@askexenow/exe-os 0.9.357 → 0.9.359

package/dist/tui/App.js

@@ -1,27 +1,27 @@
 #!/usr/bin/env node
 import {
   getSessionPrompt
-} from "../chunk-P2Y6S53G.js";
-import "../chunk-KP3PLOGC.js";
-import "../chunk-2TL5RKMC.js";
+} from "../chunk-R6LNQAUG.js";
+import "../chunk-NP2Y7P3I.js";
+import "../chunk-3BAGFZFN.js";
 import {
   sessionScopeFilter
-} from "../chunk-YSUHXDQU.js";
-import "../chunk-X7CWCQ5S.js";
-import "../chunk-TQ4O5A4S.js";
-import "../chunk-P7EUKYSQ.js";
+} from "../chunk-74R44E4S.js";
+import "../chunk-CAEWPEBA.js";
+import "../chunk-XV42EAVK.js";
+import "../chunk-6WHYSLGF.js";
+import "../chunk-EIKATSE4.js";
 import "../chunk-E23LNUWJ.js";
 import "../chunk-4JERP7NT.js";
-import "../chunk-EIKATSE4.js";
-import "../chunk-PM4TIRCR.js";
+import "../chunk-3ODATKWH.js";
 import "../chunk-UXLO7VHX.js";
 import "../chunk-DSOQUQTV.js";
 import "../chunk-SKGMF2SO.js";
-import "../chunk-X4EDW3FH.js";
+import "../chunk-POZGQQEZ.js";
 import "../chunk-AJIXH5JF.js";
 import "../chunk-VAY6IXWY.js";
 import "../chunk-AM7S2TY6.js";
-import "../chunk-4GGP4Q5N.js";
+import "../chunk-F3QTF4T7.js";
 import "../chunk-OSKWCKUC.js";
 import "../chunk-KI5PFRG6.js";
 import "../chunk-CVYC6DUW.js";
@@ -40,17 +40,19 @@ import {
 import {
   DEFAULT_COORDINATOR_TEMPLATE_NAME,
   isCoordinatorName
-} from "../chunk-M5DPPJLS.js";
+} from "../chunk-EA5FVACM.js";
 import "../chunk-2I23RPSI.js";
-import "../chunk-LLXYWNCH.js";
+import "../chunk-5YEUPUV4.js";
+import "../chunk-Z2PAVJJ4.js";
 import "../chunk-OMXJMOBD.js";
-import "../chunk-7HLWBYH7.js";
 import "../chunk-BBMTVAE3.js";
 import "../chunk-YMUZWC33.js";
+import "../chunk-V3W3SATA.js";
+import "../chunk-JY5GAZYC.js";
 import "../chunk-FXU7JOXK.js";
 import "../chunk-WNBZJSQT.js";
-import "../chunk-4VU2VCEU.js";
-import "../chunk-A627QFOE.js";
+import "../chunk-2OVTGZYH.js";
+import "../chunk-YBX3G5OP.js";
 import {
   THEME_MODES,
   tuiPalette
@@ -7423,7 +7425,7 @@ function useOrchestrator(enabled = true) {
     let cancelled = false;
     async function init() {
       try {
-        const { MultiAgentOrchestrator } = await import("../orchestrator-XUJDK4EW.js");
+        const { MultiAgentOrchestrator } = await import("../orchestrator-WV2YCHTK.js");
         const { getCoordinatorName, isCoordinatorRole, loadEmployees } = await import("../lib/employees.js");
         const { isExeSession } = await import("../lib/tmux-routing.js");
         const { listTmuxSessions, inTmux } = await import("../lib/tmux-status.js");
@@ -7464,7 +7466,7 @@ function useOrchestrator(enabled = true) {
         setTotalInProgress(health.totalInProgress);
         try {
           const { getClient } = await import("../lib/database.js");
-          const { sessionScopeFilter: sessionScopeFilter2 } = await import("../task-scope-74ZIFQRH.js");
+          const { sessionScopeFilter: sessionScopeFilter2 } = await import("../task-scope-44N7XP5N.js");
           const client = getClient();
           const uoScope = sessionScopeFilter2();
           const result = await client.execute({
@@ -7496,7 +7498,7 @@ function useOrchestrator(enabled = true) {
   const spawnSession = useCallback5(
     async (agentId) => {
       try {
-        const { createTaskCore } = await import("../tasks-crud-N54JZCXU.js");
+        const { createTaskCore } = await import("../tasks-crud-IWVDREXG.js");
         const { ensureEmployee } = await import("../lib/tmux-routing.js");
         const { getCoordinatorName } = await import("../lib/employees.js");
         await createTaskCore({
@@ -8120,7 +8122,7 @@ function TasksView({ onBack }) {
     const { withTrace } = await import("../telemetry-43X3GT3R.js");
     return withTrace("tui.tasks.loadTasks", async () => {
       try {
-        const { loadTaskList } = await import("../tui-data-BPXEJKRQ.js");
+        const { loadTaskList } = await import("../tui-data-KT7YGVQS.js");
         const tasks = await loadTaskList();
         setAllTasks(
           tasks.map((task) => ({
@@ -8953,7 +8955,7 @@ function TeamView({ onBack, onViewSessions }) {
         let projectsByEmployee = /* @__PURE__ */ new Map();
         let currentTaskByEmployee = /* @__PURE__ */ new Map();
         try {
-          const { loadTeamBadgeCounts, loadTeamDetailMetrics } = await import("../tui-data-BPXEJKRQ.js");
+          const { loadTeamBadgeCounts, loadTeamDetailMetrics } = await import("../tui-data-KT7YGVQS.js");
           setBadgeInFlight(true);
           const badgeCountsPromise = loadTeamBadgeCounts();
           const detailsPromise = loadTeamDetailMetrics(roster.map((emp) => emp.name));
@@ -9319,7 +9321,7 @@ function WikiView({ onBack }) {
     }
     setSearchLoading(true);
     try {
-      const { searchWikiMemoryRows } = await import("../tui-data-BPXEJKRQ.js");
+      const { searchWikiMemoryRows } = await import("../tui-data-KT7YGVQS.js");
       setSearchResults(await searchWikiMemoryRows(query));
     } catch {
       setSearchResults([]);

