@askexenow/exe-os 0.9.359 → 0.9.361

package/dist/{chunk-5UAMBMNR.js → chunk-RO326K57.js}

@@ -3,7 +3,7 @@ import {
 } from "./chunk-SSC7EKY2.js";
 import {
   inventoryLocalSecretResidue
-} from "./chunk-EHM4E62N.js";
+} from "./chunk-6DTALXOA.js";
 import {
   CC_NATIVE_ONLY_CUTOFF,
   compareSemver,
@@ -12,13 +12,16 @@ import {
 import {
   readMcpHttpEvents,
   summarizeMcpTransport
-} from "./chunk-ITRKRKS7.js";
+} from "./chunk-RFKRCVGW.js";
 import {
   mcpHttpPort
-} from "./chunk-6EOLGE7T.js";
+} from "./chunk-5XEKQJE5.js";
+import {
+  inspectKeyCustodySync
+} from "./chunk-HPXFKUGU.js";
 import {
   EXE_AI_DIR
-} from "./chunk-BCZF3AGJ.js";
+} from "./chunk-BRIZ6OZ3.js";
 
 // src/bin/exe-healthcheck.ts
 import { existsSync, readFileSync, readdirSync } from "fs";
@@ -544,37 +547,44 @@ function checkLocalSecretResidue() {
     detail: `${inventory.residues.length} plaintext secret residue file(s) detected: ${shown}${inventory.residues.length > 3 ? " ..." : ""}. Vault needed secrets, then run: exe-os doctor --delete-local-secret-residue`
   }];
 }
-function checkKeyStorageFallback() {
-  const keyPath = path.join(EXE_AI_DIR, "master.key");
-  if (!existsSync(keyPath)) {
-    return [{ name: "security/key-storage", pass: true, detail: "No master.key file fallback detected (expected when OS keychain owns the key)" }];
-  }
-  let first = "";
-  try {
-    first = readFileSync(keyPath, "utf8").slice(0, 4);
-  } catch {
-    return [{ name: "security/key-storage", pass: false, detail: `master.key exists but is not readable: ${keyPath}` }];
-  }
-  const saltPath = path.join(EXE_AI_DIR, ".machine-key-salt");
-  if (first === "enc:" && existsSync(saltPath)) {
-    return [{
-      name: "security/key-storage",
-      pass: false,
-      detail: `\u{1F7E0} Key is using salted encrypted file fallback at ${keyPath}; migrate to OS keychain when available`
-    }];
-  }
-  if (first === "enc:") {
-    return [{
-      name: "security/key-storage",
-      pass: false,
-      detail: `\u{1F534} Key is using legacy deterministic encrypted file fallback at ${keyPath}; run exe-os key status or exe-os setup to re-migrate/rewrite with salt`
-    }];
+function checkKeyStorageFallback(custody = inspectKeyCustodySync()) {
+  const name = "security/key-storage";
+  switch (custody.kind) {
+    case "macos-keychain":
+    case "linux-secret-service":
+      if (custody.staleKeyFile) {
+        return [{
+          name,
+          pass: false,
+          detail: `\u{1F7E0} ${custody.note}. Two copies of the key exist; the file is machine-bound only and any local process can read the material it is derived from. Remove it once you have confirmed the keychain copy works: ${custody.staleKeyFile}`
+        }];
+      }
+      return [{ name, pass: true, detail: `\u{1F7E2} OS keychain owns the master key (${custody.note})` }];
+    case "refused":
+      return [{
+        name,
+        pass: false,
+        detail: `\u{1F534} Key custody UNKNOWN \u2014 ${custody.note}`
+      }];
+    case "missing":
+      return [{
+        name,
+        pass: true,
+        detail: `\u{1F7E0} No master key found yet \u2014 ${custody.note}. Run exe-os setup if this install should hold a key.`
+      }];
+    case "plaintext-file":
+      return [{
+        name,
+        pass: false,
+        detail: `\u{1F534} ${custody.note}; run exe-os key status or exe-os setup to migrate/encrypt it`
+      }];
+    default:
+      return [{
+        name,
+        pass: false,
+        detail: `\u{1F7E0} ${custody.note}`
+      }];
   }
-  return [{
-    name: "security/key-storage",
-    pass: false,
-    detail: `\u{1F534} Key is stored in plaintext file fallback at ${keyPath}; run exe-os key status or exe-os setup to migrate/encrypt it`
-  }];
 }
 var HEALTHCHECK_CHILD_ENV = "EXE_HEALTHCHECK_CHILD";
 var DEFAULT_HEALTHCHECK_TIMEOUT_MS = 3e4;

