          memory_type: "bug_report",
+          tier: 1,
+          importance: status2 === "fixed" || status2 === "closed" ? 8 : 6,
+          intent: "update",
+          domain: "support",
+          file_paths: null
+        }
       });
-      await flushBatch();
       const payload = {
-        id: fullId,
+        // Body belt (round 9): even past ingress validation, sanitize the id so a
+        // value from a non-schema caller can't put a raw id in the JSON body.
+        id: sanitizeUpstreamId(fullId),
         updated_at: (/* @__PURE__ */ new Date()).toISOString(),
         agent_id: agentId
       };
       if (isAdmin) {
         if (status2) payload.status = status2;
-        if (fix_version) {
-          payload.fixed_version = fix_version;
-          payload.fix_version = fix_version;
+        const safeFixVersion = sanitizeVersionField(fix_version);
+        if (safeFixVersion) {
+          payload.fixed_version = safeFixVersion;
+          payload.fix_version = safeFixVersion;
         }
-        if (product) payload.product = product;
+        const safeProduct = sanitizeProductFilter(product);
+        if (safeProduct) payload.product = safeProduct;
         if (followUpNote) payload.triage_notes = followUpNote;
       } else {
         if (followUpNote) payload.add_note = followUpNote;
@@ -12439,13 +12621,13 @@ Upstream status: ${upstreamStatus}`
           }
         ]
       };
-    }
+    })
   );
 }
 
 // src/mcp/tools/update-feature-request.ts
 import { z as z91 } from "zod";
-import { readdir as readdir2, readFile as readFile3, writeFile as writeFile5 } from "fs/promises";
+import { readdir as readdir2, readFile as readFile3 } from "fs/promises";
 import path16 from "path";
 var STATUS2 = z91.enum(["open", "planned", "in_progress", "shipped", "closed", "wontdo"]);
 async function findRequestFile(id) {
@@ -12459,9 +12641,8 @@ async function findRequestFile(id) {
     return null;
   }
 }
-async function appendStatusUpdate(filePath, status2, notes, shippedVersion) {
-  const existing = await readFile3(filePath, "utf-8");
-  const updateBlock = [
+function buildStatusUpdate(status2, notes, shippedVersion) {
+  return [
     "",
     `## Status Update \u2014 ${(/* @__PURE__ */ new Date()).toISOString()}`,
     "",
@@ -12469,7 +12650,6 @@ async function appendStatusUpdate(filePath, status2, notes, shippedVersion) {
     ...shippedVersion ? [`shipped_version: ${shippedVersion}`] : [],
     ...notes ? [``, `${notes}`] : []
   ].join("\n");
-  await writeFile5(filePath, existing + updateBlock, "utf-8");
 }
 async function sendUpstream2(payload) {
   const config = await loadConfig();
@@ -12482,7 +12662,7 @@ async function sendUpstream2(payload) {
   if (!baseEndpoint) return "not_configured";
   try {
     const base = baseEndpoint.replace(/\/+$/, "");
-    const url = `${base}/${encodeURIComponent(payload.id)}`;
+    const url = `${base}/${encodeURIComponent(sanitizeUpstreamId(payload.id))}`;
     const parsed = new URL(url);
     if (parsed.protocol !== "https:" && !["localhost", "127.0.0.1", "::1"].includes(parsed.hostname)) {
       return "failed: insecure endpoint rejected";
@@ -12514,59 +12694,59 @@ function registerUpdateFeatureRequest(server) {
       title: "Update Feature Request",
       description: "Update the status of a previously filed feature request. Updates local file, POSTs change to AskExe support, and stores a memory. Status flow: open \u2192 planned \u2192 in_progress \u2192 shipped \u2192 closed (or wontdo at any point).",
       inputSchema: {
-        id: z91.string().min(8).describe("Feature request UUID (full or 8-char prefix)"),
+        id: supportIdSchema.describe("Feature request UUID (full or 8-char prefix)"),
         status: STATUS2.describe("New status: open, planned, in_progress, shipped, closed, wontdo"),