package/dist/{tui-data-BPXEJKRQ.js → tui-data-KT7YGVQS.js}

@@ -1,21 +1,21 @@
 import {
   sessionScopeFilter
-} from "./chunk-YSUHXDQU.js";
-import "./chunk-X7CWCQ5S.js";
-import "./chunk-TQ4O5A4S.js";
-import "./chunk-P7EUKYSQ.js";
+} from "./chunk-74R44E4S.js";
+import "./chunk-CAEWPEBA.js";
+import "./chunk-XV42EAVK.js";
+import "./chunk-6WHYSLGF.js";
+import "./chunk-EIKATSE4.js";
 import "./chunk-E23LNUWJ.js";
 import "./chunk-4JERP7NT.js";
-import "./chunk-EIKATSE4.js";
-import "./chunk-PM4TIRCR.js";
+import "./chunk-3ODATKWH.js";
 import "./chunk-UXLO7VHX.js";
 import "./chunk-DSOQUQTV.js";
 import "./chunk-SKGMF2SO.js";
-import "./chunk-X4EDW3FH.js";
+import "./chunk-POZGQQEZ.js";
 import "./chunk-AJIXH5JF.js";
 import "./chunk-VAY6IXWY.js";
 import "./chunk-AM7S2TY6.js";
-import "./chunk-4GGP4Q5N.js";
+import "./chunk-F3QTF4T7.js";
 import "./chunk-OSKWCKUC.js";
 import "./chunk-KI5PFRG6.js";
 import "./chunk-CVYC6DUW.js";
@@ -31,17 +31,19 @@ import "./chunk-GJV3WDWM.js";
 import "./chunk-MP2AFCGL.js";
 import {
   getClient
-} from "./chunk-M5DPPJLS.js";
+} from "./chunk-EA5FVACM.js";
 import "./chunk-2I23RPSI.js";
-import "./chunk-LLXYWNCH.js";
+import "./chunk-5YEUPUV4.js";
+import "./chunk-Z2PAVJJ4.js";
 import "./chunk-OMXJMOBD.js";
-import "./chunk-7HLWBYH7.js";
 import "./chunk-BBMTVAE3.js";
 import "./chunk-YMUZWC33.js";
+import "./chunk-V3W3SATA.js";
+import "./chunk-JY5GAZYC.js";
 import "./chunk-FXU7JOXK.js";
 import "./chunk-WNBZJSQT.js";
-import "./chunk-4VU2VCEU.js";
-import "./chunk-A627QFOE.js";
+import "./chunk-2OVTGZYH.js";
+import "./chunk-YBX3G5OP.js";
 import "./chunk-BCZF3AGJ.js";
 import "./chunk-HSGBZSCA.js";
 import "./chunk-MLKGABMK.js";

