@askexenow/exe-os 0.9.341 → 0.9.342

package/dist/{update-support-VPBD5SD2.js → update-support-UVUSZG7R.js}

@@ -1,54 +1,59 @@
 import {
   queueSupportStatusUpdateSync
-} from "./chunk-Q5AIPSSC.js";
-import "./chunk-MMRUBN3I.js";
+} from "./chunk-25X4JD2V.js";
 import {
-  embed
-} from "./chunk-AP455LBW.js";
+  persistSupportArtifact
+} from "./chunk-TTCUG2CF.js";
 import {
-  flushBatch,
-  writeMemory
-} from "./chunk-EDH54E5A.js";
+  supportIdSchema,
+  supportVersionSchema
+} from "./chunk-5H47VHB7.js";
+import "./chunk-MMRUBN3I.js";
+import "./chunk-XZXBB3TN.js";
+import "./chunk-VSRPS3J7.js";
 import "./chunk-CHCA3ZM2.js";
 import "./chunk-OTVEIJUQ.js";
-import "./chunk-7LF5DS3A.js";
+import "./chunk-6XWTQUO4.js";
 import {
   getActiveAgent
-} from "./chunk-C445WRUX.js";
+} from "./chunk-5ERDIOV3.js";
 import {
   isTelemetryRedactionEnabled,
-  sanitizeUpstreamPayload
-} from "./chunk-RP5GETX5.js";
+  redactedToolResult,
+  sanitizeUpstreamId,
+  sanitizeUpstreamPayload,
+  sanitizeVersionField
+} from "./chunk-4QCFFW2H.js";
 import "./chunk-CVYC6DUW.js";
-import "./chunk-UU4UINUX.js";
+import "./chunk-G4RGKBCA.js";
 import "./chunk-AFNRE2RV.js";
-import "./chunk-3NGZ4PL7.js";
+import "./chunk-X2Q5NLUL.js";
 import "./chunk-NLEW62VC.js";
 import "./chunk-GJV3WDWM.js";
 import "./chunk-MP2AFCGL.js";
-import "./chunk-RWSLVYTE.js";
+import "./chunk-AOHXREB7.js";
 import "./chunk-2I23RPSI.js";
-import "./chunk-BV6GBSRP.js";
+import "./chunk-OLMQ4UOF.js";
 import "./chunk-PNQDP3OA.js";
 import "./chunk-H73TUI4Y.js";
 import "./chunk-7HLWBYH7.js";
 import "./chunk-FXU7JOXK.js";
-import "./chunk-Z42MXYWW.js";
+import "./chunk-QWVXN224.js";
 import {
   loadLicense,
   readCachedLicenseToken
-} from "./chunk-7SEC2AG5.js";
-import "./chunk-PPZOWQHP.js";
+} from "./chunk-PQIDGXSG.js";
+import "./chunk-K7KFGDWF.js";
 import {
   EXE_AI_DIR,
   loadConfig
-} from "./chunk-7Y5UDEVM.js";
-import "./chunk-SHIICYJW.js";
+} from "./chunk-WZHZCDDO.js";
+import "./chunk-BYTDMAGB.js";
 import "./chunk-MLKGABMK.js";
 