-        shipped_version: z91.string().optional().describe("Version that ships this feature (e.g. '0.9.161')"),
+        shipped_version: supportVersionSchema.optional().describe("Version that ships this feature (e.g. '0.9.161')"),
         notes: z91.string().optional().describe("Notes about the status change"),
         send_upstream: z91.boolean().default(true).describe("POST status change to AskExe support endpoint")
       }
     },
-    async ({ id, status: status2, shipped_version, notes, send_upstream }) => {
+    async ({ id, status: status2, shipped_version, notes, send_upstream }) => redactedToolResult(async () => {
       const { agentId, agentRole } = getActiveAgent();
       const localFile = await findRequestFile(id);
       let localTitle = "Unknown feature";
+      let updateBlock = null;
       if (localFile) {
         try {
           const content = await readFile3(localFile, "utf-8");
           const titleMatch = content.match(/^# Feature Request — (.+)$/m);
           if (titleMatch?.[1]) localTitle = titleMatch[1];
-          await appendStatusUpdate(localFile, status2, notes, shipped_version);
+          updateBlock = buildStatusUpdate(status2, notes, shipped_version);
         } catch {
         }
       }
-      const memoryText = `Feature "${localTitle}" (${id.slice(0, 8)}) marked ${status2}` + (shipped_version ? ` in v${shipped_version}` : "") + (notes ? `. Notes: ${notes}` : "");
-      let vector = null;
-      try {
-        vector = await embed(memoryText);
-      } catch {
-        vector = null;
-      }
+      const memoryText = `Feature "${localTitle}" (${id.slice(0, 8)}) marked ${status2}` + (shipped_version ? ` in v ${shipped_version}` : "") + (notes ? `. Notes: ${notes}` : "");
       const memoryId = `${id}-update-${Date.now()}`;
-      await writeMemory({
-        id: memoryId,
-        agent_id: agentId,
-        agent_role: agentRole,
-        session_id: process.env.SESSION_ID ?? "manual",
-        timestamp: (/* @__PURE__ */ new Date()).toISOString(),
-        tool_name: "update_feature_request",
-        project_name: "support",
-        has_error: false,
-        raw_text: memoryText,
-        vector,
-        source_path: localFile ?? null,
-        source_type: "feature_request",
-        memory_type: "feature_request",
-        tier: 1,
-        importance: status2 === "shipped" || status2 === "closed" ? 8 : 6,
-        intent: "update",
-        domain: "support",
-        file_paths: null
+      await persistSupportArtifact({
+        memoryText,
+        file: localFile && updateBlock !== null ? { path: localFile, content: updateBlock, append: true } : void 0,
+        memory: {
+          id: memoryId,
+          agent_id: agentId,
+          agent_role: agentRole,
+          session_id: process.env.SESSION_ID ?? "manual",
+          timestamp: (/* @__PURE__ */ new Date()).toISOString(),
+          tool_name: "update_feature_request",
+          project_name: "support",
+          has_error: false,
+          source_path: localFile ?? null,
+          source_type: "feature_request",
+          memory_type: "feature_request",
+          tier: 1,
+          importance: status2 === "shipped" || status2 === "closed" ? 8 : 6,
+          intent: "update",
+          domain: "support",
+          file_paths: null
+        }
       });
-      await flushBatch();
       const upstreamStatus = send_upstream ? await sendUpstream2({
-        id,
+        // Body belt (round 9): sanitize the id so a non-schema caller can't put
+        // a raw id in the JSON body (the URL is sanitized separately).
+        id: sanitizeUpstreamId(id),
         status: status2,
-        shipped_version,
+        // Body belt (round 10): shape-validate the version so a schema-bypassing
+        // caller can't put a raw credential-shaped version in the body.
