@askexenow/exe-os 0.9.362 → 0.9.365

package/deploy/stack-manifests/v0.9.json

@@ -1,6 +1,6 @@
 {
   "schemaVersion": 1,
-  "latest": "0.9.33",
+  "latest": "0.9.35",
   "stacks": {
     "0.9.0": {
       "version": "0.9.0",
@@ -2459,11 +2459,241 @@
         }
       },
       "rolloutStage": "ga"
+    },
+    "0.9.34": {
+      "version": "0.9.34",
+      "releasedAt": "2026-08-10T07:05:25Z",
+      "notes": "Monitor UID-1001 runtime regression fix (exe-monitor PR #25, squash-merged d6585d22; images built from PR commit 10660eb4, verified live against a 1001-owned volume). Bumps exe-monitor-hub + exe-monitor-agent digests only; gitSha pins the image-label commit 10660eb4 (provenance ancestry break-glass: PR commit squash-merged to main). ERP queue/scheduler healthcheck fix ships compose-only via exe-os #580 (VPS CLI 0.9.362) — erp IMAGE unchanged from 0.9.33. All other pins identical to 0.9.33. Founder-approved GO 2026-08-10.",
+      "npmVersion": "0.9.324",
+      "services": {
+        "exe-db": {
+          "image": "update.askexe.com/askexe/pgvector:0.8.0-pg16@sha256:a132765ec351c65111b5b675928a3a0515a466a40f97277329db8b8209ad8bc9",
+          "env": "EXE_DB_IMAGE",
+          "composeService": "exe-db",
+          "required": true,
+          "category": "core",
+          "description": "Postgres (pgvector) — digest-pinned (bug 32d6e02f; was tag-only in 0.9.25, regressed from 0.9.24)"
+        },
+        "exe-os": {
+          "image": "update.askexe.com/askexe/exe-os:v0.9.324@sha256:3ce6406e0f7f279ff2568bbbb7d55de51a46fdf35c49691f24fd959d6fd2d3fa",
+          "env": "EXE_OS_IMAGE_TAG",
+          "composeService": "exe-os",
+          "healthUrl": "http://127.0.0.1:8765/health",
+          "required": true,
+          "category": "core",
+          "description": "exe-os daemon + MCP server"
+        },
+        "crm": {
+          "image": "update.askexe.com/askexe/exe-crm:v0.9.53@sha256:a586dcc8bbd992538e3caa18c44e772d30f31155dfef0a2b7466ca3fc7c553d8",
+          "env": "CRM_IMAGE_TAG",
+          "composeService": "exe-crm",
+          "healthUrl": "http://127.0.0.1:3000/healthz",
+          "category": "app"
+        },
+        "wiki": {
+          "image": "update.askexe.com/askexe/exe-wiki:v0.9.28@sha256:61856a4c6b97ce62c62ecdc3a377139287be5860eb807d9fbb737115758d7856",
+          "env": "WIKI_IMAGE_TAG",
+          "composeService": "exe-wiki",
+          "healthUrl": "http://127.0.0.1:3001/api/ping",
+          "category": "app"
+        },
+        "gateway": {
+          "image": "update.askexe.com/askexe/exe-gateway:v2026.08.07-c15f093-stamped@sha256:1bc11a2a0ad1f3929d59d2685696f22a72042b9fca9c75e15c02dc7d3c640105",
+          "env": "GATEWAY_IMAGE_TAG",
+          "composeService": "exe-gateway",
+          "healthUrl": "http://127.0.0.1:3100/health",
+          "category": "app",
+          "description": "WhatsApp/messaging gateway — provenance-stamped rebuild of main (outbound message persistence fix); pinned by digest, dated immutable tag.",
+          "gitSha": "c15f093a0f59730bd5c2c73791ff77059dfa7cc1"
+        },
+        "monitorAgent": {
+          "image": "update.askexe.com/askexe/exe-monitor-agent:v2026.08.09-10660eb4-stamped@sha256:29fbd445f79484df04f000603e4ff445e76f0380f86d687a0033e3a0ef7d1b7a",
+          "env": "MONITOR_AGENT_IMAGE_TAG",
+          "composeService": "exe-monitor-agent",
+          "category": "monitoring",
+          "gitSha": "10660eb4abdeffbcba2aad13549aa58e208ac7a3"
+        },
+        "monitorHub": {
+          "image": "update.askexe.com/askexe/exe-monitor-hub:v2026.08.09-10660eb4-stamped@sha256:c9a9218c2713b8dffea7e1cf8c0702a614657d311a7a4e821c6a543bab29bb97",
+          "env": "MONITOR_HUB_IMAGE_TAG",
+          "composeService": "exe-monitor-hub",
+          "healthUrl": "http://127.0.0.1:8090/api/health",
+          "category": "monitoring",
+          "gitSha": "10660eb4abdeffbcba2aad13549aa58e208ac7a3"
+        },
+        "auth": {
+          "image": "update.askexe.com/askexe/exe-auth:v0.4.0@sha256:d92b50e812ca3dbd5e3a828be3cdd7a7b73967f00f53640f09288d44a8ea1716",
