@askexenow/exe-os 0.9.357 → 0.9.359

package/dist/{chunk-P7EUKYSQ.js → chunk-6WHYSLGF.js}

@@ -1,6 +1,6 @@
 import {
   getClient
-} from "./chunk-M5DPPJLS.js";
+} from "./chunk-EA5FVACM.js";
 
 // src/lib/skill-refinement.ts
 import crypto from "crypto";

package/dist/{chunk-YSUHXDQU.js → chunk-74R44E4S.js}

@@ -1,6 +1,6 @@
 import {
   ensureAgentSymlink
-} from "./chunk-X7CWCQ5S.js";
+} from "./chunk-CAEWPEBA.js";
 import {
   ensureWorktree,
   ensureWorktreeAsync,
@@ -8,10 +8,14 @@ import {
   getMainRepoRoot,
   isInsideGitRepo,
   isWorktreeDirty
-} from "./chunk-TQ4O5A4S.js";
+} from "./chunk-XV42EAVK.js";
 import {
   incrementSkillSuccess
-} from "./chunk-P7EUKYSQ.js";
+} from "./chunk-6WHYSLGF.js";
+import {
+  reviewSignalPath,
+  taskSignalDir
+} from "./chunk-EIKATSE4.js";
 import {
   LEASE_MINUTES,
   isLeaseExpired,
@@ -21,14 +25,10 @@ import {
   buildTaskResult,
   serializeMessage
 } from "./chunk-4JERP7NT.js";
-import {
-  reviewSignalPath,
-  taskSignalDir
-} from "./chunk-EIKATSE4.js";
 import {
   listSessions,
   registerSession
-} from "./chunk-PM4TIRCR.js";
+} from "./chunk-3ODATKWH.js";
 import {
   getTransport
 } from "./chunk-UXLO7VHX.js";
@@ -37,7 +37,7 @@ import {
 } from "./chunk-SKGMF2SO.js";
 import {
   recordOrchestrationEventBestEffort
-} from "./chunk-X4EDW3FH.js";
+} from "./chunk-POZGQQEZ.js";
 import {
   appendDispatchJournalEvent,
   releaseDispatchClaim,
@@ -53,7 +53,7 @@ import {
 import {
   PlanLimitError,
   assertEmployeeLimitSync
-} from "./chunk-4GGP4Q5N.js";
+} from "./chunk-F3QTF4T7.js";
 import {
   BUSY_PATTERN
 } from "./chunk-OSKWCKUC.js";
@@ -89,13 +89,13 @@ import {
   loadEmployeesSync,
   offloadReadIfMain,
   offloadReadQuery
-} from "./chunk-M5DPPJLS.js";
+} from "./chunk-EA5FVACM.js";
 import {
   RUNTIME_TABLE
 } from "./chunk-WNBZJSQT.js";
 import {
   loadDeviceId
-} from "./chunk-4VU2VCEU.js";
+} from "./chunk-2OVTGZYH.js";
 import {
   EXE_AI_DIR
 } from "./chunk-BCZF3AGJ.js";
@@ -414,6 +414,8 @@ function eventIcon(event) {
       return "Task group:";
     case "capacity_relaunch":
       return "Relaunched:";
+    case "spend_cap_alert":
+      return "Spend cap:";
   }
 }
 function formatTimeAgo(timestamp) {
@@ -1513,7 +1515,7 @@ async function createTaskCore(input) {
         if (isCoordinatorSession) {
           earlySessionScope = resolved;
         } else {
-          const { getSessionProject } = await import("./session-scope-LIJ746K2.js");
+          const { getSessionProject } = await import("./session-scope-2ADEVY3C.js");
           const sessionProject = getSessionProject(resolved);
           if (sessionProject && sessionProject !== input.projectName) {
             scopeMismatchWarning = `session/project mismatch: session "${resolved}" owns "${sessionProject}" but task targets "${input.projectName}". Routed to default scope.`;
@@ -1810,7 +1812,7 @@ async function buildTaskRowsStatement(opts) {
   }
   if (opts.founderId !== null) {
     try {
-      const { founderScopeFilter } = await import("./founder-context-5OFTZNDO.js");
+      const { founderScopeFilter } = await import("./founder-context-C7X7IRDA.js");
       const founderFilter = founderScopeFilter(opts.founderId);
       const cleaned = founderFilter.sql.replace(/^\s*AND\s+/, "");
       conditions.push(cleaned);
@@ -5142,7 +5144,7 @@ async function verifyPaneAtCapacity(sessionName) {
       reason: `capture-pane failed: ${err instanceof Error ? err.message : String(err)}`
     };
   }
-  const { isAtCapacity } = await import("./capacity-monitor-5XUR3JTN.js");
+  const { isAtCapacity } = await import("./capacity-monitor-QLPEL6S5.js");
   if (!isAtCapacity(pane)) {
     return {
       atCapacity: false,
@@ -5376,7 +5378,7 @@ async function countScopedPendingReviews(targetSession, reviewer) {
 }
 async function countScopedOpenTasks(targetSession, agentId) {
   try {
-    const { fastDbInit } = await import("./fast-db-init-B5Q3SJQG.js");
+    const { fastDbInit } = await import("./fast-db-init-6H67K76Q.js");
     const client = await fastDbInit();
     const scope = extractRootExe(targetSession);
     if (!scope) return 0;
@@ -5431,7 +5433,7 @@ function buildScopedInProgressTaskQuery(targetSession) {
 async function findScopedInProgressTaskId(targetSession) {
   const q = buildScopedInProgressTaskQuery(targetSession);
   if (!q) return null;
-  const { fastDbInit } = await import("./fast-db-init-B5Q3SJQG.js");
+  const { fastDbInit } = await import("./fast-db-init-6H67K76Q.js");
   const client = await fastDbInit();
   const result = await client.execute(q);
   const id = result.rows[0]?.id;
@@ -5551,7 +5553,7 @@ function sendIntercom(targetSession, opts) {
   }
   if ((process.env.EXE_NOTIFICATION_LEDGER ?? "").trim().toLowerCase() === "shadow") {
     const shadowScope = opts && "callerSessionScope" in opts ? opts.callerSessionScope : void 0;
-    void import("./notification-ledger-GL3ZPZNR.js").then((m) => m.recordShadowNudge(targetSession, reason, shadowScope)).catch(() => {
+    void import("./notification-ledger-NZ4HO3M5.js").then((m) => m.recordShadowNudge(targetSession, reason, shadowScope)).catch(() => {
     });
   }
   if (!opts?.force && isDebounced(targetSession)) {
@@ -5687,7 +5689,7 @@ function scheduleDeferredSpawnNudge(input) {
           return;
         }
         queueIntercom(input.sessionName, `spawn nudge failed after ${attempt} attempts: ${msg}`, "signal");
-        void import("./notifications-FGYNO2FY.js").then(({ writeNotification: writeNotification2 }) => writeNotification2({
+        void import("./notifications-74YECZ4V.js").then(({ writeNotification: writeNotification2 }) => writeNotification2({
           agentId: getCoordinatorName(),
           agentRole: "COO",
           event: "error_spike",

