@askexenow/exe-os 0.9.359 → 0.9.362

package/dist/{chunk-2I23RPSI.js → chunk-TKDITWDN.js}

@@ -1,8 +1,17 @@
+import {
+  isRefusedQuarantinePath
+} from "./chunk-JKKZGDLP.js";
+
 // src/lib/db-path-guard.ts
 function assertValidDbPath(dbPath, caller) {
   if (typeof dbPath !== "string" || dbPath.trim().length === 0) {
     throw new Error(`${caller}: dbPath is required; refusing to open SQLite at an empty/undefined path`);
   }
+  if (isRefusedQuarantinePath(dbPath)) {
+    throw new Error(
+      `${caller}: refusing to open a database at ${dbPath} \u2014 exe-os could not resolve an install belonging to this user. Run as the user that owns the install, or set EXE_OS_DIR explicitly.`
+    );
+  }
   const trimmed = dbPath.trim();
   if (trimmed === "undefined" || trimmed === "null" || trimmed === "file:undefined" || trimmed === "file:null") {
     throw new Error(`${caller}: dbPath is ${JSON.stringify(trimmed)}; refusing to create stray SQLite files`);

package/dist/{chunk-5UAMBMNR.js → chunk-TN2E6ZCM.js}

@@ -3,7 +3,7 @@ import {
 } from "./chunk-SSC7EKY2.js";
 import {
   inventoryLocalSecretResidue
-} from "./chunk-EHM4E62N.js";
+} from "./chunk-6DTALXOA.js";
 import {
   CC_NATIVE_ONLY_CUTOFF,
   compareSemver,
@@ -12,13 +12,16 @@ import {
 import {
   readMcpHttpEvents,
   summarizeMcpTransport
-} from "./chunk-ITRKRKS7.js";
+} from "./chunk-RFKRCVGW.js";
 import {
   mcpHttpPort
-} from "./chunk-6EOLGE7T.js";
+} from "./chunk-CVYDJ2TW.js";
+import {
+  inspectKeyCustodySync
+} from "./chunk-HPXFKUGU.js";
 import {
   EXE_AI_DIR
-} from "./chunk-BCZF3AGJ.js";
+} from "./chunk-BRIZ6OZ3.js";
 