+        shipped_version: sanitizeVersionField(shipped_version),
         notes,
         updated_at: (/* @__PURE__ */ new Date()).toISOString(),
         agent_id: agentId
@@ -12585,7 +12765,7 @@ Upstream status: ${upstreamStatus}`
           }
         ]
       };
-    }
+    })
   );
 }
 
@@ -13075,7 +13255,7 @@ function registerCliParityTools(server) {
     const out = await runCommand("exe-os", ["cloud", "status"], 45e3);
     let healthSection = "";
     try {
-      const { getRetrievalHealth: getRetrievalHealth2, formatDegradations: formatDegradations2 } = await import("./retrieval-health-4C2PO6HH.js");
+      const { getRetrievalHealth: getRetrievalHealth2, formatDegradations: formatDegradations2 } = await import("./retrieval-health-4Z242P3B.js");
       const h = await getRetrievalHealth2();
       const lines = [
         "",
@@ -13143,7 +13323,7 @@ function registerCodeContext(server) {
       const index = buildCodeContextIndex(opts);
       let graphExtract;
       try {
-        const { autoExtractGraphEntities } = await import("./graph-auto-extract-HCQQF5AG.js");
+        const { autoExtractGraphEntities } = await import("./graph-auto-extract-OURWMGBS.js");
         graphExtract = await autoExtractGraphEntities(opts.projectRoot);
       } catch {
       }
@@ -13391,7 +13571,6 @@ import { z as z98 } from "zod";
 // src/mcp/tools/create-review.ts
 import { z as z97 } from "zod";
 import crypto6 from "crypto";
-import { mkdir as mkdir4, writeFile as writeFile6 } from "fs/promises";
 import path17 from "path";
 var PRIORITY2 = z97.enum(["p0", "p1", "p2", "p3"]);
 function slugify3(input) {
@@ -13467,12 +13646,13 @@ function registerCreateReview(server) {
         priority: PRIORITY2.default("p1").describe("p0 critical -> p3 low"),
         source: z97.string().optional().describe("Source: self-improve, manual, ci, etc."),
         pr_url: z97.string().optional().describe("PR URL if applicable"),
-        product: z97.string().optional().describe("Product: exe-os (default), exe-create, exe-wiki, exe-gateway, exe-crm, exe-build"),
+        product: supportProductSchema.optional().describe("Product: exe-os (default), exe-create, exe-wiki, exe-gateway, exe-crm, exe-build"),
         package_version: z97.string().optional().describe("Installed package version"),
         project_name: z97.string().optional().describe("Project/customer context"),
         send_upstream: z97.boolean().default(false).describe("Attempt to POST to configured AskExe support endpoint (disabled by default \u2014 review route not yet live)")
       }
     },
+    // Structural sink guard (round 6): deep-redact the whole return object + errors.