package/dist/{chunk-DF5K4JJL.js → chunk-A5WEEND7.js}

@@ -1,6 +1,6 @@
 import {
   routeTask
-} from "./chunk-Y4JA5V22.js";
+} from "./chunk-46RPEWTH.js";
 import {
   createTaskCore,
   employeeSessionName,
@@ -9,11 +9,11 @@ import {
   isEmployeeAlive,
   sessionScopeFilter,
   updateTaskStatus
-} from "./chunk-YSUHXDQU.js";
+} from "./chunk-74R44E4S.js";
 import {
   DEFAULT_COORDINATOR_TEMPLATE_NAME,
   getCoordinatorName
-} from "./chunk-M5DPPJLS.js";
+} from "./chunk-EA5FVACM.js";
 
 // src/runtime/orchestrator.ts
 var STALE_THRESHOLD_MS = 2 * 60 * 60 * 1e3;

package/dist/{chunk-OBWTTM7E.js → chunk-AL7JMA54.js}

@@ -1,11 +1,11 @@
 import {
   ingest
-} from "./chunk-72GUU6Z4.js";
+} from "./chunk-NKDKB2RT.js";
 import {
   listWorkflowDefinitions,
   runWorkflow,
   startWorkflow
-} from "./chunk-H4ZSOAP6.js";
+} from "./chunk-44WFVMZ5.js";
 import {
   initCRMBridge
 } from "./chunk-ML4S5SHZ.js";

package/dist/{chunk-JZXHLDQN.js → chunk-APR556TY.js}

@@ -1,6 +1,6 @@
 import {
   loadLicense
-} from "./chunk-4VU2VCEU.js";
+} from "./chunk-2OVTGZYH.js";
 