 // src/bin/exe-healthcheck.ts
 import { existsSync, readFileSync, readdirSync } from "fs";
@@ -544,37 +547,44 @@ function checkLocalSecretResidue() {
     detail: `${inventory.residues.length} plaintext secret residue file(s) detected: ${shown}${inventory.residues.length > 3 ? " ..." : ""}. Vault needed secrets, then run: exe-os doctor --delete-local-secret-residue`
   }];
 }
-function checkKeyStorageFallback() {
-  const keyPath = path.join(EXE_AI_DIR, "master.key");
-  if (!existsSync(keyPath)) {
-    return [{ name: "security/key-storage", pass: true, detail: "No master.key file fallback detected (expected when OS keychain owns the key)" }];
-  }
-  let first = "";
-  try {
-    first = readFileSync(keyPath, "utf8").slice(0, 4);
-  } catch {
-    return [{ name: "security/key-storage", pass: false, detail: `master.key exists but is not readable: ${keyPath}` }];
-  }
-  const saltPath = path.join(EXE_AI_DIR, ".machine-key-salt");
-  if (first === "enc:" && existsSync(saltPath)) {
-    return [{
-      name: "security/key-storage",
-      pass: false,
-      detail: `\u{1F7E0} Key is using salted encrypted file fallback at ${keyPath}; migrate to OS keychain when available`
-    }];
-  }
-  if (first === "enc:") {
-    return [{
-      name: "security/key-storage",
-      pass: false,
-      detail: `\u{1F534} Key is using legacy deterministic encrypted file fallback at ${keyPath}; run exe-os key status or exe-os setup to re-migrate/rewrite with salt`
-    }];
+function checkKeyStorageFallback(custody = inspectKeyCustodySync()) {
+  const name = "security/key-storage";
+  switch (custody.kind) {
+    case "macos-keychain":
+    case "linux-secret-service":
+      if (custody.staleKeyFile) {
+        return [{
+          name,
+          pass: false,
+          detail: `\u{1F7E0} ${custody.note}. Two copies of the key exist; the file is machine-bound only and any local process can read the material it is derived from. Remove it once you have confirmed the keychain copy works: ${custody.staleKeyFile}`
+        }];
+      }
+      return [{ name, pass: true, detail: `\u{1F7E2} OS keychain owns the master key (${custody.note})` }];
+    case "refused":
+      return [{
+        name,
+        pass: false,
+        detail: `\u{1F534} Key custody UNKNOWN \u2014 ${custody.note}`
+      }];
+    case "missing":
+      return [{
+        name,
+        pass: true,
+        detail: `\u{1F7E0} No master key found yet \u2014 ${custody.note}. Run exe-os setup if this install should hold a key.`
+      }];
+    case "plaintext-file":
+      return [{
+        name,
+        pass: false,
+        detail: `\u{1F534} ${custody.note}; run exe-os key status or exe-os setup to migrate/encrypt it`
+      }];
+    default:
+      return [{
+        name,
+        pass: false,
+        detail: `\u{1F7E0} ${custody.note}`
+      }];
   }
-  return [{
-    name: "security/key-storage",
-    pass: false,
-    detail: `\u{1F534} Key is stored in plaintext file fallback at ${keyPath}; run exe-os key status or exe-os setup to migrate/encrypt it`
-  }];
 }
 var HEALTHCHECK_CHILD_ENV = "EXE_HEALTHCHECK_CHILD";
 var DEFAULT_HEALTHCHECK_TIMEOUT_MS = 3e4;

package/dist/{chunk-SQBNN44X.js → chunk-TP7RXGMP.js}

@@ -1,13 +1,14 @@
 import {
   isPaneBusy
-} from "./chunk-G2KK64UB.js";
+} from "./chunk-PDJWHL63.js";
 import {
   recordSessionKill
-} from "./chunk-XVTKJEI2.js";
+} from "./chunk-VDMFVUSY.js";
 import {
   updateTask
-} from "./chunk-2EAYZ3BK.js";
+} from "./chunk-7H3AZNQ7.js";
 import {
+  BUSY_PATTERN,
   countPendingReviews,
   ensureEmployeeAsync,
   extractRootExe,
@@ -22,14 +23,14 @@ import {
   sessionScopeFilter,
   strictSessionScopeFilter,
   writeNotification
-} from "./chunk-74R44E4S.js";
+} from "./chunk-SQM4ZTL2.js";
 import {
   LEASE_MINUTES,
   isLeaseExpired
 } from "./chunk-E23LNUWJ.js";
 import {
   listSessions
-} from "./chunk-3ODATKWH.js";
+} from "./chunk-D5CY4E7I.js";
 import {
   getTransport
 } from "./chunk-UXLO7VHX.js";
@@ -38,10 +39,10 @@ import {
   listTmuxSessions,
   parseContextPercentage,
   parseContextPercentageAsync
-} from "./chunk-SKGMF2SO.js";
+} from "./chunk-GBNB4EWD.js";
 import {
   recordOrchestrationEventBestEffort
-} from "./chunk-POZGQQEZ.js";
+} from "./chunk-PV5BIXT6.js";
 import {
   checkDispatchStatus,
   readTerminalLauncherFailure,
@@ -50,22 +51,19 @@ import {
 } from "./chunk-AJIXH5JF.js";
 import {
   getAgentRuntime
-} from "./chunk-VAY6IXWY.js";
-import {
-  BUSY_PATTERN
-} from "./chunk-OSKWCKUC.js";
+} from "./chunk-KDMVVHZH.js";
 import {
   baseAgentName,
   getCoordinatorName,
   isCoordinatorName,
   shouldAutoInstance
-} from "./chunk-EA5FVACM.js";
+} from "./chunk-HLU52KTO.js";
 import {
   eventLoopBlockedMarkerPath
 } from "./chunk-JY5GAZYC.js";
 import {
   loadConfigSync
-} from "./chunk-BCZF3AGJ.js";
+} from "./chunk-BRIZ6OZ3.js";
 
