@askexenow/exe-os 0.9.358 → 0.9.359

package/dist/{chunk-IR6CEBWC.js → chunk-74R44E4S.js}

@@ -1,6 +1,6 @@
 import {
   ensureAgentSymlink
-} from "./chunk-VJRLBE2R.js";
+} from "./chunk-CAEWPEBA.js";
 import {
   ensureWorktree,
   ensureWorktreeAsync,
@@ -8,10 +8,10 @@ import {
   getMainRepoRoot,
   isInsideGitRepo,
   isWorktreeDirty
-} from "./chunk-Q5AFCR57.js";
+} from "./chunk-XV42EAVK.js";
 import {
   incrementSkillSuccess
-} from "./chunk-J4DLB36O.js";
+} from "./chunk-6WHYSLGF.js";
 import {
   reviewSignalPath,
   taskSignalDir
@@ -28,7 +28,7 @@ import {
 import {
   listSessions,
   registerSession
-} from "./chunk-MODZZ52R.js";
+} from "./chunk-3ODATKWH.js";
 import {
   getTransport
 } from "./chunk-UXLO7VHX.js";
@@ -37,7 +37,7 @@ import {
 } from "./chunk-SKGMF2SO.js";
 import {
   recordOrchestrationEventBestEffort
-} from "./chunk-6ZUHNYAB.js";
+} from "./chunk-POZGQQEZ.js";
 import {
   appendDispatchJournalEvent,
   releaseDispatchClaim,
@@ -53,7 +53,7 @@ import {
 import {
   PlanLimitError,
   assertEmployeeLimitSync
-} from "./chunk-IOSM2N3Z.js";
+} from "./chunk-F3QTF4T7.js";
 import {
   BUSY_PATTERN
 } from "./chunk-OSKWCKUC.js";
@@ -89,13 +89,13 @@ import {
   loadEmployeesSync,
   offloadReadIfMain,
   offloadReadQuery
-} from "./chunk-U7I4YINB.js";
+} from "./chunk-EA5FVACM.js";
 import {
   RUNTIME_TABLE
 } from "./chunk-WNBZJSQT.js";
 import {
   loadDeviceId
-} from "./chunk-6VUMFHWB.js";
+} from "./chunk-2OVTGZYH.js";
 import {
   EXE_AI_DIR
 } from "./chunk-BCZF3AGJ.js";
@@ -1515,7 +1515,7 @@ async function createTaskCore(input) {
         if (isCoordinatorSession) {
           earlySessionScope = resolved;
         } else {
-          const { getSessionProject } = await import("./session-scope-ISVYSAC2.js");
+          const { getSessionProject } = await import("./session-scope-2ADEVY3C.js");
           const sessionProject = getSessionProject(resolved);
           if (sessionProject && sessionProject !== input.projectName) {
             scopeMismatchWarning = `session/project mismatch: session "${resolved}" owns "${sessionProject}" but task targets "${input.projectName}". Routed to default scope.`;
@@ -1812,7 +1812,7 @@ async function buildTaskRowsStatement(opts) {
   }
   if (opts.founderId !== null) {
     try {
-      const { founderScopeFilter } = await import("./founder-context-K5NWGKX7.js");
+      const { founderScopeFilter } = await import("./founder-context-C7X7IRDA.js");
       const founderFilter = founderScopeFilter(opts.founderId);
       const cleaned = founderFilter.sql.replace(/^\s*AND\s+/, "");
       conditions.push(cleaned);
@@ -5144,7 +5144,7 @@ async function verifyPaneAtCapacity(sessionName) {
       reason: `capture-pane failed: ${err instanceof Error ? err.message : String(err)}`
     };
   }
-  const { isAtCapacity } = await import("./capacity-monitor-6FD2LIDV.js");
+  const { isAtCapacity } = await import("./capacity-monitor-QLPEL6S5.js");
   if (!isAtCapacity(pane)) {
     return {
       atCapacity: false,
@@ -5378,7 +5378,7 @@ async function countScopedPendingReviews(targetSession, reviewer) {
 }
 async function countScopedOpenTasks(targetSession, agentId) {
   try {
-    const { fastDbInit } = await import("./fast-db-init-LRC6RZ6U.js");
+    const { fastDbInit } = await import("./fast-db-init-6H67K76Q.js");
     const client = await fastDbInit();
     const scope = extractRootExe(targetSession);
     if (!scope) return 0;
@@ -5433,7 +5433,7 @@ function buildScopedInProgressTaskQuery(targetSession) {
 async function findScopedInProgressTaskId(targetSession) {
   const q = buildScopedInProgressTaskQuery(targetSession);
   if (!q) return null;
-  const { fastDbInit } = await import("./fast-db-init-LRC6RZ6U.js");
+  const { fastDbInit } = await import("./fast-db-init-6H67K76Q.js");
   const client = await fastDbInit();
   const result = await client.execute(q);
   const id = result.rows[0]?.id;
@@ -5553,7 +5553,7 @@ function sendIntercom(targetSession, opts) {
   }
   if ((process.env.EXE_NOTIFICATION_LEDGER ?? "").trim().toLowerCase() === "shadow") {
     const shadowScope = opts && "callerSessionScope" in opts ? opts.callerSessionScope : void 0;
-    void import("./notification-ledger-54CAO4AS.js").then((m) => m.recordShadowNudge(targetSession, reason, shadowScope)).catch(() => {
+    void import("./notification-ledger-NZ4HO3M5.js").then((m) => m.recordShadowNudge(targetSession, reason, shadowScope)).catch(() => {
     });
   }
   if (!opts?.force && isDebounced(targetSession)) {
@@ -5689,7 +5689,7 @@ function scheduleDeferredSpawnNudge(input) {
           return;
         }
         queueIntercom(input.sessionName, `spawn nudge failed after ${attempt} attempts: ${msg}`, "signal");
-        void import("./notifications-MCJFLBAO.js").then(({ writeNotification: writeNotification2 }) => writeNotification2({
+        void import("./notifications-74YECZ4V.js").then(({ writeNotification: writeNotification2 }) => writeNotification2({
           agentId: getCoordinatorName(),
           agentRole: "COO",
           event: "error_spike",