 // src/lib/stack-update.ts
 import { execFileSync, spawnSync } from "child_process";

package/dist/{chunk-G2MXTLOD.js → chunk-C5YZMYQH.js}

@@ -2,7 +2,7 @@ import {
   decryptSyncBlob,
   encryptSyncBlob,
   isSyncCryptoInitialized
-} from "./chunk-S3THSOWV.js";
+} from "./chunk-EUQF3JOH.js";
 
 // src/lib/crdt-sync.ts
 import * as Y from "yjs";

package/dist/{chunk-X7CWCQ5S.js → chunk-CAEWPEBA.js}

@@ -1,6 +1,6 @@
 import {
   loadEmployees
-} from "./chunk-M5DPPJLS.js";
+} from "./chunk-EA5FVACM.js";
 
 // src/lib/agent-symlinks.ts
 import os from "os";

package/dist/{chunk-SFSB64NK.js → chunk-DKRSKC5R.js}

@@ -3,7 +3,7 @@ import {
 } from "./chunk-WCGNCH3Q.js";
 import {
   registerAllTools
-} from "./chunk-AW3WT3TJ.js";
+} from "./chunk-GD7VXXW6.js";
 
 // src/mcp/mcp-surface-hash.ts
 function computeMcpSurfaceHash() {

package/dist/{chunk-IIHFSNL4.js → chunk-DQ75MEPU.js}

@@ -1,6 +1,6 @@
 import {
   processCRMEvent
-} from "./chunk-GVU3BW6N.js";
+} from "./chunk-COHHVCFA.js";
 
 // src/gateway/adapters/crm-webhook.ts
 function parseTwentyWebhook(payload) {

package/dist/{chunk-H4IZKSOY.js → chunk-DWKH2H7W.js}

@@ -1,6 +1,6 @@
 import {
   getClient
-} from "./chunk-M5DPPJLS.js";
+} from "./chunk-EA5FVACM.js";
 
 // src/lib/token-budget.ts
 var WARN_THRESHOLD = 0.8;