package/dist/{update-support-HLZ7KMVM.js → update-support-ZVRMECNQ.js}

@@ -1,23 +1,23 @@
 import {
   persistSupportArtifact
-} from "./chunk-CI3YVCUY.js";
+} from "./chunk-MCNDZU5W.js";
 import {
   queueSupportStatusUpdateSync
-} from "./chunk-25X4JD2V.js";
+} from "./chunk-WDA2KAV7.js";
 import {
   supportIdSchema,
   supportVersionSchema
 } from "./chunk-5H47VHB7.js";
 import "./chunk-MMRUBN3I.js";
 import "./chunk-I5AVZOL2.js";
-import "./chunk-WHQYVFE2.js";
-import "./chunk-IHKRHGKT.js";
+import "./chunk-W5YV2PZE.js";
+import "./chunk-ZMYXQU4L.js";
 import "./chunk-CHCA3ZM2.js";
 import "./chunk-OTVEIJUQ.js";
-import "./chunk-VML2UQK7.js";
+import "./chunk-FVWI2AR4.js";
 import {
   getActiveAgent
-} from "./chunk-YNYISUMW.js";
+} from "./chunk-WRP5AG4D.js";
 import "./chunk-5MOYSU5A.js";
 import {
   isTelemetryRedactionEnabled,
@@ -34,20 +34,22 @@ import "./chunk-VMR6M6GN.js";
 import "./chunk-NLEW62VC.js";
 import "./chunk-GJV3WDWM.js";
 import "./chunk-MP2AFCGL.js";
-import "./chunk-M5DPPJLS.js";
+import "./chunk-EA5FVACM.js";
 import "./chunk-2I23RPSI.js";
-import "./chunk-LLXYWNCH.js";
+import "./chunk-5YEUPUV4.js";
+import "./chunk-Z2PAVJJ4.js";
 import "./chunk-OMXJMOBD.js";
-import "./chunk-7HLWBYH7.js";
 import "./chunk-BBMTVAE3.js";
 import "./chunk-YMUZWC33.js";
+import "./chunk-V3W3SATA.js";
+import "./chunk-JY5GAZYC.js";
 import "./chunk-FXU7JOXK.js";
 import "./chunk-QWVXN224.js";
 import {
   loadLicense,
   readCachedLicenseToken
-} from "./chunk-4VU2VCEU.js";
-import "./chunk-A627QFOE.js";
+} from "./chunk-2OVTGZYH.js";
+import "./chunk-YBX3G5OP.js";
 import {
   EXE_AI_DIR,
   loadConfig

package/dist/{work-state-heartbeat-IQI3LCHN.js → work-state-heartbeat-CA4CN7DQ.js}