+          "env": "AUTH_IMAGE_TAG",
+          "composeService": "exe-auth",
+          "healthUrl": "http://127.0.0.1:3300/api/health",
+          "category": "auth",
+          "description": "Corrects the 0.9.29 exe-auth downgrade regression to v0.1.0; pins v0.3.0 (bug 5f5b4795).",
+          "gitSha": "72475df3d19f9614897910bae90550a414604954"
+        },
+        "erp": {
+          "image": "update.askexe.com/askexe/exe-erp:v2026.08.07-d185286-stamped@sha256:1c655f3f7819c797afd13c79561354f0276cf337403f32aee3e406a497e8827b",
+          "env": "ERP_IMAGE_TAG",
+          "composeService": "exe-erp",
+          "healthUrl": "http://127.0.0.1:8069/api/method/ping",
+          "healthHost": "localhost",
+          "required": false,
+          "category": "app",
+          "description": "Enterprise Resource Planning",
+          "gitSha": "d185286873dcfa11e4b3f9672c4e23efea240cc5"
+        },
+        "gotrue": {
+          "image": "update.askexe.com/askexe/gotrue:v2.172.1@sha256:b0dd7aa28dd1f9a8bd31f136c8b912661f701d9b863171e5843cb08f18f49de4",
+          "composeService": "gotrue",
+          "healthUrl": "http://127.0.0.1:9999/health",
+          "category": "infra"
+        },
+        "redis": {
+          "image": "update.askexe.com/askexe/redis:7.4-alpine@sha256:6ab0b6e7381779332f97b8ca76193e45b0756f38d4c0dcda72dbb3c32061ab99",
+          "composeService": "redis",
+          "category": "infra"
+        },
+        "clickhouse": {
+          "image": "update.askexe.com/askexe/clickhouse-server:24.8.4.13-alpine@sha256:88a45f9e328549b2579256c46ee38e5c0e25ae58303d9eb6d9c7ed8d6d2bbf3c",
+          "composeService": "clickhouse",
+          "category": "infra"
+        },
+        "cloudflared": {
+          "image": "update.askexe.com/askexe/cloudflared:2026-07@sha256:ba461b8aa9c042156dbd39c38657fe7431bafa063220eab8d5330a523863da9f",
+          "composeService": "cloudflared",
+          "category": "infra"
+        },
+        "exe-sso-edge": {
+          "image": "update.askexe.com/askexe/nginx:alpine@sha256:20316569d8f81a160065d7d2a5eeffc7ca97d79022462ee255fd23fa103a6b5c",
+          "composeService": "exe-sso-edge",
+          "category": "infra"
+        },
+        "exe-otel-collector": {
+          "image": "update.askexe.com/askexe/otel-collector-contrib:0.114.0@sha256:37fa87091cfaaec7234a27e4e395a40c31c2bfaea97a349a4afef6d9e9681197",
+          "composeService": "exe-otel-collector",
+          "category": "infra"
+        }
+      },
+      "rolloutStage": "ga"
+    },
+    "0.9.35": {
+      "version": "0.9.35",
+      "releasedAt": "2026-08-13T00:16:05Z",
+      "notes": "exe-auth v0.5.0 — the shared SSO login page is now one front door with one identity: the logo reads EXE INTELLIGENCE regardless of which product bounced the visitor here (?product= no longer rebrands it), configurable per-deploy via AUTH_BRAND_NAME. Includes the brand-word escaping fix (every '<' encoded for the JS/HTML context) so a white-label value can never break the login page. Bumps the auth image digest ONLY; every other pin is identical to 0.9.34. Founder-approved GO 2026-08-12.",
+      "npmVersion": "0.9.324",
+      "services": {
+        "exe-db": {
+          "image": "update.askexe.com/askexe/pgvector:0.8.0-pg16@sha256:a132765ec351c65111b5b675928a3a0515a466a40f97277329db8b8209ad8bc9",
+          "env": "EXE_DB_IMAGE",
+          "composeService": "exe-db",
+          "required": true,
+          "category": "core",
+          "description": "Postgres (pgvector) — digest-pinned (bug 32d6e02f; was tag-only in 0.9.25, regressed from 0.9.24)"
+        },
+        "exe-os": {
+          "image": "update.askexe.com/askexe/exe-os:v0.9.324@sha256:3ce6406e0f7f279ff2568bbbb7d55de51a46fdf35c49691f24fd959d6fd2d3fa",
+          "env": "EXE_OS_IMAGE_TAG",
+          "composeService": "exe-os",
+          "healthUrl": "http://127.0.0.1:8765/health",
+          "required": true,
+          "category": "core",
+          "description": "exe-os daemon + MCP server"
+        },
+        "crm": {
+          "image": "update.askexe.com/askexe/exe-crm:v0.9.53@sha256:a586dcc8bbd992538e3caa18c44e772d30f31155dfef0a2b7466ca3fc7c553d8",