package/dist/{chunk-M5DPPJLS.js → chunk-EA5FVACM.js}

@@ -1,22 +1,26 @@
 import {
   assertValidDbPath
 } from "./chunk-2I23RPSI.js";
+import {
+  recordDbOpen
+} from "./chunk-5YEUPUV4.js";
 import {
   listBackups
-} from "./chunk-LLXYWNCH.js";
+} from "./chunk-Z2PAVJJ4.js";
 import {
   getEmotionalBaseline,
   renderEmotionalBaselineSection
 } from "./chunk-OMXJMOBD.js";
-import {
-  isDaemonAlive
-} from "./chunk-7HLWBYH7.js";
 import {
   logDaemonHealth
 } from "./chunk-BBMTVAE3.js";
 import {
   isPostgresBackendEnabled
 } from "./chunk-YMUZWC33.js";
+import {
+  directWriterAllowed,
+  isDaemonAlive
+} from "./chunk-V3W3SATA.js";
 import {
   EMBEDDING_DIM
 } from "./chunk-FXU7JOXK.js";
@@ -1329,7 +1333,7 @@ async function migrateReflectionDedup(client) {
     "ALTER TABLE memory_reflections ADD COLUMN dedup_key TEXT",
     "migration add memory_reflections.dedup_key"
   );
-  const { reflectionDedupKey } = await import("./memory-reflection-Q4OT4V55.js");
+  const { reflectionDedupKey } = await import("./memory-reflection-EQC4FXSW.js");
   const keyForRow = (row) => {
     let sources = [];
     try {
@@ -1751,6 +1755,7 @@ async function _attemptBackupRestore(config) {
         opts.encryptionKey = config.encryptionKey;
       }
       const testClient = createClient(opts);
+      recordDbOpen({ dbPath: config.dbPath, source: "auto-restore-verify", writeCapable: true, checkpointTimer: false });
       await testClient.execute("PRAGMA busy_timeout = 30000");
       await testClient.execute("PRAGMA journal_mode = WAL");
       const isCorrupt = await _checkDbIntegrity(testClient);
@@ -1914,6 +1919,11 @@ async function initDatabase(config) {
     cleanupLegacyPlaintextStubs(dirname(config.dbPath), config.dbPath);
   } catch {
   }
+  if (process.env.EXE_BACKGROUND_CLOUD_SYNC === "1" && !isPostgresBackendEnabled() && !await directWriterAllowed()) {
+    throw new Error(
+      "Background cloud-sync child refused a direct SQLite WRITER open: the daemon is alive and owns the single writer connection. Cloud-sync writes must route through the daemon socket (fastDbInit); a direct open would be an unsanctioned second writer (bug 4a6f8aaf). This is safe to retry once the daemon socket is reachable."
+    );
+  }
   await acquireDbLock();
   if (existsSync4(config.dbPath)) {
     const dbStat = statSync(config.dbPath);
@@ -1976,6 +1986,15 @@ async function initDatabase(config) {
     opts.encryptionKey = config.encryptionKey;
   }
   _client = createClient(opts);
+  recordDbOpen({
+    dbPath: config.dbPath,
+    source: config.telemetrySource ?? "initDatabase",
+    writeCapable: config.telemetryWriteCapable ?? process.env.EXE_DB_READONLY !== "1",
+    // Must mirror the ACTUAL timer gate below (bug df26c896: daemon-only by
+    // default) — a telemetry flag that disagrees with the real decision would
+    // poison the regression tripwire.
+    checkpointTimer: config.telemetryCheckpointTimer ?? ((process.env.EXE_IS_DAEMON === "1" || process.env.EXE_DB_CHECKPOINT_TIMER === "1") && process.env.EXE_DB_NO_CHECKPOINT_TIMER !== "1")
+  });
   _resilientClient = wrapWithRetry(_client);
   _adapterClient = _resilientClient;
   await _client.execute("PRAGMA busy_timeout = 30000");
@@ -2033,7 +2052,8 @@ async function initDatabase(config) {
     }
   }
   if (_walCheckpointTimer) clearInterval(_walCheckpointTimer);
-  if (process.env.EXE_DB_NO_CHECKPOINT_TIMER !== "1") {
+  const checkpointTimerAllowed = process.env.EXE_IS_DAEMON === "1" || process.env.EXE_DB_CHECKPOINT_TIMER === "1";
+  if (checkpointTimerAllowed && process.env.EXE_DB_NO_CHECKPOINT_TIMER !== "1") {
     _walCheckpointTimer = setInterval(() => {
       void runWalCheckpoint(_client, config.dbPath, false).catch(() => {
       });
@@ -2061,6 +2081,9 @@ async function initDatabase(config) {
   }
   releaseDbLock();
 }
+function _isWalCheckpointTimerActive() {
+  return _walCheckpointTimer !== null;
+}
 function isInitialized() {
   return _adapterClient !== null || _client !== null;
 }
@@ -2109,7 +2132,7 @@ async function sweepExpiredSoftDeletedMemories(client, options = {}) {
   const purgeArchived = archDays !== void 0;
   const BATCH_SIZE = 2e3;
   const MAX_BATCHES = 500;
-  const { cleanupCardsForMemories, cleanupGraphLinksForMemories } = await import("./graph-rag-HCQCZ2W7.js");
+  const { cleanupCardsForMemories, cleanupGraphLinksForMemories } = await import("./graph-rag-5FVC5JXH.js");
   const softCutoff = `-${softDays} days`;
   const selectArgsBase = [softCutoff];
   let predicate = `status = 'deleted' AND COALESCE(deleted_at, timestamp) < datetime('now', ?)`;
@@ -2178,9 +2201,13 @@ function getClient() {
     } catch {
     }
     if (daemonAlive) {
+      if (_daemonClient) {
+        return _daemonClient;
+      }
       process.stderr.write(
         "[database] INFO: daemon running \u2014 CLI taking direct SQLite access (single-writer CLI mode).\n"
       );
+      return _resilientClient;
     } else {
       process.stderr.write(
         "[database] WARN: daemon unavailable \u2014 using direct SQLite (single-writer CLI mode).\n"
@@ -2224,6 +2251,9 @@ async function initDaemonClient() {
     );
   }
 }
+function isDaemonRoutingActive() {
+  return _daemonClient !== null && _daemonClient._isDaemonActive();
+}
 function getRawClient() {
   if (!_client) {
     throw new Error("Database client not initialized. Call initDatabase() first.");
@@ -4259,6 +4289,7 @@ export {
   optimizeFtsIndexes,
   initTurso,
   initDatabase,
+  _isWalCheckpointTimerActive,
   isInitialized,
   setExternalClient,
   initPostgresOnlyDatabase,
@@ -4270,6 +4301,7 @@ export {
   getClient,
   getCurrentDatabaseConfig,
   initDaemonClient,
+  isDaemonRoutingActive,
   getRawClient,
   tryGetRawClient,
   _getMigrationBlockRuns,