     async ({
       title,
       description,
@@ -13483,11 +13663,11 @@ function registerCreateReview(server) {
       package_version,
       project_name,
       send_upstream
-    }) => {
+    }) => redactedToolResult(async () => {
       const { agentId, agentRole } = getActiveAgent();
       const id = crypto6.randomUUID();
       const resolvedProduct = product ?? "exe-os";
-      const version = package_version ?? "unknown";
+      const version = sanitizeVersionField(package_version) ?? "unknown";
       const markdown = buildMarkdown3({
         id,
         title,
@@ -13502,36 +13682,29 @@ function registerCreateReview(server) {
         projectName: project_name
       });
       const outDir = path17.join(EXE_AI_DIR, "reviews");
-      await mkdir4(outDir, { recursive: true });
-      const reportPath = path17.join(outDir, `${(/* @__PURE__ */ new Date()).toISOString().slice(0, 10)}-${slugify3(title)}-${id.slice(0, 8)}.md`);
-      await writeFile6(reportPath, markdown, "utf-8");
-      let vector = null;
-      try {
-        vector = await embed(markdown);
-      } catch {
-        vector = null;
-      }
-      await writeMemory({
-        id,
-        agent_id: agentId,
-        agent_role: agentRole,
-        session_id: process.env.SESSION_ID ?? "manual",
-        timestamp: (/* @__PURE__ */ new Date()).toISOString(),
-        tool_name: "create_review",
-        project_name: project_name ?? "support",
-        has_error: false,
-        raw_text: markdown,
-        vector,
-        source_path: reportPath,
-        source_type: "review",
-        memory_type: "review",
-        tier: 1,
-        importance: priority === "p0" ? 10 : priority === "p1" ? 9 : priority === "p2" ? 7 : 5,
-        intent: "review",
-        domain: "support",
-        file_paths: null
+      const reportPath = path17.join(outDir, `${(/* @__PURE__ */ new Date()).toISOString().slice(0, 10)}-${slugify3(redactSecrets(title).text)}-${id.slice(0, 8)}.md`);
+      await persistSupportArtifact({
+        memoryText: markdown,
+        file: { path: reportPath, content: markdown },
+        memory: {
+          id,
+          agent_id: agentId,
+          agent_role: agentRole,
+          session_id: process.env.SESSION_ID ?? "manual",
+          timestamp: (/* @__PURE__ */ new Date()).toISOString(),
+          tool_name: "create_review",
+          project_name: project_name ?? "support",
+          has_error: false,
+          source_path: reportPath,
+          source_type: "review",
+          memory_type: "review",
+          tier: 1,
+          importance: priority === "p0" ? 10 : priority === "p1" ? 9 : priority === "p2" ? 7 : 5,
+          intent: "review",
+          domain: "support",
+          file_paths: null
+        }
       });
-      await flushBatch();
       const upstreamPayload = {
         id,
         title,
@@ -13564,7 +13737,7 @@ Upstream status: ${upstreamStatus}`
           }
         ]
       };
-    }
+    })
   );
 }
 
@@ -13624,7 +13797,7 @@ function registerSupportConsolidated(server) {
     "support",
     {
       title: "Support",
-      description: "Bug reports, feature requests, reviews, and support system. Actions: create_bug, create_feature, create_review, update_bug, update_feature, list_my_bugs, list_my_features, list_my_reviews, list_bugs, get_bug, add_comment, get_comments, triage_bug, list_features, get_feature, triage_feature, list_reviews, get_review, triage_review, health, test. Use 'product' param to file bugs for any AskExe product.",
+      description: "Bug reports, feature requests, reviews, and support system. Actions: create_bug, create_feature, create_review, update_bug, update_feature, list_my_bugs, list_my_features, list_my_reviews, list_bugs, get_bug, add_comment, get_comments, triage_bug, list_features, get_feature, triage_feature, list_reviews, get_review, triage_review, health, test. Use 'product' param to file/route bugs AND feature requests for any AskExe product.",
       inputSchema: {
         action: z98.enum([
           "create_bug",
@@ -13654,23 +13827,51 @@ function registerSupportConsolidated(server) {
         steps_to_reproduce: z98.string().optional().describe("Steps to reproduce (bugs)"),
         expected_behavior: z98.string().optional().describe("Expected behavior (bugs)"),
         actual_behavior: z98.string().optional().describe("Actual behavior (bugs)"),
-        severity: z98.string().optional().describe("Severity: p0/p1/p2/p3"),
-        product: z98.string().optional().describe("Product (create_bug default exe-os; also re-labels a bug via update_bug, admin only): exe-os, exe-create, exe-wiki, exe-gateway, exe-crm, exe-build, exe-chat, exe-auth, exe-monitor, exe-db, exe-erp"),
+        // Round 10: these are ENUM fields — on list actions they reach the vendor URL
+        // query, and on triage/create the body. Constrained to the UNION of valid values
+        // across bug/feature/review actions so a non-enum value is rejected at ingress.