 // src/lib/daemon-orchestration.ts
 import { execFile, execFileSync, execSync } from "child_process";
@@ -1755,6 +1753,27 @@ async function releaseStuckTasks(deps, nowMs = Date.now()) {
           continue;
         }
       }
+      if (t.claimedSession && deps.confirmClaimedSessionAlive) {
+        let stillAlive = false;
+        try {
+          stillAlive = await deps.confirmClaimedSessionAlive(t.claimedSession);
+        } catch {
+          stillAlive = false;
+        }
+        if (stillAlive) {
+          process.stderr.write(
+            `[stuck-release] Task ${t.taskId} (${t.agentId}) \u2014 claimed session ${t.claimedSession} is LIVE per direct has-session probe (cached list was stale); NOT fabricating a dead-session abandon. Deferring.
+`
+          );
+          if (deps.notifyOrphan) {
+            try {
+              await deps.notifyOrphan(t.taskId, t.agentId, t.sessionScope);
+            } catch {
+            }
+          }
+          continue;
+        }
+      }
       const abandonReason = leaseExpired ? `Abandoned: agent "${t.agentId}" task lease expired (${t.leaseExpiresAt}). Blocked for manual re-dispatch; any existing result is unverified evidence, not a completion.` : `Abandoned: agent "${t.agentId}" session ended (in_progress for ${ageMinutes}m, no live session). Blocked for manual re-dispatch; any existing result is unverified evidence, not a completion.`;
       try {
         if (!deps.markTaskAbandoned) {
@@ -1924,6 +1943,21 @@ function createStuckTaskRealDeps(getClient) {
         return false;
       }
     },
+    confirmClaimedSessionAlive: async (claimedSession) => {
+      if (!claimedSession) return false;
+      try {
+        const socket = process.env.EXE_TMUX_SOCKET;
+        const socketArgs = socket ? ["-L", socket] : [];
+        await execFileAsync(
+          "tmux",
+          [...socketArgs, "has-session", "-t", claimedSession],
+          { encoding: "utf8", timeout: 3e3 }
+        );
+        return true;
+      } catch {
+        return false;
+      }
+    },
     hasInFlightSubagentWork: async (task) => {
       if (!task.claimedSession) return false;
       try {
@@ -3194,7 +3228,7 @@ async function reapOrphanedWorktrees(deps, nowMs = Date.now()) {
 }
 async function createWorktreeReaperRealDeps() {
   const { getPaneCwdAsync } = await import("./lib/tmux-status.js");
-  const { getGitRootAsync, isWorktreeDirtyAsync } = await import("./worktree-NNVXVV6A.js");
+  const { getGitRootAsync, isWorktreeDirtyAsync } = await import("./worktree-ZWA35PKW.js");
   const { statSync: statSync3 } = await import("fs");
   const { basename: basename2 } = await import("path");
   const { promisify: promisify2 } = await import("util");
@@ -3425,7 +3459,7 @@ async function gcStaleCheckpoints() {
 }
 async function pollTaskGroupBarriers() {
   try {
-    const { checkAndFireBarriers } = await import("./tasks-crud-IWVDREXG.js");
+    const { checkAndFireBarriers } = await import("./tasks-crud-NVNF3NRA.js");
     const firedGroupIds = await checkAndFireBarriers();
     if (firedGroupIds.length === 0) return 0;
     const { getClient } = await import("./lib/database.js");