package/dist/{chunk-76IW4LIS.js → chunk-A5WEEND7.js}

@@ -1,6 +1,6 @@
 import {
   routeTask
-} from "./chunk-OP7M5N5R.js";
+} from "./chunk-46RPEWTH.js";
 import {
   createTaskCore,
   employeeSessionName,
@@ -9,11 +9,11 @@ import {
   isEmployeeAlive,
   sessionScopeFilter,
   updateTaskStatus
-} from "./chunk-IR6CEBWC.js";
+} from "./chunk-74R44E4S.js";
 import {
   DEFAULT_COORDINATOR_TEMPLATE_NAME,
   getCoordinatorName
-} from "./chunk-U7I4YINB.js";
+} from "./chunk-EA5FVACM.js";
 
 // src/runtime/orchestrator.ts
 var STALE_THRESHOLD_MS = 2 * 60 * 60 * 1e3;

package/dist/{chunk-YPZTTTFH.js → chunk-AL7JMA54.js}

@@ -1,11 +1,11 @@
 import {
   ingest
-} from "./chunk-WXUTAQX2.js";
+} from "./chunk-NKDKB2RT.js";
 import {
   listWorkflowDefinitions,
   runWorkflow,
   startWorkflow
-} from "./chunk-72HSYKEQ.js";
+} from "./chunk-44WFVMZ5.js";
 import {
   initCRMBridge
 } from "./chunk-ML4S5SHZ.js";

package/dist/{chunk-7KPY52EO.js → chunk-APR556TY.js}

@@ -1,6 +1,6 @@
 import {
   loadLicense
-} from "./chunk-6VUMFHWB.js";
+} from "./chunk-2OVTGZYH.js";
 
 // src/lib/stack-update.ts
 import { execFileSync, spawnSync } from "child_process";

package/dist/{chunk-ZP3224K3.js → chunk-C5YZMYQH.js}

@@ -2,7 +2,7 @@ import {
   decryptSyncBlob,
   encryptSyncBlob,
   isSyncCryptoInitialized
-} from "./chunk-S3THSOWV.js";
+} from "./chunk-EUQF3JOH.js";
 