 // src/mcp/tools/update-support.ts
 import { z } from "zod";
-import { readdir, readFile, writeFile } from "fs/promises";
+import { readdir, readFile } from "fs/promises";
 import path from "path";
 var BUG_STATUS = z.enum(["open", "triaged", "fixed", "closed", "wontfix"]);
 var FEATURE_STATUS = z.enum(["open", "planned", "in_progress", "shipped", "closed", "wontdo"]);
@@ -166,19 +171,22 @@ function registerUpdateBugReport(server) {
       title: "Update Bug Report",
       description: "Update the status of a previously filed bug report. Updates local markdown file, stores a memory, and POSTs the change to AskExe support. Statuses: open \u2192 triaged \u2192 fixed \u2192 closed \u2192 wontfix.",
       inputSchema: {
-        id: z.string().min(8).describe("Bug report ID (UUID or first 8 chars)"),
+        id: supportIdSchema.describe("Bug report ID (UUID or first 8 chars)"),
         status: BUG_STATUS.describe("New status"),
-        fix_version: z.string().optional().describe("Version that fixes this bug (e.g. '0.9.161')"),
+        fix_version: supportVersionSchema.optional().describe("Version that fixes this bug (e.g. '0.9.161')"),
         notes: z.string().optional().describe("Update notes \u2014 why this status change"),
         send_upstream: z.boolean().default(true).describe("POST update to AskExe support endpoint")
       }
     },
-    async ({ id, status, fix_version, notes, send_upstream }) => {
+    // Structural sink guard (round 6): deep-redact the whole return object and any
+    // propagated error, so no echoed field (id, fix_version, notes, …) can leak.
+    async ({ id, status, fix_version, notes, send_upstream }) => redactedToolResult(async () => {
       const { agentId, agentRole } = getActiveAgent();
       const reportDir = path.join(EXE_AI_DIR, "bug-reports");
       const reportPath = await findReportFile(reportDir, id);
       let fullId = id;
       let title = id;
+      let updatedContent = null;
       if (reportPath) {
         let content = await readFile(reportPath, "utf-8");
         const idMatch = content.match(/^id:\s*([0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12})\s*$/m);
@@ -198,45 +206,40 @@ ${fix_version ? `Fix version: ${fix_version}
 ` : ""}${notes}
 `;
         }
-        await writeFile(reportPath, content, "utf-8");
+        updatedContent = content;
       }
-      const memoryText = fix_version ? `Bug "${title}" marked ${status} in v${fix_version}${notes ? `. ${notes}` : ""}` : `Bug "${title}" marked ${status}${notes ? `. ${notes}` : ""}`;
-      let vector = null;
-      try {
-        vector = await embed(memoryText);
-      } catch {
-        vector = null;
-      }
-      await writeMemory({
-        id: `${fullId}-update-${Date.now()}`,
-        agent_id: agentId,
-        agent_role: agentRole,
-        session_id: process.env.SESSION_ID ?? "manual",
-        timestamp: (/* @__PURE__ */ new Date()).toISOString(),
-        tool_name: "update_bug_report",
-        project_name: "support",
-        has_error: false,
-        raw_text: memoryText,
-        vector,
-        source_path: reportPath ?? void 0,
-        source_type: "bug_report_update",
-        memory_type: "observation",
-        tier: 1,
-        importance: 7,
-        intent: "update",
-        domain: "support",
-        file_paths: null
+      const memoryText = fix_version ? `Bug "${title}" marked ${status} in v ${fix_version}${notes ? `. ${notes}` : ""}` : `Bug "${title}" marked ${status}${notes ? `. ${notes}` : ""}`;
+      const persisted = await persistSupportArtifact({