+        severity: z98.enum(["p0", "p1", "p2", "p3"]).optional().describe("Severity: p0/p1/p2/p3"),
+        // bug b8e990ed: product works for BOTH bugs and features (create default exe-os;
+        // list_bugs/list_features filter; triage_bug/triage_feature admin re-label).
+        // Kept on the strict ingress schema (round 10) rather than a loose string.
+        product: supportProductSchema.optional().describe("Product \u2014 works for BOTH bugs and features (create default exe-os; list_bugs/list_features filter; triage_bug/triage_feature admin re-label): exe-os, exe-create, exe-wiki, exe-gateway, exe-crm, exe-build, exe-chat, exe-auth, exe-monitor, exe-db, exe-erp"),
         use_case: z98.string().optional().describe("Use case (features)"),
         proposed_solution: z98.string().optional().describe("Proposed solution (features)"),
-        priority: z98.string().optional().describe("Priority (features)"),
+        priority: z98.enum(["p0", "p1", "p2", "p3"]).optional().describe("Priority (features)"),
         on_behalf_of_email: z98.string().email().optional().describe("ADMIN ONLY: file this request owned by another customer's license email; ignored unless caller holds the support admin token (create_bug/create_feature)"),
-        id: z98.string().optional().describe("Bug/feature ID for get/triage/add_comment/get_comments"),
+        // Round 10: constrained fields are shape-validated at ingress (this is the
+        // DEFAULT surface and calls handlers directly, bypassing their per-tool schemas).
+        id: supportIdSchema.optional().describe("Bug/feature ID for get/triage/add_comment/get_comments"),
         comment: z98.string().optional().describe("Comment text to append to a bug report thread (add_comment)"),
-        status: z98.string().optional().describe("Filter by status"),
-        classification: z98.string().optional().describe("Triage classification"),
+        status: z98.enum([
+          "all",
+          "open",
+          "triaged",
+          "fixed",
+          "closed",
+          "wontfix",
+          "planned",
+          "in_progress",
+          "shipped",
+          "wontdo",
+          "in_review",
+          "approved",
+          "merged",
+          "rejected"
+        ]).optional().describe("Filter by status (union across bug/feature/review)"),
+        classification: z98.enum([
+          "upstream_bug",
+          "customer_customization",
+          "emergency_hotfix",
+          "unclear"
+        ]).optional().describe("Triage classification"),
         resolution: z98.string().optional().describe("Triage resolution"),
         notes: z98.string().optional().describe("Triage notes (mapped to triage_notes for bug/feature triage)"),
         triage_notes: z98.string().optional().describe("Triage notes (legacy field name)"),
-        linked_task_id: z98.string().optional().describe("Linked task ID for triage"),
-        linked_commit: z98.string().optional().describe("Linked commit hash for triage"),
-        fixed_version: z98.string().optional().describe("Version that fixes this bug"),
-        shipped_version: z98.string().optional().describe("Version that ships this feature (features only)"),
+        linked_task_id: supportTaskIdSchema.optional().describe("Linked task ID for triage"),
+        linked_commit: supportCommitSchema.optional().describe("Linked commit hash for triage"),
+        fixed_version: supportVersionSchema.optional().describe("Version that fixes this bug"),
+        shipped_version: supportVersionSchema.optional().describe("Version that ships this feature (features only)"),
         add_evidence: z98.string().optional().describe("Owner self-service: additional evidence (logs, repro, stack traces) for update_bug"),
         reopen_request: z98.boolean().optional().describe("Owner self-service: request a reopen on a recurring fixed bug (update_bug)"),
         reopen_reason: z98.string().optional().describe("Owner self-service: why the bug should be reopened (update_bug)"),
@@ -13681,8 +13882,8 @@ function registerSupportConsolidated(server) {
         source: z98.string().optional().describe("Review source: self-improve, manual, ci"),
         pr_url: z98.string().optional().describe("PR URL (reviews)"),
         review_resolution: z98.string().optional().describe("Resolution text (reviews)"),
-        limit: z98.coerce.number().optional().describe("Max results per page (up to 500)"),
-        offset: z98.coerce.number().optional().describe("Number of results to skip for pagination (list_my_bugs/list_my_features). Use next_offset from a prior response.")