@@ -9,7 +9,7 @@ import {
   runWorkStateTick,
   shouldWriteWorkState,
   upsertWorkState
-} from "./chunk-IHKRHGKT.js";
+} from "./chunk-ZMYXQU4L.js";
 import "./chunk-CHCA3ZM2.js";
 import "./chunk-MLKGABMK.js";
 export {

package/dist/{worker-gate-5ABYGLC2.js → worker-gate-52MVKYGZ.js}

@@ -6,7 +6,7 @@ import {
   releaseBackfillLock,
   tryAcquireBackfillLock,
   tryAcquireWorkerSlot
-} from "./chunk-XPGUSSG7.js";
+} from "./chunk-SIGAQQHW.js";
 import "./chunk-BCZF3AGJ.js";
 import "./chunk-HSGBZSCA.js";
 import "./chunk-MLKGABMK.js";

package/dist/{workflow-engine-XSUWZK6I.js → workflow-engine-ZAFBPVUP.js}

@@ -10,8 +10,8 @@ import {
   persistWorkflows,
   runWorkflow,
   startWorkflow
-} from "./chunk-H4ZSOAP6.js";
-import "./chunk-GVU3BW6N.js";
+} from "./chunk-44WFVMZ5.js";
+import "./chunk-COHHVCFA.js";
 import "./chunk-MLKGABMK.js";
 export {
   advanceWorkflow,

package/dist/{worktree-EUYBBABA.js → worktree-NNVXVV6A.js}

@@ -16,15 +16,17 @@ import {
   resolveGitWithRetrySync,
   worktreeBranch,
   worktreePath
-} from "./chunk-TQ4O5A4S.js";
-import "./chunk-X4EDW3FH.js";
-import "./chunk-M5DPPJLS.js";
+} from "./chunk-XV42EAVK.js";
+import "./chunk-POZGQQEZ.js";
+import "./chunk-EA5FVACM.js";
 import "./chunk-2I23RPSI.js";
-import "./chunk-LLXYWNCH.js";
+import "./chunk-5YEUPUV4.js";
+import "./chunk-Z2PAVJJ4.js";
 import "./chunk-OMXJMOBD.js";
-import "./chunk-7HLWBYH7.js";
 import "./chunk-BBMTVAE3.js";
 import "./chunk-YMUZWC33.js";
+import "./chunk-V3W3SATA.js";
+import "./chunk-JY5GAZYC.js";
 import "./chunk-FXU7JOXK.js";
 import "./chunk-BCZF3AGJ.js";
 import "./chunk-HSGBZSCA.js";