package/dist/{chunk-S3THSOWV.js → chunk-EUQF3JOH.js}

@@ -1,116 +1,44 @@
 import {
-  deriveEnvelopeWrapKeyForRecipient,
+  ALGORITHM,
+  CURRENT_KEY_ID,
+  DEK_LENGTH,
+  ENVELOPE_BLOB_VERSION,
+  IV_LENGTH,
+  PK_HASH_LENGTH,
+  RECIPIENT_SYMMETRIC,
+  RECIPIENT_X25519,
+  SYM_RECIPIENT_LENGTH,
+  SYNC_BLOB_VERSION,
+  TAG_LENGTH,
+  VERSIONED_HEADER_LENGTH,
+  X25519_PUB_LENGTH,
+  X25519_RECIPIENT_LENGTH,
+  initSyncKey,
+  isSyncKeyInitialized,
+  requireSyncKey,
+  unwrapDek,
+  v2PayloadAad
+} from "./chunk-TWMWHDOY.js";
+import {
   getCachedMonitorIdentity,
-  pubKeyHash,
   recomputeEnvelopeWrapKey
 } from "./chunk-IOEUAQWP.js";
 
 // src/lib/crypto.ts
 import crypto from "crypto";
-var ALGORITHM = "aes-256-gcm";
-var IV_LENGTH = 12;
-var TAG_LENGTH = 16;
-var SYNC_HKDF_INFO = "exe-mem-sync-v2";
-var SYNC_BLOB_VERSION = 1;
-var CURRENT_KEY_ID = 0;
-var VERSIONED_HEADER_LENGTH = 2;
-var ENVELOPE_BLOB_VERSION = 2;
-var RECIPIENT_SYMMETRIC = 0;
-var RECIPIENT_X25519 = 1;
-var DEK_LENGTH = 32;
-var PK_HASH_LENGTH = 8;
-var X25519_PUB_LENGTH = 32;
-var SYM_RECIPIENT_LENGTH = 1 + IV_LENGTH + DEK_LENGTH + TAG_LENGTH;
-var X25519_RECIPIENT_LENGTH = 1 + PK_HASH_LENGTH + X25519_PUB_LENGTH + IV_LENGTH + DEK_LENGTH + TAG_LENGTH;
-var _syncKey = null;
 function initSyncCrypto(masterKey) {
-  if (masterKey.length !== 32) {
-    throw new Error(`Master key must be 32 bytes, got ${masterKey.length}`);
-  }
-  _syncKey = Buffer.from(
-    crypto.hkdfSync("sha256", masterKey, "", SYNC_HKDF_INFO, 32)
-  );
+  initSyncKey(masterKey);
 }
 function isSyncCryptoInitialized() {
-  return _syncKey !== null;
+  return isSyncKeyInitialized();
 }
-function requireSyncKey() {
-  if (!_syncKey) {
-    throw new Error("Sync crypto not initialized. Call initSyncCrypto(masterKey) first.");
-  }
-  return _syncKey;
-}
-function encryptSyncBlob(data, recipientPubKeys) {
+function encryptSyncBlob(data) {
   const key = requireSyncKey();
-  if (!recipientPubKeys || recipientPubKeys.length === 0) {
-    const iv = crypto.randomBytes(IV_LENGTH);
-    const cipher = crypto.createCipheriv(ALGORITHM, key, iv);
-    const encrypted = Buffer.concat([cipher.update(data), cipher.final()]);
-    const tag = cipher.getAuthTag();
-    return Buffer.concat([Buffer.from([SYNC_BLOB_VERSION, CURRENT_KEY_ID]), iv, encrypted, tag]).toString("base64");
-  }
-  return encryptEnvelope(data, key, recipientPubKeys).toString("base64");
-}
-function wrapDek(dek, wrapKey, aad) {
   const iv = crypto.randomBytes(IV_LENGTH);
-  const cipher = crypto.createCipheriv(ALGORITHM, wrapKey, iv);
-  cipher.setAAD(aad);
-  const wrapped = Buffer.concat([cipher.update(dek), cipher.final()]);
+  const cipher = crypto.createCipheriv(ALGORITHM, key, iv);
+  const encrypted = Buffer.concat([cipher.update(data), cipher.final()]);
   const tag = cipher.getAuthTag();
-  return Buffer.concat([iv, wrapped, tag]);
-}
-function unwrapDek(iv, wrapped, tag, wrapKey, aad) {
-  const decipher = crypto.createDecipheriv(ALGORITHM, wrapKey, iv);