package/dist/{chunk-GSVQBBE5.js → chunk-TY4JLBFO.js}

@@ -3,13 +3,13 @@ import {
 } from "./chunk-3BAGFZFN.js";
 import {
   isGhostBehaviorRow
-} from "./chunk-6LY3QSJA.js";
+} from "./chunk-ZI3HA3XW.js";
 import {
   getClient,
   getIdentity,
   listIdentities,
   updateIdentity
-} from "./chunk-EA5FVACM.js";
+} from "./chunk-HLU52KTO.js";
 import {
   atomicWriteJsonSync
 } from "./chunk-HSGBZSCA.js";

package/dist/{chunk-7QRMFYOV.js → chunk-UHPMK6QZ.js}

@@ -1,6 +1,6 @@
 import {
   isPostgresBackendEnabled
-} from "./chunk-YMUZWC33.js";
+} from "./chunk-YYB5PMTK.js";
 
 // src/lib/db-write-worker-client.ts
 import { fork } from "child_process";
@@ -76,6 +76,7 @@ function spawnDbWriteWorker(dbPath, encryptionKey) {
     clearTimeout(cb.timer);
     if (msg.error) cb.reject(new Error(msg.error));
     else if (msg.memoryId) cb.resolve({ memoryId: msg.memoryId, version: msg.version, deduped: msg.deduped });
+    else if (typeof msg.deleted === "number") cb.resolve({ deleted: msg.deleted });
     else cb.reject(new Error("invalid write-worker response"));
   });
   _worker.on("error", (err) => {
@@ -95,7 +96,19 @@ function spawnDbWriteWorker(dbPath, encryptionKey) {
 function isDbWriteWorkerReady() {
   return _worker !== null && _workerReady;
 }
-function writeMemoryInWorker(payload) {
+async function writeMemoryInWorker(payload) {
+  const result = await sendWriteWorkerRequest({ type: "write-memory", ...payload });
+  if (!result.memoryId) throw new Error("invalid write-worker response");
+  return result;
+}
+async function sweepSessionEventsRetentionInWorker(retentionDays) {
+  const result = await sendWriteWorkerRequest({
+    type: "sweep-session-events-retention",
+    retentionDays
+  });
+  return { deleted: Number(result.deleted ?? 0) };
+}
+function sendWriteWorkerRequest(payload) {
   if (!_worker || !_workerReady) {
     return Promise.reject(new Error("db write worker not available"));
   }
@@ -107,7 +120,7 @@ function writeMemoryInWorker(payload) {
     }, WRITE_TIMEOUT_MS);
     _pending.set(id, { resolve, reject, timer });
     try {
-      _worker.send({ id, type: "write-memory", ...payload });
+      _worker.send({ id, ...payload });
     } catch (err) {
       _pending.delete(id);
       clearTimeout(timer);
@@ -136,6 +149,7 @@ export {
   spawnDbWriteWorker,
   isDbWriteWorkerReady,
   writeMemoryInWorker,
+  sweepSessionEventsRetentionInWorker,
   _getDbWriteWorkerForTests,
   disposeDbWriteWorker
 };

package/dist/{chunk-LPKTGK7L.js → chunk-UO5QJ2RX.js}

@@ -1,17 +1,17 @@
 import {
   updateTask
-} from "./chunk-2EAYZ3BK.js";
+} from "./chunk-7H3AZNQ7.js";
 import {
   TASK_ALREADY_CLAIMED_PREFIX,
   TASK_CLAIM_NOT_HELD_PREFIX,
   TASK_SIDECHAIN_WRITE_BLOCKED_PREFIX
-} from "./chunk-74R44E4S.js";
+} from "./chunk-SQM4ZTL2.js";
 import {
   getAgentContext
 } from "./chunk-GJV3WDWM.js";
 import {
   isCoordinatorName
-} from "./chunk-EA5FVACM.js";
+} from "./chunk-HLU52KTO.js";
 