+        limit: z98.coerce.number().int().min(1).max(500).optional().describe("Max results per page (up to 500)"),
+        offset: z98.coerce.number().int().min(0).optional().describe("Number of results to skip for pagination (list_bugs, list_features, list_reviews, list_my_bugs, list_my_features). Use next_offset from a prior response.")
       }
     },
     async (input, extra) => {
@@ -13782,12 +13983,12 @@ function buildHandlers9() {
 function registerDiagnostics(server) {
   const handlers = buildHandlers9();
   const toolNames = Array.from(handlers.keys());
-  toolNames.push("tool_search", "drift", "merge_agent_memories", "agent_liveness", "steward_check", "steward_audit_log", "steward_override", "daemon_restarts", "spawn_failures", "orchestration_health", "work_map");
+  toolNames.push("tool_search", "drift", "merge_agent_memories", "agent_liveness", "steward_check", "steward_audit_log", "steward_override", "daemon_restarts", "timers", "spawn_failures", "orchestration_health", "work_map");
   server.registerTool(
     "diagnostics",
     {
       title: "Diagnostics",
-      description: `System diagnostics and admin operations. Actions: ${toolNames.join(", ")}. Covers health checks, update status, cloud status, key management, employee rename, semantic tool discovery (tool_search), identity drift detection (drift), agent liveness monitoring (agent_liveness), agent memory reassignment (merge_agent_memories), steward identity gate (steward_check, steward_audit_log, steward_override), daemon restart forensics (daemon_restarts \u2014 'why did the daemon restart?': restart-cause breakdown, slowest-timer leaderboard, event-loop-block frequency), and orchestration-health visibility: spawn_failures ('why did dispatch fail?': tmux spawn fail count + cause breakdown path_not_found/claude_launch_failed/timeout + success-vs-fail ratio), orchestration_health ('is the box healthy / is the spiral happening?': load/core, event-loop lag, direct-SQLite-fallback count, event-loop blocks), and work_map ('who's doing what / who died and why?': live sessions \xD7 role \xD7 task \xD7 worktree flag, plus recent session deaths with cause/load + worktree violations).`,
+      description: `System diagnostics and admin operations. Actions: ${toolNames.join(", ")}. Covers health checks, update status, cloud status, key management, employee rename, semantic tool discovery (tool_search), identity drift detection (drift), agent liveness monitoring (agent_liveness), agent memory reassignment (merge_agent_memories), steward identity gate (steward_check, steward_audit_log, steward_override), daemon restart forensics (daemon_restarts \u2014 'why did the daemon restart?': restart-cause breakdown, slowest-timer leaderboard, event-loop-block frequency), timer health dashboard (timers \u2014 'which background timer is about to take the daemon down?': per-timer last/avg/p95/max tick duration, watchdog trips past the 10s event-loop-block budget, whether the timer is executing right now, projected next fire \u2014 sorted worst-first; read-only over already-emitted daemon health logs), and orchestration-health visibility: spawn_failures ('why did dispatch fail?': tmux spawn fail count + cause breakdown path_not_found/claude_launch_failed/timeout + success-vs-fail ratio), orchestration_health ('is the box healthy / is the spiral happening?': load/core, event-loop lag, direct-SQLite-fallback count, event-loop blocks), and work_map ('who's doing what / who died and why?': live sessions \xD7 role \xD7 task \xD7 worktree flag, plus recent session deaths with cause/load + worktree violations).`,
       inputSchema: {
         action: z99.string().describe(`Diagnostic operation: ${toolNames.join(", ")}`),