 // src/lib/crdt-sync.ts
 import * as Y from "yjs";

package/dist/{chunk-VJRLBE2R.js → chunk-CAEWPEBA.js}

@@ -1,6 +1,6 @@
 import {
   loadEmployees
-} from "./chunk-U7I4YINB.js";
+} from "./chunk-EA5FVACM.js";
 
 // src/lib/agent-symlinks.ts
 import os from "os";

package/dist/{chunk-WTTCNZ6J.js → chunk-DKRSKC5R.js}

@@ -3,7 +3,7 @@ import {
 } from "./chunk-WCGNCH3Q.js";
 import {
   registerAllTools
-} from "./chunk-ZJB26D36.js";
+} from "./chunk-GD7VXXW6.js";
 
 // src/mcp/mcp-surface-hash.ts
 function computeMcpSurfaceHash() {

package/dist/{chunk-5A43OWIJ.js → chunk-DQ75MEPU.js}

@@ -1,6 +1,6 @@
 import {
   processCRMEvent
-} from "./chunk-MZXYP2YA.js";
+} from "./chunk-COHHVCFA.js";
 
 // src/gateway/adapters/crm-webhook.ts
 function parseTwentyWebhook(payload) {

package/dist/{chunk-E47WQHCT.js → chunk-DWKH2H7W.js}

@@ -1,6 +1,6 @@
 import {
   getClient
-} from "./chunk-U7I4YINB.js";
+} from "./chunk-EA5FVACM.js";
 
 // src/lib/token-budget.ts
 var WARN_THRESHOLD = 0.8;

package/dist/{chunk-U7I4YINB.js → chunk-EA5FVACM.js}

@@ -6,7 +6,7 @@ import {
 } from "./chunk-5YEUPUV4.js";
 import {
   listBackups
-} from "./chunk-AXAHRTST.js";
+} from "./chunk-Z2PAVJJ4.js";
 import {
   getEmotionalBaseline,
   renderEmotionalBaselineSection
@@ -1333,7 +1333,7 @@ async function migrateReflectionDedup(client) {
     "ALTER TABLE memory_reflections ADD COLUMN dedup_key TEXT",
     "migration add memory_reflections.dedup_key"
   );
-  const { reflectionDedupKey } = await import("./memory-reflection-LIILYJAS.js");
+  const { reflectionDedupKey } = await import("./memory-reflection-EQC4FXSW.js");
   const keyForRow = (row) => {
     let sources = [];
     try {
@@ -2132,7 +2132,7 @@ async function sweepExpiredSoftDeletedMemories(client, options = {}) {
   const purgeArchived = archDays !== void 0;
   const BATCH_SIZE = 2e3;
   const MAX_BATCHES = 500;
-  const { cleanupCardsForMemories, cleanupGraphLinksForMemories } = await import("./graph-rag-WUM5JUB7.js");
+  const { cleanupCardsForMemories, cleanupGraphLinksForMemories } = await import("./graph-rag-5FVC5JXH.js");
   const softCutoff = `-${softDays} days`;
   const selectArgsBase = [softCutoff];
   let predicate = `status = 'deleted' AND COALESCE(deleted_at, timestamp) < datetime('now', ?)`;

package/dist/{chunk-S3THSOWV.js → chunk-EUQF3JOH.js}

@@ -1,116 +1,44 @@
 import {
-  deriveEnvelopeWrapKeyForRecipient,
+  ALGORITHM,
+  CURRENT_KEY_ID,
+  DEK_LENGTH,
+  ENVELOPE_BLOB_VERSION,
+  IV_LENGTH,
+  PK_HASH_LENGTH,
+  RECIPIENT_SYMMETRIC,
+  RECIPIENT_X25519,
+  SYM_RECIPIENT_LENGTH,
+  SYNC_BLOB_VERSION,
+  TAG_LENGTH,
+  VERSIONED_HEADER_LENGTH,
+  X25519_PUB_LENGTH,
+  X25519_RECIPIENT_LENGTH,
+  initSyncKey,
+  isSyncKeyInitialized,
+  requireSyncKey,
+  unwrapDek,
+  v2PayloadAad
+} from "./chunk-TWMWHDOY.js";
+import {
   getCachedMonitorIdentity,
-  pubKeyHash,
   recomputeEnvelopeWrapKey
 } from "./chunk-IOEUAQWP.js";
 