+        memoryText,
+        file: reportPath && updatedContent !== null ? { path: reportPath, content: updatedContent, append: false } : void 0,
+        memory: {
+          id: `${fullId}-update-${Date.now()}`,
+          agent_id: agentId,
+          agent_role: agentRole,
+          session_id: process.env.SESSION_ID ?? "manual",
+          timestamp: (/* @__PURE__ */ new Date()).toISOString(),
+          tool_name: "update_bug_report",
+          project_name: "support",
+          has_error: false,
+          source_path: reportPath ?? void 0,
+          source_type: "bug_report_update",
+          memory_type: "observation",
+          tier: 1,
+          importance: 7,
+          intent: "update",
+          domain: "support",
+          file_paths: null
+        }
       });
-      await flushBatch();
       const upstreamPayload = {
-        id: fullId,
+        id: sanitizeUpstreamId(fullId),
         status,
-        fixed_version: fix_version,
+        fixed_version: sanitizeVersionField(fix_version),
         triage_notes: notes,
         updated_at: (/* @__PURE__ */ new Date()).toISOString(),
         agent_id: agentId
       };
-      const upstreamStatus = send_upstream ? await sendStatusUpstream("bug", `bug-reports/${encodeURIComponent(fullId)}`, upstreamPayload) : "skipped";
+      const upstreamStatus = send_upstream ? await sendStatusUpstream("bug", `bug-reports/${encodeURIComponent(sanitizeUpstreamId(fullId))}`, upstreamPayload) : "skipped";
       return {
         content: [
           {
@@ -246,12 +249,12 @@ ID: ${fullId}
 New status: ${status}
 ${fix_version ? `Fix version: ${fix_version}
 ` : ""}Local file: ${reportPath ?? "not found"}
-Memory stored: ${memoryText}
+Memory stored: ${persisted.redactedMemoryText}
 Upstream status: ${upstreamStatus}`
           }
         ]
       };
-    }
+    })
   );
 }
 function registerUpdateFeatureRequest(server) {
@@ -261,19 +264,21 @@ function registerUpdateFeatureRequest(server) {
       title: "Update Feature Request",
       description: "Update the status of a previously filed feature request. Updates local markdown file, stores a memory, and POSTs the change to AskExe support. Statuses: open \u2192 planned \u2192 in_progress \u2192 shipped \u2192 closed \u2192 wontdo.",
       inputSchema: {
-        id: z.string().min(8).describe("Feature request ID (UUID or first 8 chars)"),
+        id: supportIdSchema.describe("Feature request ID (UUID or first 8 chars)"),
         status: FEATURE_STATUS.describe("New status"),
-        shipped_version: z.string().optional().describe("Version that ships this feature (e.g. '0.9.170')"),
+        shipped_version: supportVersionSchema.optional().describe("Version that ships this feature (e.g. '0.9.170')"),
         notes: z.string().optional().describe("Update notes \u2014 why this status change"),
         send_upstream: z.boolean().default(true).describe("POST update to AskExe support endpoint")
       }
     },
-    async ({ id, status, shipped_version, notes, send_upstream }) => {
+    // Structural sink guard (round 6): deep-redact the whole return object + errors.
+    async ({ id, status, shipped_version, notes, send_upstream }) => redactedToolResult(async () => {
       const { agentId, agentRole } = getActiveAgent();
       const reportDir = path.join(EXE_AI_DIR, "feature-requests");
       const reportPath = await findReportFile(reportDir, id);
       let fullId = id;
       let title = id;
+      let updatedContent = null;
       if (reportPath) {