 // src/mcp/tools/update-task.ts
 import { z } from "zod";
@@ -72,7 +72,7 @@ function registerUpdateTask(server) {
       let callerSession;
       let callerIsSidechain = false;
       try {
-        const { getActiveAgent: getAgent } = await import("./active-agent-Y3DCBD7J.js");
+        const { getActiveAgent: getAgent } = await import("./active-agent-BPNEBKHI.js");
         const active = getAgent();
         callerAgentId = active.agentId;
         callerSession = resolveCallerSessionForUpdate();

package/dist/{chunk-VCCZQDCU.js → chunk-URNVIZXU.js}

@@ -9,17 +9,17 @@ import {
 import {
   buildClaudeHttpMcpEntry,
   buildClaudeStdioProxyMcpEntry
-} from "./chunk-6EOLGE7T.js";
+} from "./chunk-CVYDJ2TW.js";
 import {
   ensureAllAgentSymlinks
-} from "./chunk-CAEWPEBA.js";
+} from "./chunk-5C6ZIJ7J.js";
 import {
   MCP_LEGACY_KEY,
   MCP_PRIMARY_KEY
 } from "./chunk-HYZV25LY.js";
 import {
   loadConfigSync
-} from "./chunk-BCZF3AGJ.js";
+} from "./chunk-BRIZ6OZ3.js";
 
 // src/adapters/claude/installer.ts
 import { readFile, writeFile, mkdir, readdir, rm } from "fs/promises";

package/dist/{chunk-OIS5VIAH.js → chunk-UWEFIIEG.js}

@@ -1,12 +1,12 @@
 import {
   assertValidDbPath
-} from "./chunk-2I23RPSI.js";
+} from "./chunk-TKDITWDN.js";
 import {
   recordDbOpen
 } from "./chunk-5YEUPUV4.js";
 import {
   EXE_AI_DIR
-} from "./chunk-BCZF3AGJ.js";
+} from "./chunk-BRIZ6OZ3.js";
 
 // src/lib/shard-manager.ts
 import path from "path";
@@ -301,6 +301,10 @@ async function ensureShardSchema(client) {
     "ALTER TABLE memories ADD COLUMN consolidated INTEGER NOT NULL DEFAULT 0",
     "ALTER TABLE memories ADD COLUMN author_device_id TEXT",
     "ALTER TABLE memories ADD COLUMN scope TEXT NOT NULL DEFAULT 'business'",
+    // Org Partner §4.1 — must match database.ts, or a sharded install would
+    // hand the scoped-query chokepoint rows with no visibility column at all.
+    "ALTER TABLE memories ADD COLUMN visibility TEXT NOT NULL DEFAULT 'private'",
+    "ALTER TABLE memories ADD COLUMN origin_org_id TEXT",
     "ALTER TABLE memories ADD COLUMN importance INTEGER DEFAULT 5",
     "ALTER TABLE memories ADD COLUMN status TEXT DEFAULT 'active'",
     "ALTER TABLE memories ADD COLUMN wiki_synced INTEGER DEFAULT 0",

package/dist/{chunk-IQWAYXVF.js → chunk-V5I5N7NC.js}

@@ -1,21 +1,21 @@
 import {
   cleanupCardsForMemories,
   cleanupGraphLinksForMemories
-} from "./chunk-HK7SQDKJ.js";
+} from "./chunk-RNSAVQEU.js";
 import {
   resolveAnthropicAuth
 } from "./chunk-VGMACSEV.js";
 import {
   buildSystemStateExclusionFilter,
   vectorToBlob
-} from "./chunk-W5YV2PZE.js";
+} from "./chunk-DKRDU2AX.js";
 import {
   extractKeywords,
   keywordsToString
 } from "./chunk-CHCA3ZM2.js";
 import {
   isCoordinatorName
-} from "./chunk-EA5FVACM.js";
+} from "./chunk-HLU52KTO.js";
 
 // src/lib/consolidation.ts
 import { randomUUID } from "crypto";