 // src/lib/crypto.ts
 import crypto from "crypto";
-var ALGORITHM = "aes-256-gcm";
-var IV_LENGTH = 12;
-var TAG_LENGTH = 16;
-var SYNC_HKDF_INFO = "exe-mem-sync-v2";
-var SYNC_BLOB_VERSION = 1;
-var CURRENT_KEY_ID = 0;
-var VERSIONED_HEADER_LENGTH = 2;
-var ENVELOPE_BLOB_VERSION = 2;
-var RECIPIENT_SYMMETRIC = 0;
-var RECIPIENT_X25519 = 1;
-var DEK_LENGTH = 32;
-var PK_HASH_LENGTH = 8;
-var X25519_PUB_LENGTH = 32;
-var SYM_RECIPIENT_LENGTH = 1 + IV_LENGTH + DEK_LENGTH + TAG_LENGTH;
-var X25519_RECIPIENT_LENGTH = 1 + PK_HASH_LENGTH + X25519_PUB_LENGTH + IV_LENGTH + DEK_LENGTH + TAG_LENGTH;
-var _syncKey = null;
 function initSyncCrypto(masterKey) {
-  if (masterKey.length !== 32) {
-    throw new Error(`Master key must be 32 bytes, got ${masterKey.length}`);
-  }
-  _syncKey = Buffer.from(
-    crypto.hkdfSync("sha256", masterKey, "", SYNC_HKDF_INFO, 32)
-  );
+  initSyncKey(masterKey);
 }
 function isSyncCryptoInitialized() {
-  return _syncKey !== null;
+  return isSyncKeyInitialized();
 }
-function requireSyncKey() {
-  if (!_syncKey) {
-    throw new Error("Sync crypto not initialized. Call initSyncCrypto(masterKey) first.");
-  }
-  return _syncKey;
-}
-function encryptSyncBlob(data, recipientPubKeys) {
+function encryptSyncBlob(data) {
   const key = requireSyncKey();
-  if (!recipientPubKeys || recipientPubKeys.length === 0) {
-    const iv = crypto.randomBytes(IV_LENGTH);
-    const cipher = crypto.createCipheriv(ALGORITHM, key, iv);
-    const encrypted = Buffer.concat([cipher.update(data), cipher.final()]);
-    const tag = cipher.getAuthTag();
-    return Buffer.concat([Buffer.from([SYNC_BLOB_VERSION, CURRENT_KEY_ID]), iv, encrypted, tag]).toString("base64");
-  }
-  return encryptEnvelope(data, key, recipientPubKeys).toString("base64");
-}
-function wrapDek(dek, wrapKey, aad) {
   const iv = crypto.randomBytes(IV_LENGTH);
-  const cipher = crypto.createCipheriv(ALGORITHM, wrapKey, iv);
-  cipher.setAAD(aad);
-  const wrapped = Buffer.concat([cipher.update(dek), cipher.final()]);
+  const cipher = crypto.createCipheriv(ALGORITHM, key, iv);
+  const encrypted = Buffer.concat([cipher.update(data), cipher.final()]);
   const tag = cipher.getAuthTag();
-  return Buffer.concat([iv, wrapped, tag]);
-}
-function unwrapDek(iv, wrapped, tag, wrapKey, aad) {
-  const decipher = crypto.createDecipheriv(ALGORITHM, wrapKey, iv);
-  decipher.setAAD(aad);
-  decipher.setAuthTag(tag);
-  return Buffer.concat([decipher.update(wrapped), decipher.final()]);
-}
-function buildPayloadAad(keyId, recipientCount, recipientBytes) {
-  const digest = crypto.createHash("sha256").update(recipientBytes).digest();