         let content = await readFile(reportPath, "utf-8");
         const idMatch = content.match(/^id:\s*([0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12})\s*$/m);
@@ -293,45 +298,40 @@ ${shipped_version ? `Shipped version: ${shipped_version}
 ` : ""}${notes}
 `;
         }
-        await writeFile(reportPath, content, "utf-8");
-      }
-      const memoryText = shipped_version ? `Feature "${title}" marked ${status} in v${shipped_version}${notes ? `. ${notes}` : ""}` : `Feature "${title}" marked ${status}${notes ? `. ${notes}` : ""}`;
-      let vector = null;
-      try {
-        vector = await embed(memoryText);
-      } catch {
-        vector = null;
+        updatedContent = content;
       }
-      await writeMemory({
-        id: `${fullId}-update-${Date.now()}`,
-        agent_id: agentId,
-        agent_role: agentRole,
-        session_id: process.env.SESSION_ID ?? "manual",
-        timestamp: (/* @__PURE__ */ new Date()).toISOString(),
-        tool_name: "update_feature_request",
-        project_name: "support",
-        has_error: false,
-        raw_text: memoryText,
-        vector,
-        source_path: reportPath ?? void 0,
-        source_type: "feature_request_update",
-        memory_type: "observation",
-        tier: 1,
-        importance: 7,
-        intent: "update",
-        domain: "support",
-        file_paths: null
+      const memoryText = shipped_version ? `Feature "${title}" marked ${status} in v ${shipped_version}${notes ? `. ${notes}` : ""}` : `Feature "${title}" marked ${status}${notes ? `. ${notes}` : ""}`;
+      const persisted = await persistSupportArtifact({
+        memoryText,
+        file: reportPath && updatedContent !== null ? { path: reportPath, content: updatedContent, append: false } : void 0,
+        memory: {
+          id: `${fullId}-update-${Date.now()}`,
+          agent_id: agentId,
+          agent_role: agentRole,
+          session_id: process.env.SESSION_ID ?? "manual",
+          timestamp: (/* @__PURE__ */ new Date()).toISOString(),
+          tool_name: "update_feature_request",
+          project_name: "support",
+          has_error: false,
+          source_path: reportPath ?? void 0,
+          source_type: "feature_request_update",
+          memory_type: "observation",
+          tier: 1,
+          importance: 7,
+          intent: "update",
+          domain: "support",
+          file_paths: null
+        }
       });
-      await flushBatch();
       const upstreamPayload = {
-        id: fullId,
+        id: sanitizeUpstreamId(fullId),
         status,
-        shipped_version,
+        shipped_version: sanitizeVersionField(shipped_version),
         response_notes: notes,
         updated_at: (/* @__PURE__ */ new Date()).toISOString(),
         agent_id: agentId
       };
-      const upstreamStatus = send_upstream ? await sendStatusUpstream("feature", `feature-requests/${encodeURIComponent(fullId)}`, upstreamPayload) : "skipped";
+      const upstreamStatus = send_upstream ? await sendStatusUpstream("feature", `feature-requests/${encodeURIComponent(sanitizeUpstreamId(fullId))}`, upstreamPayload) : "skipped";
       return {
         content: [
           {
@@ -341,12 +341,12 @@ ID: ${fullId}
 New status: ${status}
 ${shipped_version ? `Shipped version: ${shipped_version}
 ` : ""}Local file: ${reportPath ?? "not found"}
-Memory stored: ${memoryText}
+Memory stored: ${persisted.redactedMemoryText}
 Upstream status: ${upstreamStatus}`
           }
         ]
       };
-    }
+    })
   );
 }
 export {