package/dist/{worktree-sweep-LSKFA2PK.js → worktree-sweep-IM2ZQG6Z.js}

@@ -3,16 +3,18 @@ import {
   discoverRepoPaths,
   isWorktreePathOccupiedByCwd,
   sweepWorktrees
-} from "./chunk-ABM3DZF3.js";
-import "./chunk-TQ4O5A4S.js";
-import "./chunk-X4EDW3FH.js";
-import "./chunk-M5DPPJLS.js";
+} from "./chunk-G37RG543.js";
+import "./chunk-XV42EAVK.js";
+import "./chunk-POZGQQEZ.js";
+import "./chunk-EA5FVACM.js";
 import "./chunk-2I23RPSI.js";
-import "./chunk-LLXYWNCH.js";
+import "./chunk-5YEUPUV4.js";
+import "./chunk-Z2PAVJJ4.js";
 import "./chunk-OMXJMOBD.js";
-import "./chunk-7HLWBYH7.js";
 import "./chunk-BBMTVAE3.js";
 import "./chunk-YMUZWC33.js";
+import "./chunk-V3W3SATA.js";
+import "./chunk-JY5GAZYC.js";
 import "./chunk-FXU7JOXK.js";
 import "./chunk-BCZF3AGJ.js";
 import "./chunk-HSGBZSCA.js";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@askexenow/exe-os",
-  "version": "0.9.357",
+  "version": "0.9.359",
   "description": "AI employee operating system — persistent memory, task management, and multi-agent coordination for Claude Code.",
   "license": "SEE LICENSE IN LICENSE",
   "type": "module",
@@ -64,6 +64,15 @@
     "deploy/compose"
   ],
   "exports": {
+    "./internal/*": null,
+    "./dist/internal/*": null,
+    "./dist/internal/*.js": null,
+    "./lib/founder-monitor-envelope": null,
+    "./lib/sync-cipher": null,
+    "./dist/lib/founder-monitor-envelope": null,
+    "./dist/lib/founder-monitor-envelope.js": null,
+    "./dist/lib/sync-cipher": null,
+    "./dist/lib/sync-cipher.js": null,
     ".": "./dist/index.js",
     "./runtime": "./dist/runtime/index.js",
     "./gateway": "./dist/gateway/index.js",
@@ -109,14 +118,15 @@
     "node": ">=20.0.0"
   },
   "scripts": {
+    "prepare": "git config core.hooksPath .githooks || true",
     "test": "vitest run",
     "test:watch": "vitest",
     "lint": "eslint src/ --max-warnings 53",
     "typecheck": "tsc --noEmit",
-    "build": "bash scripts/build-lock.sh && mkdir -p dist/assets && cp src/assets/tmux.conf dist/assets/ && cp src/assets/ghostty.conf dist/assets/ && cp src/assets/statusline-command.sh dist/assets/ && cp src/assets/wezterm.lua dist/assets/ && cp src/assets/com.askexe.exed.plist dist/assets/ && cp src/bin/exe-start.sh dist/bin/exe-start.sh && (node dist/bin/generate-hook-manifest.js 2>/dev/null || true)",
-    "deploy": "node dist/bin/pre-build-guard.js && npm run build && (node dist/bin/prune-orphan-chunks.js || true) && npm install -g . && node dist/bin/install.js --global && echo '[exe-os] Deploy complete. Run /mcp in active sessions to reconnect.'",
+    "build": "bash scripts/build-lock.sh && mkdir -p dist/assets && cp src/assets/tmux.conf dist/assets/ && cp src/assets/ghostty.conf dist/assets/ && cp src/assets/statusline-command.sh dist/assets/ && cp src/assets/wezterm.lua dist/assets/ && cp src/assets/com.askexe.exed.plist dist/assets/ && cp src/bin/exe-start.sh dist/bin/exe-start.sh && (node dist/bin/generate-hook-manifest.js 2>/dev/null || true) && node scripts/dist-integrity.mjs --record",
+    "deploy": "node dist/bin/pre-build-guard.js && EXE_DIST_CLEAN=1 npm run build && node scripts/dist-integrity.mjs --verify && (node dist/bin/prune-orphan-chunks.js || true) && npm install -g . && node dist/bin/install.js --global && echo '[exe-os] Deploy complete. Run /mcp in active sessions to reconnect.'",
     "postinstall": "[ ! -f dist/bin/install.js ] || node dist/bin/install.js --commands-only || true",
-    "prepublishOnly": "npm run typecheck && npm run build && node dist/bin/prune-orphan-chunks.js --force && npm run guard:esm-require && npm run check:schema-version && node dist/bin/customer-readiness.js && node dist/bin/pre-publish.js",
+    "prepublishOnly": "npm run typecheck && EXE_DIST_CLEAN=1 npm run build && node dist/bin/prune-orphan-chunks.js --force && node scripts/dist-integrity.mjs --prune && npm run guard:esm-require && npm run check:schema-version && node dist/bin/customer-readiness.js && node dist/bin/pre-publish.js",
     "test:publish": "npx vitest run --maxWorkers=4 --exclude 'tests/tui/**' --exclude 'tests/lib/tmux-routing.test.ts' --exclude 'tests/lib/intercom-routing.test.ts' --exclude 'tests/gateway/**' --exclude 'tests/mcp/ingest-document.test.ts' --exclude 'tests/lib/hybrid-search.test.ts' --exclude 'tests/lib/worker-gate.test.ts' --exclude 'tests/daemon-perf-stress.test.ts' --exclude 'tests/lib/gateway-client.test.ts' --exclude 'tests/lib/ws-client.test.ts' --exclude 'tests/lib/ws-auth.test.ts' --exclude 'tests/integration/clean-stack-projection.test.ts' --exclude 'tests/orchestration/dispatch-chain.test.ts' --exclude 'tests/orchestration/e2e-flow.test.ts' && echo '::warning::clean-stack-projection and stack-update quarantined (need Docker + live DB; environmental, fail in CI runner — container unhealthy / DB not initialized); ws-client/ws-auth quarantined (30-120s timeouts flaky on Node 20 CI runner — passes locally). Quarantined to match build-and-test (required gate): dispatch-chain/e2e-flow (timing-sensitive, flaky under parallel load — bug dfb25bf1). device-id-split-brain/reaper-deps-async/find-free-instance/db-backup-recovery de-flaked and promoted to the required gate (chore/deflake-required-ci). See cicd-audit-2026-06-18.md.' && npx vitest run --maxWorkers=1 tests/daemon-perf-stress.test.ts tests/lib/gateway-client.test.ts",
     "benchmark:longmemeval": "npx tsx tests/benchmarks/longmemeval.ts",
     "guard:esm-require": "node scripts/check-no-runtime-require.mjs",