         // Pass-through params used by various sub-tools
@@ -13836,6 +14037,21 @@ function registerDiagnostics(server) {
           return { content: [{ type: "text", text: `daemon_restarts failed: ${err instanceof Error ? err.message : String(err)}` }], isError: true };
         }
       }
+      if (action === "timers") {
+        try {
+          const { buildLiveTimerReport, formatTimerReport } = await import("./daemon-timer-report-NM44WQRH.js");
+          const report = await buildLiveTimerReport();
+          const asJson = input.format === "json";
+          return {
+            content: [{
+              type: "text",
+              text: asJson ? JSON.stringify(report, null, 2) : formatTimerReport(report)
+            }]
+          };
+        } catch (err) {
+          return { content: [{ type: "text", text: `timers failed: ${err instanceof Error ? err.message : String(err)}` }], isError: true };
+        }
+      }
       if (action === "spawn_failures") {
         return handleSpawnFailures();
       }
@@ -13968,7 +14184,7 @@ async function handleMergeAgentMemories(input) {
 }
 async function handleSpawnFailures() {
   try {
-    const { getOrchestrationMetrics } = await import("./orchestration-events-ZG7O4HRY.js");
+    const { getOrchestrationMetrics } = await import("./orchestration-events-WV4NWKZH.js");
     const metrics = await getOrchestrationMetrics();
     const c = metrics.counts;
     const attempted = c.tmuxSpawnAttempted;
@@ -14070,7 +14286,7 @@ async function handleOrchestrationHealth() {
 async function handleWorkMap() {
   try {
     const { getAgentLivenessReport } = await import("./agent-heartbeat-I5UPGXAU.js");
-    const { classifyRole } = await import("./session-kill-telemetry-6YDGEF27.js");
+    const { classifyRole } = await import("./session-kill-telemetry-AELE4JDK.js");
     const { buildSessionDeathSummary } = await import("./orchestration-health-read-EJWVUARG.js");
     const { getPaneCwd } = await import("./lib/tmux-status.js");
     const live = getAgentLivenessReport();
@@ -14205,7 +14421,7 @@ async function handleDrift(input) {
 }
 async function handleSteward(action, input) {
   const gate = new StewardGate();
-  const { getActiveAgent: getActiveAgent2 } = await import("./active-agent-AIQP4DFL.js");
+  const { getActiveAgent: getActiveAgent2 } = await import("./active-agent-PVGE57FY.js");
   const inputAgent = input.agent_id;
   const operation = input.operation;
   const target = input.target;
@@ -14503,7 +14719,7 @@ function registerResonance(server) {
     }
   }, async ({ action, memory_id, entity_id, limit }) => {
     try {
-      const { getHotPairs, getCoActivationNeighbors } = await import("./co-activation-QI5BK4RT.js");
+      const { getHotPairs, getCoActivationNeighbors } = await import("./co-activation-ZCHPLLP6.js");
       if (action === "hot_pairs") {
         const pairs = await getHotPairs(limit ?? 20);
         if (pairs.length === 0) return text4("No co-activation data yet. Pairs are recorded as memories are accessed together in searches.");
@@ -14917,7 +15133,7 @@ ${err.stack ?? ""}` : String(err);
     gate("registerSupportTools", registerSupportTools);
     const hasAdminToken = !!(process.env.ASKEXE_SUPPORT_ADMIN_TOKEN || process.env.EXE_SUPPORT_ADMIN_TOKEN || (() => {
       try {
-        const c = JSON.parse(readFileSync7(join4(process.env.EXE_OS_DIR ?? join4(homedir4(), ".exe-os"), "config.json"), "utf-8"));
+        const c = JSON.parse(readFileSync7(join4(process.env.EXE_OS_DIR ?? join4(homedir5(), ".exe-os"), "config.json"), "utf-8"));
         return c.support?.adminToken || c.support?.admin_token;
       } catch {
         return "";