package/dist/{whatsapp-accounts-BWRZUY23.js → whatsapp-accounts-BFIOXYW5.js}

@@ -4,7 +4,7 @@ import {
   getAccountByPhoneNumberId,
   getDefaultAccount,
   loadAccounts
-} from "./chunk-YGAAZN3E.js";
+} from "./chunk-GL57PO3K.js";
 import "./chunk-MLKGABMK.js";
 export {
   _resetCache,

package/dist/{whatsapp-config-GOSELKTE.js → whatsapp-config-FAX6EA5K.js}

@@ -1,17 +1,32 @@
 import {
   _resetCache,
   loadAccounts
-} from "./chunk-YGAAZN3E.js";
+} from "./chunk-GL57PO3K.js";
 import "./chunk-MLKGABMK.js";
 
 // src/gateway/whatsapp-config.ts
-import { existsSync, readFileSync, writeFileSync, mkdirSync } from "fs";
+import { chmodSync, existsSync, readFileSync, writeFileSync, mkdirSync } from "fs";
 import { join } from "path";
 import { homedir } from "os";
 var GRAPH_API_VERSION = "v21.0";
 var GRAPH_API_BASE = `https://graph.facebook.com/${GRAPH_API_VERSION}`;
 var ACCOUNTS_PATH = join(homedir(), ".exe-os", "whatsapp-accounts.json");
 var GATEWAY_CONFIG_PATH = join(homedir(), ".exe-os", "gateway.json");
+function ensurePrivateConfigDir() {
+  const dir = join(homedir(), ".exe-os");
+  mkdirSync(dir, { recursive: true, mode: 448 });
+  try {
+    chmodSync(dir, 448);
+  } catch {
+  }
+}
+function writePrivateJson(filePath, value) {
+  writeFileSync(filePath, JSON.stringify(value, null, 2), { encoding: "utf8", mode: 384 });
+  try {
+    chmodSync(filePath, 384);
+  } catch {
+  }
+}
 async function validateCredentials(phoneNumberId, accessToken) {
   try {
     const url = `${GRAPH_API_BASE}/${phoneNumberId}?fields=display_phone_number,verified_name`;
@@ -58,8 +73,7 @@ async function configureWhatsApp(config) {
     businessAccountId: config.businessAccountId ?? "",
     verifyToken: config.verifyToken
   };
-  const dir = join(homedir(), ".exe-os");
-  mkdirSync(dir, { recursive: true });
+  ensurePrivateConfigDir();
   let accounts = [];
   try {
     if (existsSync(ACCOUNTS_PATH)) {
@@ -75,7 +89,7 @@ async function configureWhatsApp(config) {
   } else {
     accounts.push(account);
   }
-  writeFileSync(ACCOUNTS_PATH, JSON.stringify(accounts, null, 2), "utf8");
+  writePrivateJson(ACCOUNTS_PATH, accounts);
   let gatewayConfig = {};
   try {
     if (existsSync(GATEWAY_CONFIG_PATH)) {
@@ -87,7 +101,7 @@ async function configureWhatsApp(config) {
   if (config.webhookUrl) {
     gatewayConfig.whatsappWebhookUrl = config.webhookUrl;
   }
-  writeFileSync(GATEWAY_CONFIG_PATH, JSON.stringify(gatewayConfig, null, 2), "utf8");
+  writePrivateJson(GATEWAY_CONFIG_PATH, gatewayConfig);
   _resetCache();
   return {
     valid: true,
@@ -97,13 +111,6 @@ async function configureWhatsApp(config) {
 }
 function getWhatsAppStatus() {
   _resetCache();
-  if (!existsSync(ACCOUNTS_PATH)) {
-    return {
-      connected: false,
-      accounts: 0,
-      error: "No WhatsApp accounts configured. Use gateway(action='configure_whatsapp') to set up."
-    };
-  }
   const accounts = loadAccounts();
   if (accounts.length === 0) {
     return {

package/dist/{worker-gate-4QLLMXZM.js → worker-gate-3KUBAU32.js}

@@ -6,9 +6,9 @@ import {
   releaseBackfillLock,
   tryAcquireBackfillLock,
   tryAcquireWorkerSlot
-} from "./chunk-2IWBY7XK.js";
-import "./chunk-7Y5UDEVM.js";
-import "./chunk-SHIICYJW.js";
+} from "./chunk-VPZHJCKW.js";
+import "./chunk-WZHZCDDO.js";
+import "./chunk-BYTDMAGB.js";
 import "./chunk-MLKGABMK.js";
 export {
   MAX_CONCURRENT_WORKERS,

package/dist/{workflow-engine-MMEHKUN4.js → workflow-engine-YITHXZR5.js}

@@ -10,8 +10,8 @@ import {
   persistWorkflows,
   runWorkflow,
   startWorkflow
-} from "./chunk-DNVFWFYF.js";
-import "./chunk-IB336P52.js";
+} from "./chunk-AJYCFKJR.js";
+import "./chunk-KP3U5QGJ.js";
 import "./chunk-MLKGABMK.js";
 export {
   advanceWorkflow,

package/dist/{working-memory-PY4AG577.js → working-memory-NUVB5SFV.js}

@@ -1,6 +1,6 @@
 import {
   atomicWriteSync
-} from "./chunk-SHIICYJW.js";
+} from "./chunk-BYTDMAGB.js";
 import "./chunk-MLKGABMK.js";
 