package/release-notes.json

@@ -1,63 +1,67 @@
 {
-  "current": "0.9.357",
+  "current": "0.9.359",
   "notes": {
-    "0.9.357": {
-      "version": "0.9.357",
-      "date": "2026-07-28",
+    "0.9.359": {
+      "version": "0.9.359",
+      "date": "2026-07-30",
       "features": [],
       "fixes": [],
       "security": [],
       "other": [
-        "v0.9.357 — image-pullability watchdog + upgrade.sh proxy login (#501)"
+        "v0.9.359 — keychain-dialog fix (#514) + telemetry-privacy P0 (#510) + dormant AI-Partner B1/B2 (#515)"
       ],
       "migration_notes": []
     },
-    "0.9.356": {
-      "version": "0.9.356",
-      "date": "2026-07-27",
-      "features": [],
+    "0.9.358": {
+      "version": "0.9.358",
+      "date": "2026-07-29",
+      "features": [
+        "budget: proactive global spend-cap alerting — the daemon now evaluates 24h spend against the configured cap on each agent-stats refresh and fires ONE notification per escalation (ok→near_cap→over_cap, re-arming on a drop), so a runaway agent that blows the budget is surfaced actively instead of only reactively via get_agent_spend (7c89b432) (#482)",
+        "security: repo-wide gitleaks pre-commit hook (staged-content scan, warn-and-allow when the tool is missing, CI full-history scan as the hard backstop) plus a fully triaged .gitleaksignore baseline — every entry is a documented false-positive (redaction-test fixtures, doc examples, public keys), with the standing policy that new untriaged findings still fail CI (caf65918) (#424)"
+      ],
       "fixes": [
-        "memory reads no longer throw \"Database client not initialized\" — memory(search)/recall_my_memory/ask_team_memory now guard on a shared ensureReadDbReady() and return an empty result gracefully when the DB adapter is unregistered (daemon down / degraded fastDbInit no-op), instead of crashing (extends the #474 fix to the read paths) (8167b9aa) (#495)",
-        "spawn no longer emits a false \"Coordinator checkout refusal\" for worktree-isolated dispatch — the coordinator-cwd refusal now only fires for an explicit spawn_worktree=false opt-out into the coordinator's live checkout; the main-checkout branch-stomp protection is preserved downstream, so code-role agents can again be dispatched from the coordinator's own repo (7af6e4a1) (#496)"
+        "db: reconcile the ADR-016 single-writer guard (supersedes #498+#487) — isDaemonWriterAuthority() now fails SAFE on a frozen daemon (a socket-ping timeout is read as \"authority present\", refusing a second writer) and resolves the daemon PID/socket from the same EXE_OS_DIR-aware path the daemon writes to; adds an MCP-process unconditional direct-write block, a read-path short-circuit, a DB-open telemetry tripwire, and WAL/scope fixes; also folds in daemon stall-attribution, boot timing and cloud-sync-via-daemon diagnostics (df26c896) (#503)",
+        "ci: make two required-gate tests deterministic — the retrieval-telemetry \"hot path\" test now asserts the real invariant (synchronous void return + in-memory buffering, no DB I/O) instead of a wall-clock threshold, and the daemon-ready \"starting health window\" test uses fake timers; both previously flaked under self-hosted-runner load and stalled releases (a8817ab0) (#506)",
+        "release: drift-proof the stack-promote runbook + printed NEXT STEPS — re-sign the stack manifest and commit the SIGNED file BEFORE arming auto-merge (an armed auto-merge could otherwise land an unsigned manifest and brick fleet stack-update), and publish only after the signed manifest is on merged main; adds a doc-lint guard enforcing the ordering and a cli.ts --version routing regression test (5a6c6c52 #463, hardened by 53816038 #509)",
+        "daemon-report: exclude macOS host-sleep wake-clusters from the restart-report slowest-timer leaderboard too (shared with the timer report via a new daemon-sleep-filter module), so a laptop suspend no longer inflates the slowest-timer numbers with multi-minute sleep spans (#457)",
+        "procedures: raise the injected-procedures size cap to 27000 to fit the \"Done = LANDED\" terminal-state discipline addition, and teach merge/landing discipline in the platform procedures (#486)"
       ],
       "security": [],
       "other": [],
       "migration_notes": []
     },
-    "0.9.355": {
-      "version": "0.9.355",
-      "date": "2026-07-27",
+    "0.9.357": {
+      "version": "0.9.357",
+      "date": "2026-07-28",
       "features": [