-  return Buffer.concat([Buffer.from([ENVELOPE_BLOB_VERSION, keyId, recipientCount]), digest]);
-}
-function encryptEnvelope(data, syncKey, recipientPubKeys) {
-  const dek = crypto.randomBytes(DEK_LENGTH);
-  const recipients = [];
-  {
-    const sym = wrapDek(dek, syncKey, Buffer.from([RECIPIENT_SYMMETRIC]));
-    recipients.push(Buffer.concat([Buffer.from([RECIPIENT_SYMMETRIC]), sym]));
-  }
-  for (const recipientPub of recipientPubKeys) {
-    if (recipientPub.length !== X25519_PUB_LENGTH) {
-      process.stderr.write(`[exe-os] \u26A0 skipping monitoring recipient with bad length ${recipientPub.length}
-`);
-      continue;
-    }
-    try {
-      const hash = pubKeyHash(recipientPub);
-      const { ephemeralPublicKey, wrapKey } = deriveEnvelopeWrapKeyForRecipient(recipientPub);
-      const aad = Buffer.concat([Buffer.from([RECIPIENT_X25519]), hash]);
-      const wrapped = wrapDek(dek, wrapKey, aad);
-      recipients.push(Buffer.concat([Buffer.from([RECIPIENT_X25519]), hash, ephemeralPublicKey, wrapped]));
-    } catch (err) {
-      process.stderr.write(
-        `[exe-os] \u26A0 skipping unusable monitoring recipient (${pubKeyHash(recipientPub).toString("hex")}): ${err instanceof Error ? err.message : String(err)}
-`
-      );
-    }
-  }
-  if (recipients.length > 255) {
-    throw new Error(`Too many envelope recipients: ${recipients.length} (max 255)`);
-  }
-  const recipientBytes = Buffer.concat(recipients);
-  const payloadIv = crypto.randomBytes(IV_LENGTH);
-  const payloadCipher = crypto.createCipheriv(ALGORITHM, dek, payloadIv);
-  payloadCipher.setAAD(buildPayloadAad(CURRENT_KEY_ID, recipients.length, recipientBytes));
-  const payloadCt = Buffer.concat([payloadCipher.update(data), payloadCipher.final()]);
-  const payloadTag = payloadCipher.getAuthTag();
-  return Buffer.concat([
-    Buffer.from([ENVELOPE_BLOB_VERSION, CURRENT_KEY_ID, recipients.length]),
-    recipientBytes,
-    payloadIv,
-    payloadTag,
-    payloadCt
-  ]);
+  return Buffer.concat([Buffer.from([SYNC_BLOB_VERSION, CURRENT_KEY_ID]), iv, encrypted, tag]).toString("base64");
 }
 function parseEnvelope(combined) {
   if (combined.length < 3 || combined[0] !== ENVELOPE_BLOB_VERSION) {
@@ -173,7 +101,7 @@ function parseEnvelope(combined) {
 }
 function decryptEnvelopePayload(env, dek) {
   const decipher = crypto.createDecipheriv(ALGORITHM, dek, env.payloadIv);
-  decipher.setAAD(buildPayloadAad(env.keyId, env.recipientCount, env.recipientBytes));
+  decipher.setAAD(v2PayloadAad(env.keyId, env.recipientCount, env.recipientBytes));
   decipher.setAuthTag(env.payloadTag);
   return Buffer.concat([decipher.update(env.payloadCt), decipher.final()]);
 }