 // src/lib/working-memory.ts

package/dist/worktree-LL62PLQB.js

@@ -0,0 +1,47 @@
+import {
+  classifyGitFailure,
+  cleanupWorktree,
+  ensureWorktree,
+  ensureWorktreeAsync,
+  getGitRoot,
+  getGitRootAsync,
+  getMainRepoRoot,
+  getMainRepoRootAsync,
+  isInsideGitRepo,
+  isWorktreeDirty,
+  isWorktreeDirtyAsync,
+  parseInstanceLabel,
+  resolveGitWithRetryAsync,
+  resolveGitWithRetrySync,
+  worktreeBranch,
+  worktreePath
+} from "./chunk-I26FWCSP.js";
+import "./chunk-2WAVZ5UJ.js";
+import "./chunk-AOHXREB7.js";
+import "./chunk-2I23RPSI.js";
+import "./chunk-OLMQ4UOF.js";
+import "./chunk-PNQDP3OA.js";
+import "./chunk-H73TUI4Y.js";
+import "./chunk-7HLWBYH7.js";
+import "./chunk-FXU7JOXK.js";
+import "./chunk-WZHZCDDO.js";
+import "./chunk-BYTDMAGB.js";
+import "./chunk-MLKGABMK.js";
+export {
+  classifyGitFailure,
+  cleanupWorktree,
+  ensureWorktree,
+  ensureWorktreeAsync,
+  getGitRoot,
+  getGitRootAsync,
+  getMainRepoRoot,
+  getMainRepoRootAsync,
+  isInsideGitRepo,
+  isWorktreeDirty,
+  isWorktreeDirtyAsync,
+  parseInstanceLabel,
+  resolveGitWithRetryAsync,
+  resolveGitWithRetrySync,
+  worktreeBranch,
+  worktreePath
+};