-        "search: FTS queries now support exact \"quoted phrases\" and negative/NOT terms (`-term` / `NOT term`) — parsed into FTS5 phrase + NOT clauses (query-construction only, no index/tokenizer change), with a safe fallback to a plain match on malformed input so a bad query never throws or returns nothing (91b92519) (#492)"
+        "release ops: nightly image-pullability drift watchdog — a scheduled workflow HEAD-checks every pinned digest in the shipped stack manifests and fails loudly if any becomes un-pullable (registry GC, mirror rot, or proxy-auth drift), catching supply-chain breakage within ~24h instead of at a customer's deploy pre-flight (f4cbc12a) (#499)"
+      ],
+      "fixes": [
+        "deploy: the legacy deploy/upgrade.sh now docker-logins the update.askexe.com registry proxy (Basic auth, user token + EXE_REGISTRY_PROXY_PULL_TOKENS) before pulling — closes the one un-authenticated pull path that made manifest-pinned images fail with 401 on that flow (the primary `exe-os stack-update` path already re-auths per pull). Idempotent + guarded; skips cleanly when no proxy token is present (5f94882d) (#500)"
       ],
-      "fixes": [],
       "security": [],
       "other": [],
       "migration_notes": []
     },
-    "0.9.354": {
-      "version": "0.9.354",
+    "0.9.356": {
+      "version": "0.9.356",
       "date": "2026-07-27",
-      "features": [
-        "diagnostics: new `memory_isolation` action scores how unique each agent's memory is vs how much it overlaps others — graph-entity-set Jaccard overlap + per-agent uniqueness score, read-only, no embeddings, session_scope-isolated (admin-only all_scopes opt-in) (d78ca1df) (#489)",
-        "search-quality: aggregate precision@K reporting (micro + macro) over a window, computed read-only from existing memory_reads ⋈ tasks telemetry and surfaced in `exe-memory-reads` (90bba6f0) (#490)"
+      "features": [],
+      "fixes": [
+        "memory reads no longer throw \"Database client not initialized\" — memory(search)/recall_my_memory/ask_team_memory now guard on a shared ensureReadDbReady() and return an empty result gracefully when the DB adapter is unregistered (daemon down / degraded fastDbInit no-op), instead of crashing (extends the #474 fix to the read paths) (8167b9aa) (#495)",
+        "spawn no longer emits a false \"Coordinator checkout refusal\" for worktree-isolated dispatch — the coordinator-cwd refusal now only fires for an explicit spawn_worktree=false opt-out into the coordinator's live checkout; the main-checkout branch-stomp protection is preserved downstream, so code-role agents can again be dispatched from the coordinator's own repo (7af6e4a1) (#496)"
       ],
-      "fixes": [],
       "security": [],
       "other": [],
       "migration_notes": []
     },
-    "0.9.353": {
-      "version": "0.9.353",
+    "0.9.355": {
+      "version": "0.9.355",
       "date": "2026-07-27",
       "features": [
-        "Opus 5.0 (claude-opus-5.0) is now a first-class selectable model across the claude + opencode runtimes, with aliases (opus, opus-5, opus5) and spawn-time validation — fixes multi-customer reports that Opus 5.0 was rejected as unavailable (#480)"
-      ],
-      "fixes": [
-        "employee-session spawn cwd is derived from the roster/project root instead of a prior task's stale or deleted worktree, and refuses cleanly (releasing the spawn lock) rather than hard-failing tmux new-session when no valid directory resolves (e1b1444b) (#481)",
-        "intercom nudge delivery now confirms the Enter submission on an idle employee pane and re-queues half-delivered (typed-but-unsubmitted) nudges, so a dispatched agent no longer sits idle with an open task when the submit keystroke is dropped (e4889b61) (#483)",
-        "ERP deploy health probe resolves its HTTP Host header from the configured stack domain (ERP_SITE_NAME) instead of a hardcoded 'localhost', so a Host-routed Frappe/ERPNext deployment no longer 404s and rolls back an otherwise-healthy release (9747e6e6) (#484)"
+        "search: FTS queries now support exact \"quoted phrases\" and negative/NOT terms (`-term` / `NOT term`) — parsed into FTS5 phrase + NOT clauses (query-construction only, no index/tokenizer change), with a safe fallback to a plain match on malformed input so a bad query never throws or returns nothing (91b92519) (#492)"
       ],
+      "fixes": [],
       "security": [],
       "other": [],
       "migration_notes": []