package/dist/{chunk-JBAMYKBL.js → chunk-SSZIGWIG.js}

@@ -1,6 +1,6 @@
 import {
   getClient
-} from "./chunk-EA5FVACM.js";
+} from "./chunk-ESGLOI6Q.js";
 
 // src/lib/boot-generation.ts
 var SYNC_META_KEY = "daemon_boot_generation";

package/dist/{chunk-2I23RPSI.js → chunk-TKDITWDN.js}

@@ -1,8 +1,17 @@
+import {
+  isRefusedQuarantinePath
+} from "./chunk-JKKZGDLP.js";
+
 // src/lib/db-path-guard.ts
 function assertValidDbPath(dbPath, caller) {
   if (typeof dbPath !== "string" || dbPath.trim().length === 0) {
     throw new Error(`${caller}: dbPath is required; refusing to open SQLite at an empty/undefined path`);
   }
+  if (isRefusedQuarantinePath(dbPath)) {
+    throw new Error(
+      `${caller}: refusing to open a database at ${dbPath} \u2014 exe-os could not resolve an install belonging to this user. Run as the user that owns the install, or set EXE_OS_DIR explicitly.`
+    );
+  }
   const trimmed = dbPath.trim();
   if (trimmed === "undefined" || trimmed === "null" || trimmed === "file:undefined" || trimmed === "file:null") {
     throw new Error(`${caller}: dbPath is ${JSON.stringify(trimmed)}; refusing to create stray SQLite files`);

package/dist/{chunk-VCCZQDCU.js → chunk-U32RDCUB.js}

@@ -9,17 +9,17 @@ import {
 import {
   buildClaudeHttpMcpEntry,
   buildClaudeStdioProxyMcpEntry
-} from "./chunk-6EOLGE7T.js";
+} from "./chunk-5XEKQJE5.js";
 import {
   ensureAllAgentSymlinks
-} from "./chunk-CAEWPEBA.js";
+} from "./chunk-W6J25BU7.js";
 import {
   MCP_LEGACY_KEY,
   MCP_PRIMARY_KEY
 } from "./chunk-HYZV25LY.js";
 import {
   loadConfigSync
-} from "./chunk-BCZF3AGJ.js";
+} from "./chunk-BRIZ6OZ3.js";
 
 // src/adapters/claude/installer.ts
 import { readFile, writeFile, mkdir, readdir, rm } from "fs/promises";

package/dist/{chunk-OIS5VIAH.js → chunk-UWEFIIEG.js}

@@ -1,12 +1,12 @@
 import {
   assertValidDbPath
-} from "./chunk-2I23RPSI.js";
+} from "./chunk-TKDITWDN.js";
 import {
   recordDbOpen
 } from "./chunk-5YEUPUV4.js";
 import {
   EXE_AI_DIR
-} from "./chunk-BCZF3AGJ.js";
+} from "./chunk-BRIZ6OZ3.js";
 