package/dist/{worktree-sweep-5WKBU7E6.js → worktree-sweep-WTK3MTKH.js}

@@ -2,18 +2,18 @@ import {
   cleanupAgentWorktree,
   discoverRepoPaths,
   sweepWorktrees
-} from "./chunk-PTJBWC77.js";
-import "./chunk-BJOBR6P2.js";
-import "./chunk-WH7XN5ER.js";
-import "./chunk-RWSLVYTE.js";
+} from "./chunk-2ZYO73KO.js";
+import "./chunk-I26FWCSP.js";
+import "./chunk-2WAVZ5UJ.js";
+import "./chunk-AOHXREB7.js";
 import "./chunk-2I23RPSI.js";
-import "./chunk-BV6GBSRP.js";
+import "./chunk-OLMQ4UOF.js";
 import "./chunk-PNQDP3OA.js";
 import "./chunk-H73TUI4Y.js";
 import "./chunk-7HLWBYH7.js";
 import "./chunk-FXU7JOXK.js";
-import "./chunk-7Y5UDEVM.js";
-import "./chunk-SHIICYJW.js";
+import "./chunk-WZHZCDDO.js";
+import "./chunk-BYTDMAGB.js";
 import "./chunk-MLKGABMK.js";
 export {
   cleanupAgentWorktree,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@askexenow/exe-os",
-  "version": "0.9.341",
+  "version": "0.9.342",
   "description": "AI employee operating system — persistent memory, task management, and multi-agent coordination for Claude Code.",
   "license": "SEE LICENSE IN LICENSE",
   "type": "module",
@@ -40,6 +40,7 @@
     "exe-pending-reviews": "./dist/bin/exe-pending-reviews.js",
     "exe-os-orchestration-metrics": "./dist/bin/orchestration-metrics.js",
     "exe-search-quality": "./dist/bin/exe-search-quality.js",
+    "exe-memory-reads": "./dist/bin/exe-memory-reads.js",
     "exe-healthcheck": "./dist/bin/exe-healthcheck.js",
     "exe-doctor": "./dist/bin/exe-doctor.js",
     "exe-timers": "./dist/bin/exe-timers.js",
@@ -115,7 +116,7 @@
     "deploy": "node dist/bin/pre-build-guard.js && npm run build && (node dist/bin/prune-orphan-chunks.js || true) && npm install -g . && node dist/bin/install.js --global && echo '[exe-os] Deploy complete. Run /mcp in active sessions to reconnect.'",
     "postinstall": "node dist/bin/install.js --commands-only || true",
     "prepublishOnly": "npm run typecheck && npm run build && node dist/bin/prune-orphan-chunks.js --force && npm run guard:esm-require && npm run check:schema-version && node dist/bin/customer-readiness.js && node dist/bin/pre-publish.js",
-    "test:publish": "npx vitest run --maxWorkers=4 --exclude 'tests/tui/**' --exclude 'tests/lib/tmux-routing.test.ts' --exclude 'tests/lib/intercom-routing.test.ts' --exclude 'tests/gateway/**' --exclude 'tests/mcp/ingest-document.test.ts' --exclude 'tests/lib/hybrid-search.test.ts' --exclude 'tests/lib/worker-gate.test.ts' --exclude 'tests/daemon-perf-stress.test.ts' --exclude 'tests/lib/gateway-client.test.ts' --exclude 'tests/lib/ws-client.test.ts' --exclude 'tests/lib/ws-auth.test.ts' --exclude 'tests/integration/clean-stack-projection.test.ts' --exclude 'tests/lib/stack-update.test.ts' --exclude 'tests/orchestration/dispatch-chain.test.ts' --exclude 'tests/orchestration/e2e-flow.test.ts' && echo '::warning::clean-stack-projection and stack-update quarantined (need Docker + live DB; environmental, fail in CI runner \u2014 container unhealthy / DB not initialized); ws-client/ws-auth quarantined (30-120s timeouts flaky on Node 20 CI runner \u2014 passes locally). Quarantined to match build-and-test (required gate): dispatch-chain/e2e-flow (timing-sensitive, flaky under parallel load \u2014 bug dfb25bf1). device-id-split-brain/reaper-deps-async/find-free-instance/db-backup-recovery de-flaked and promoted to the required gate (chore/deflake-required-ci). See cicd-audit-2026-06-18.md.' && npx vitest run --maxWorkers=1 tests/daemon-perf-stress.test.ts tests/lib/gateway-client.test.ts",
+    "test:publish": "npx vitest run --maxWorkers=4 --exclude 'tests/tui/**' --exclude 'tests/lib/tmux-routing.test.ts' --exclude 'tests/lib/intercom-routing.test.ts' --exclude 'tests/gateway/**' --exclude 'tests/mcp/ingest-document.test.ts' --exclude 'tests/lib/hybrid-search.test.ts' --exclude 'tests/lib/worker-gate.test.ts' --exclude 'tests/daemon-perf-stress.test.ts' --exclude 'tests/lib/gateway-client.test.ts' --exclude 'tests/lib/ws-client.test.ts' --exclude 'tests/lib/ws-auth.test.ts' --exclude 'tests/integration/clean-stack-projection.test.ts' --exclude 'tests/orchestration/dispatch-chain.test.ts' --exclude 'tests/orchestration/e2e-flow.test.ts' && echo '::warning::clean-stack-projection and stack-update quarantined (need Docker + live DB; environmental, fail in CI runner — container unhealthy / DB not initialized); ws-client/ws-auth quarantined (30-120s timeouts flaky on Node 20 CI runner — passes locally). Quarantined to match build-and-test (required gate): dispatch-chain/e2e-flow (timing-sensitive, flaky under parallel load — bug dfb25bf1). device-id-split-brain/reaper-deps-async/find-free-instance/db-backup-recovery de-flaked and promoted to the required gate (chore/deflake-required-ci). See cicd-audit-2026-06-18.md.' && npx vitest run --maxWorkers=1 tests/daemon-perf-stress.test.ts tests/lib/gateway-client.test.ts",
     "benchmark:longmemeval": "npx tsx tests/benchmarks/longmemeval.ts",
     "guard:esm-require": "node scripts/check-no-runtime-require.mjs",
     "check:schema-version": "node scripts/check-schema-version.mjs",