package/dist/{chunk-KTM4TODC.js → chunk-EX2SSLNU.js}

@@ -1,9 +1,9 @@
 import {
   MultiAgentOrchestrator
-} from "./chunk-76IW4LIS.js";
+} from "./chunk-A5WEEND7.js";
 import {
   createTokenBudgetMiddleware
-} from "./chunk-E47WQHCT.js";
+} from "./chunk-DWKH2H7W.js";
 import {
   createQuietRenderer,
   createTerminalRenderer,
@@ -209,7 +209,7 @@ function createExeOSHooks(config) {
         );
       }
       try {
-        const { listBehaviors } = await import("./behaviors-6B2FZ4KP.js");
+        const { listBehaviors } = await import("./behaviors-57AMN5IP.js");
         const behaviors = await listBehaviors(config.agentId, config.projectName, 12);
         if (behaviors.length > 0) {
           process.stderr.write(
@@ -330,7 +330,7 @@ function createExeOSHooks(config) {
     async onSubagentStop(_reason) {
       try {
         const { getClient } = await import("./lib/database.js");
-        const { sessionScopeFilter } = await import("./task-scope-NTANJZPS.js");
+        const { sessionScopeFilter } = await import("./task-scope-44N7XP5N.js");
         const client = getClient();
         const ehScope = sessionScopeFilter();
         const tasks = await client.execute({
@@ -422,7 +422,7 @@ function createExeOSHooks(config) {
         try {
           const { writeMemory, flushBatch } = await import("./lib/store.js");
           const { getClient } = await import("./lib/database.js");
-          const { sessionScopeFilter: cpScopeFilter } = await import("./task-scope-NTANJZPS.js");
+          const { sessionScopeFilter: cpScopeFilter } = await import("./task-scope-44N7XP5N.js");
           const client = getClient();
           const cpScope = cpScopeFilter();
           const tasks = await client.execute({

package/dist/{chunk-IOSM2N3Z.js → chunk-F3QTF4T7.js}

@@ -3,12 +3,12 @@ import {
   getClient,
   isInitialized,
   loadEmployees
-} from "./chunk-U7I4YINB.js";
+} from "./chunk-EA5FVACM.js";
 import {
   PLAN_LIMITS,
   checkLicense,
   isFeatureAllowed
-} from "./chunk-6VUMFHWB.js";
+} from "./chunk-2OVTGZYH.js";
 import {
   EXE_AI_DIR
 } from "./chunk-BCZF3AGJ.js";

package/dist/{chunk-VI4LQLD2.js → chunk-FASR2WLT.js}

@@ -1,6 +1,6 @@
 import {
   sessionScopeFilter
-} from "./chunk-IR6CEBWC.js";
+} from "./chunk-74R44E4S.js";
 import {
   leaseExpiryIso
 } from "./chunk-E23LNUWJ.js";

package/dist/{chunk-ELGZDMXM.js → chunk-G2KK64UB.js}

@@ -1,10 +1,10 @@
 import {
   sendIntercom,
   updateTaskStatus
-} from "./chunk-IR6CEBWC.js";
+} from "./chunk-74R44E4S.js";
 import {
   recordOrchestrationEventBestEffort
-} from "./chunk-6ZUHNYAB.js";
+} from "./chunk-POZGQQEZ.js";
 import {
   BUSY_PATTERN
 } from "./chunk-OSKWCKUC.js";
@@ -12,7 +12,7 @@ import {
   baseAgentName,
   getCoordinatorName,
   isCoordinatorName
-} from "./chunk-U7I4YINB.js";
+} from "./chunk-EA5FVACM.js";
 
 // src/lib/play-mode.ts
 import { readFileSync, writeFileSync, mkdirSync, existsSync } from "fs";
@@ -305,7 +305,7 @@ async function surfaceStaleDispatchPendingSignals(scopeList, now, thresholdMs =
     const sessionScope = signalScope ?? (scopeList.length === 1 ? scopeList[0] : null);
     if (allowedScopes.size > 0 && sessionScope && !allowedScopes.has(sessionScope)) continue;
     try {
-      const { writeNotification } = await import("./notifications-MCJFLBAO.js");
+      const { writeNotification } = await import("./notifications-74YECZ4V.js");
       await writeNotification({
         agentId: getCoordinatorName(),
         agentRole: "COO",

package/dist/{chunk-ZANQKOBC.js → chunk-G37RG543.js}

@@ -2,7 +2,7 @@ import {
   getGitRoot,
   isWorktreeDirty,
   isWorktreeDirtyAsync
-} from "./chunk-Q5AFCR57.js";
+} from "./chunk-XV42EAVK.js";
 
 // src/lib/worktree-sweep.ts
 import { execFile } from "child_process";