-  decipher.setAAD(aad);
-  decipher.setAuthTag(tag);
-  return Buffer.concat([decipher.update(wrapped), decipher.final()]);
-}
-function buildPayloadAad(keyId, recipientCount, recipientBytes) {
-  const digest = crypto.createHash("sha256").update(recipientBytes).digest();
-  return Buffer.concat([Buffer.from([ENVELOPE_BLOB_VERSION, keyId, recipientCount]), digest]);
-}
-function encryptEnvelope(data, syncKey, recipientPubKeys) {
-  const dek = crypto.randomBytes(DEK_LENGTH);
-  const recipients = [];
-  {
-    const sym = wrapDek(dek, syncKey, Buffer.from([RECIPIENT_SYMMETRIC]));
-    recipients.push(Buffer.concat([Buffer.from([RECIPIENT_SYMMETRIC]), sym]));
-  }
-  for (const recipientPub of recipientPubKeys) {
-    if (recipientPub.length !== X25519_PUB_LENGTH) {
-      process.stderr.write(`[exe-os] \u26A0 skipping monitoring recipient with bad length ${recipientPub.length}
-`);
-      continue;
-    }
-    try {
-      const hash = pubKeyHash(recipientPub);
-      const { ephemeralPublicKey, wrapKey } = deriveEnvelopeWrapKeyForRecipient(recipientPub);
-      const aad = Buffer.concat([Buffer.from([RECIPIENT_X25519]), hash]);
-      const wrapped = wrapDek(dek, wrapKey, aad);
-      recipients.push(Buffer.concat([Buffer.from([RECIPIENT_X25519]), hash, ephemeralPublicKey, wrapped]));
-    } catch (err) {
-      process.stderr.write(
-        `[exe-os] \u26A0 skipping unusable monitoring recipient (${pubKeyHash(recipientPub).toString("hex")}): ${err instanceof Error ? err.message : String(err)}
-`
-      );
-    }
-  }
-  if (recipients.length > 255) {
-    throw new Error(`Too many envelope recipients: ${recipients.length} (max 255)`);
-  }
-  const recipientBytes = Buffer.concat(recipients);
-  const payloadIv = crypto.randomBytes(IV_LENGTH);
-  const payloadCipher = crypto.createCipheriv(ALGORITHM, dek, payloadIv);
-  payloadCipher.setAAD(buildPayloadAad(CURRENT_KEY_ID, recipients.length, recipientBytes));
-  const payloadCt = Buffer.concat([payloadCipher.update(data), payloadCipher.final()]);
-  const payloadTag = payloadCipher.getAuthTag();
-  return Buffer.concat([
-    Buffer.from([ENVELOPE_BLOB_VERSION, CURRENT_KEY_ID, recipients.length]),
-    recipientBytes,
-    payloadIv,
-    payloadTag,
-    payloadCt
-  ]);
+  return Buffer.concat([Buffer.from([SYNC_BLOB_VERSION, CURRENT_KEY_ID]), iv, encrypted, tag]).toString("base64");
 }
 function parseEnvelope(combined) {
   if (combined.length < 3 || combined[0] !== ENVELOPE_BLOB_VERSION) {
@@ -173,7 +101,7 @@ function parseEnvelope(combined) {
 }
 function decryptEnvelopePayload(env, dek) {
   const decipher = crypto.createDecipheriv(ALGORITHM, dek, env.payloadIv);
-  decipher.setAAD(buildPayloadAad(env.keyId, env.recipientCount, env.recipientBytes));
+  decipher.setAAD(v2PayloadAad(env.keyId, env.recipientCount, env.recipientBytes));
   decipher.setAuthTag(env.payloadTag);
   return Buffer.concat([decipher.update(env.payloadCt), decipher.final()]);
 }