 // src/lib/shard-manager.ts
 import path from "path";
@@ -301,6 +301,10 @@ async function ensureShardSchema(client) {
     "ALTER TABLE memories ADD COLUMN consolidated INTEGER NOT NULL DEFAULT 0",
     "ALTER TABLE memories ADD COLUMN author_device_id TEXT",
     "ALTER TABLE memories ADD COLUMN scope TEXT NOT NULL DEFAULT 'business'",
+    // Org Partner §4.1 — must match database.ts, or a sharded install would
+    // hand the scoped-query chokepoint rows with no visibility column at all.
+    "ALTER TABLE memories ADD COLUMN visibility TEXT NOT NULL DEFAULT 'private'",
+    "ALTER TABLE memories ADD COLUMN origin_org_id TEXT",
     "ALTER TABLE memories ADD COLUMN importance INTEGER DEFAULT 5",
     "ALTER TABLE memories ADD COLUMN status TEXT DEFAULT 'active'",
     "ALTER TABLE memories ADD COLUMN wiki_synced INTEGER DEFAULT 0",

package/dist/{chunk-LPKTGK7L.js → chunk-V3ORKXAU.js}

@@ -1,17 +1,17 @@
 import {
   updateTask
-} from "./chunk-2EAYZ3BK.js";
+} from "./chunk-A4EPO6F3.js";
 import {
   TASK_ALREADY_CLAIMED_PREFIX,
   TASK_CLAIM_NOT_HELD_PREFIX,
   TASK_SIDECHAIN_WRITE_BLOCKED_PREFIX
-} from "./chunk-74R44E4S.js";
+} from "./chunk-VGWGXAHT.js";
 import {
   getAgentContext
 } from "./chunk-GJV3WDWM.js";
 import {
   isCoordinatorName
-} from "./chunk-EA5FVACM.js";
+} from "./chunk-ESGLOI6Q.js";
 
 // src/mcp/tools/update-task.ts
 import { z } from "zod";
@@ -72,7 +72,7 @@ function registerUpdateTask(server) {
       let callerSession;
       let callerIsSidechain = false;
       try {
-        const { getActiveAgent: getAgent } = await import("./active-agent-Y3DCBD7J.js");
+        const { getActiveAgent: getAgent } = await import("./active-agent-5RXOXM47.js");
         const active = getAgent();
         callerAgentId = active.agentId;
         callerSession = resolveCallerSessionForUpdate();

package/dist/{chunk-WCP4OQUL.js → chunk-V6T42AQN.js}

@@ -3,11 +3,11 @@ import {
 } from "./chunk-75H4R62K.js";
 import {
   initStore
-} from "./chunk-W5YV2PZE.js";
+} from "./chunk-GWBD5P7E.js";
 import {
   getClient,
   isInitialized
-} from "./chunk-EA5FVACM.js";
+} from "./chunk-ESGLOI6Q.js";
 
 // src/lib/schedules.ts
 import crypto from "crypto";

package/dist/chunk-VAOUB2TK.js

@@ -0,0 +1,23 @@
+import {
+  EXE_AI_DIR
+} from "./chunk-BRIZ6OZ3.js";
+
+// src/internal/data-dir.ts
+import path from "path";
+function resolveExeDataDir() {
+  return process.env.EXE_OS_DIR ?? process.env.EXE_MEM_DIR ?? EXE_AI_DIR;
+}
+function assertGateAndGrantsColocated(gateFilePath, grantsFilePath) {
+  const a = path.resolve(path.dirname(gateFilePath));
+  const b = path.resolve(path.dirname(grantsFilePath));
+  if (a !== b) {
+    throw new Error(
+      `Data-dir split detected: org-mode gate resolves to "${a}" but monitoring grants resolve to "${b}". Refusing to seal \u2014 the gate must read from the same directory as the grants it protects against.`
+    );
+  }
+}
+
+export {
+  resolveExeDataDir,
+  assertGateAndGrantsColocated
+};