package/dist/chunk-7HLWBYH7.js

@@ -1,60 +0,0 @@
-// src/lib/mcp-health.ts
-import { existsSync, readFileSync } from "fs";
-import path from "path";
-import { homedir } from "os";
-var PID_PATH = path.join(homedir(), ".exe-os", "exed.pid");
-function isDaemonAlive() {
-  if (_isDaemonProcess) {
-    return { alive: true, pid: process.pid };
-  }
-  try {
-    if (!existsSync(PID_PATH)) {
-      const socketPath = process.env.EXE_DAEMON_SOCK ?? path.join(homedir(), ".exe-os", "exed.sock");
-      if (existsSync(socketPath)) return { alive: true, pid: null };
-      return { alive: false, pid: null };
-    }
-    const pid = parseInt(readFileSync(PID_PATH, "utf8").trim(), 10);
-    if (!Number.isFinite(pid) || pid <= 0) return { alive: false, pid: null };
-    process.kill(pid, 0);
-    return { alive: true, pid };
-  } catch {
-    return { alive: false, pid: null };
-  }
-}
-function isMcpHealthy(_timeoutMs = 2e3) {
-  if (_isDaemonProcess) return true;
-  const { alive } = isDaemonAlive();
-  if (!alive) return false;
-  const socketPath = process.env.EXE_DAEMON_SOCK ?? process.env.EXE_EMBED_SOCK ?? path.join(homedir(), ".exe-os", "exed.sock");
-  return existsSync(socketPath);
-}
-var _isDaemonProcess = false;
-function markAsDaemonProcess() {
-  _isDaemonProcess = true;
-}
-var EVENT_LOOP_DEGRADED_THRESHOLD_MS = 5e3;
-var _eventLoopLagMs = 0;
-var _eventLoopLagUpdatedAt = 0;
-function setEventLoopLagMs(lagMs) {
-  _eventLoopLagMs = lagMs;
-  _eventLoopLagUpdatedAt = Date.now();
-}
-function getEventLoopLagMs() {
-  return _eventLoopLagMs;
-}
-function getEventLoopLagUpdatedAt() {
-  return _eventLoopLagUpdatedAt;
-}
-function isEventLoopDegraded() {
-  return _eventLoopLagMs > EVENT_LOOP_DEGRADED_THRESHOLD_MS;
-}
-
-export {
-  isDaemonAlive,
-  isMcpHealthy,
-  markAsDaemonProcess,
-  setEventLoopLagMs,
-  getEventLoopLagMs,
-  getEventLoopLagUpdatedAt,
-  isEventLoopDegraded
-};