package/dist/{chunk-2LM5GO5R.js → chunk-EX2SSLNU.js}

@@ -1,9 +1,9 @@
 import {
   MultiAgentOrchestrator
-} from "./chunk-DF5K4JJL.js";
+} from "./chunk-A5WEEND7.js";
 import {
   createTokenBudgetMiddleware
-} from "./chunk-H4IZKSOY.js";
+} from "./chunk-DWKH2H7W.js";
 import {
   createQuietRenderer,
   createTerminalRenderer,
@@ -209,7 +209,7 @@ function createExeOSHooks(config) {
         );
       }
       try {
-        const { listBehaviors } = await import("./behaviors-6GW5AFG4.js");
+        const { listBehaviors } = await import("./behaviors-57AMN5IP.js");
         const behaviors = await listBehaviors(config.agentId, config.projectName, 12);
         if (behaviors.length > 0) {
           process.stderr.write(
@@ -330,7 +330,7 @@ function createExeOSHooks(config) {
     async onSubagentStop(_reason) {
       try {
         const { getClient } = await import("./lib/database.js");
-        const { sessionScopeFilter } = await import("./task-scope-74ZIFQRH.js");
+        const { sessionScopeFilter } = await import("./task-scope-44N7XP5N.js");
         const client = getClient();
         const ehScope = sessionScopeFilter();
         const tasks = await client.execute({
@@ -422,7 +422,7 @@ function createExeOSHooks(config) {
         try {
           const { writeMemory, flushBatch } = await import("./lib/store.js");
           const { getClient } = await import("./lib/database.js");
-          const { sessionScopeFilter: cpScopeFilter } = await import("./task-scope-74ZIFQRH.js");
+          const { sessionScopeFilter: cpScopeFilter } = await import("./task-scope-44N7XP5N.js");
           const client = getClient();
           const cpScope = cpScopeFilter();
           const tasks = await client.execute({

package/dist/{chunk-4GGP4Q5N.js → chunk-F3QTF4T7.js}

@@ -3,12 +3,12 @@ import {
   getClient,
   isInitialized,
   loadEmployees
-} from "./chunk-M5DPPJLS.js";
+} from "./chunk-EA5FVACM.js";
 import {
   PLAN_LIMITS,
   checkLicense,
   isFeatureAllowed
-} from "./chunk-4VU2VCEU.js";
+} from "./chunk-2OVTGZYH.js";
 import {
   EXE_AI_DIR
 } from "./chunk-BCZF3AGJ.js";

package/dist/{chunk-EQQYCP6D.js → chunk-FASR2WLT.js}

@@ -1,6 +1,6 @@
 import {
   sessionScopeFilter
-} from "./chunk-YSUHXDQU.js";
+} from "./chunk-74R44E4S.js";
 import {
   leaseExpiryIso
 } from "./chunk-E23LNUWJ.js";

package/dist/{chunk-NT4GET5B.js → chunk-G2KK64UB.js}

@@ -1,10 +1,10 @@
 import {
   sendIntercom,
   updateTaskStatus
-} from "./chunk-YSUHXDQU.js";
+} from "./chunk-74R44E4S.js";
 import {
   recordOrchestrationEventBestEffort
-} from "./chunk-X4EDW3FH.js";
+} from "./chunk-POZGQQEZ.js";
 import {
   BUSY_PATTERN
 } from "./chunk-OSKWCKUC.js";
@@ -12,7 +12,7 @@ import {
   baseAgentName,
   getCoordinatorName,
   isCoordinatorName
-} from "./chunk-M5DPPJLS.js";
+} from "./chunk-EA5FVACM.js";
 
 // src/lib/play-mode.ts
 import { readFileSync, writeFileSync, mkdirSync, existsSync } from "fs";
@@ -305,7 +305,7 @@ async function surfaceStaleDispatchPendingSignals(scopeList, now, thresholdMs =
     const sessionScope = signalScope ?? (scopeList.length === 1 ? scopeList[0] : null);
     if (allowedScopes.size > 0 && sessionScope && !allowedScopes.has(sessionScope)) continue;
     try {
-      const { writeNotification } = await import("./notifications-FGYNO2FY.js");
+      const { writeNotification } = await import("./notifications-74YECZ4V.js");
       await writeNotification({
         agentId: getCoordinatorName(),
         agentRole: "COO",

package/dist/{chunk-ABM3DZF3.js → chunk-G37RG543.js}

@@ -2,7 +2,7 @@ import {
   getGitRoot,
   isWorktreeDirty,
   isWorktreeDirtyAsync
-} from "./chunk-TQ4O5A4S.js";
+} from "./chunk-XV42EAVK.js";
 
 // src/lib/worktree-sweep.ts
 import { execFile } from "child_process";