package/dist/{chunk-4WSUP4CC.js → chunk-VEGTALBX.js}

@@ -1,11 +1,11 @@
-import {
-  formatDegradations,
-  getRetrievalHealth
-} from "./chunk-YKRNH5LU.js";
 import {
   buildRestartReport,
   formatRestartReport
 } from "./chunk-R7F6HKTH.js";
+import {
+  formatDegradations,
+  getRetrievalHealth
+} from "./chunk-VQWRRXBD.js";
 import {
   EXE_HOOK_MANIFEST,
   LEGACY_SPLIT_POST_TOOL_HOOK_MARKERS,
@@ -14,13 +14,13 @@ import {
 import {
   cleanupLocalSecretResidue,
   inventoryLocalSecretResidue
-} from "./chunk-EHM4E62N.js";
+} from "./chunk-6DTALXOA.js";
 import {
   blobToVector
 } from "./chunk-OTVEIJUQ.js";
 import {
   offloadReadIfMain
-} from "./chunk-EA5FVACM.js";
+} from "./chunk-ESGLOI6Q.js";
 import {
   isMainModule
 } from "./chunk-6Y4B3QF6.js";
@@ -648,7 +648,7 @@ function auditHookOwnership() {
 }
 async function auditShards() {
   try {
-    const { auditShardHealth } = await import("./shard-manager-DFLCDZT5.js");
+    const { auditShardHealth } = await import("./shard-manager-YEOHEOHL.js");
     const report = await auditShardHealth();
     return {
       total: report.total,
@@ -666,7 +666,7 @@ async function auditShards() {
 async function auditKeyHealth() {
   try {
     const { getMasterKey, getKeyStorageInfo } = await import("./lib/keychain.js");
-    const { getKeyBackupStatus } = await import("./key-backup-status-YMS7YGWO.js");
+    const { getKeyBackupStatus } = await import("./key-backup-status-3RC6XTUX.js");
     const [key, storage] = await Promise.all([getMasterKey(), getKeyStorageInfo()]);
     const backup = getKeyBackupStatus();
     return {
@@ -1023,7 +1023,7 @@ function formatReport(report, flags) {
   return lines.join("\n");
 }
 async function fixNullVectors() {
-  const { tryAcquireWorkerSlot, registerWorkerPid } = await import("./worker-gate-52MVKYGZ.js");
+  const { tryAcquireWorkerSlot, registerWorkerPid } = await import("./worker-gate-UEBG2QLF.js");
   if (!tryAcquireWorkerSlot()) {
     process.stderr.write("[exe-doctor] Worker gate full \u2014 waiting for existing backfill workers to finish\n");
     await new Promise((r) => setTimeout(r, 5e3));
@@ -1137,7 +1137,7 @@ function shouldFixShards(shards) {
   return shards.unreadable > 0 || shards.schemaMismatches > 0;
 }
 async function fixShards(dryRun) {
-  const { auditShardHealth } = await import("./shard-manager-DFLCDZT5.js");
+  const { auditShardHealth } = await import("./shard-manager-YEOHEOHL.js");
   const report = await auditShardHealth({ repair: true, dryRun });
   return {
     total: report.total,
@@ -1209,7 +1209,7 @@ async function main(argv = process.argv.slice(2)) {
     console.log(formatRestartReport(restartReport));
     return emptyAuditReport();
   }
-  const { fastDbInit } = await import("./fast-db-init-6H67K76Q.js");
+  const { fastDbInit } = await import("./fast-db-init-YZNPKBNX.js");
   const client = await fastDbInit();
   const report = await runAudit(client, flags);
   console.log(formatReport(report, flags));

package/dist/{chunk-AL7JMA54.js → chunk-VEJKY5I6.js}

@@ -1,11 +1,11 @@
 import {
   ingest
-} from "./chunk-NKDKB2RT.js";
+} from "./chunk-PK5ATL23.js";
 import {
   listWorkflowDefinitions,
   runWorkflow,
   startWorkflow
-} from "./chunk-44WFVMZ5.js";
+} from "./chunk-6KVG6RTP.js";
 import {
   initCRMBridge
 } from "./chunk-ML4S5SHZ.js";