+          "env": "CRM_IMAGE_TAG",
+          "composeService": "exe-crm",
+          "healthUrl": "http://127.0.0.1:3000/healthz",
+          "category": "app"
+        },
+        "wiki": {
+          "image": "update.askexe.com/askexe/exe-wiki:v0.9.28@sha256:61856a4c6b97ce62c62ecdc3a377139287be5860eb807d9fbb737115758d7856",
+          "env": "WIKI_IMAGE_TAG",
+          "composeService": "exe-wiki",
+          "healthUrl": "http://127.0.0.1:3001/api/ping",
+          "category": "app"
+        },
+        "gateway": {
+          "image": "update.askexe.com/askexe/exe-gateway:v2026.08.07-c15f093-stamped@sha256:1bc11a2a0ad1f3929d59d2685696f22a72042b9fca9c75e15c02dc7d3c640105",
+          "env": "GATEWAY_IMAGE_TAG",
+          "composeService": "exe-gateway",
+          "healthUrl": "http://127.0.0.1:3100/health",
+          "category": "app",
+          "description": "WhatsApp/messaging gateway — provenance-stamped rebuild of main (outbound message persistence fix); pinned by digest, dated immutable tag.",
+          "gitSha": "c15f093a0f59730bd5c2c73791ff77059dfa7cc1"
+        },
+        "monitorAgent": {
+          "image": "update.askexe.com/askexe/exe-monitor-agent:v2026.08.09-10660eb4-stamped@sha256:29fbd445f79484df04f000603e4ff445e76f0380f86d687a0033e3a0ef7d1b7a",
+          "env": "MONITOR_AGENT_IMAGE_TAG",
+          "composeService": "exe-monitor-agent",
+          "category": "monitoring",
+          "gitSha": "10660eb4abdeffbcba2aad13549aa58e208ac7a3"
+        },
+        "monitorHub": {
+          "image": "update.askexe.com/askexe/exe-monitor-hub:v2026.08.09-10660eb4-stamped@sha256:c9a9218c2713b8dffea7e1cf8c0702a614657d311a7a4e821c6a543bab29bb97",
+          "env": "MONITOR_HUB_IMAGE_TAG",
+          "composeService": "exe-monitor-hub",
+          "healthUrl": "http://127.0.0.1:8090/api/health",
+          "category": "monitoring",
+          "gitSha": "10660eb4abdeffbcba2aad13549aa58e208ac7a3"
+        },
+        "auth": {
+          "image": "update.askexe.com/askexe/exe-auth:v0.5.0@sha256:ecc57f92b1f2c2d9df4fafe648622fe1fdd87c27012048d950e3f6b82086ccf9",
+          "env": "AUTH_IMAGE_TAG",
+          "composeService": "exe-auth",
+          "healthUrl": "http://127.0.0.1:3300/api/health",
+          "category": "auth",
+          "description": "exe-auth v0.5.0 — one front door, one identity: logo reads EXE INTELLIGENCE (config-driven via AUTH_BRAND_NAME, escaped for the JS/HTML context).",
+          "gitSha": "874941df74041299d829fbc0b37887d64fae6f78"
+        },
+        "erp": {
+          "image": "update.askexe.com/askexe/exe-erp:v2026.08.07-d185286-stamped@sha256:1c655f3f7819c797afd13c79561354f0276cf337403f32aee3e406a497e8827b",
+          "env": "ERP_IMAGE_TAG",
+          "composeService": "exe-erp",
+          "healthUrl": "http://127.0.0.1:8069/api/method/ping",
+          "healthHost": "localhost",
+          "required": false,
+          "category": "app",
+          "description": "Enterprise Resource Planning",
+          "gitSha": "d185286873dcfa11e4b3f9672c4e23efea240cc5"
+        },
+        "gotrue": {
+          "image": "update.askexe.com/askexe/gotrue:v2.172.1@sha256:b0dd7aa28dd1f9a8bd31f136c8b912661f701d9b863171e5843cb08f18f49de4",
+          "composeService": "gotrue",
+          "healthUrl": "http://127.0.0.1:9999/health",
+          "category": "infra"
+        },
+        "redis": {
+          "image": "update.askexe.com/askexe/redis:7.4-alpine@sha256:6ab0b6e7381779332f97b8ca76193e45b0756f38d4c0dcda72dbb3c32061ab99",
+          "composeService": "redis",
+          "category": "infra"
+        },
+        "clickhouse": {
+          "image": "update.askexe.com/askexe/clickhouse-server:24.8.4.13-alpine@sha256:88a45f9e328549b2579256c46ee38e5c0e25ae58303d9eb6d9c7ed8d6d2bbf3c",
+          "composeService": "clickhouse",
+          "category": "infra"
+        },
+        "cloudflared": {
+          "image": "update.askexe.com/askexe/cloudflared:2026-07@sha256:ba461b8aa9c042156dbd39c38657fe7431bafa063220eab8d5330a523863da9f",
+          "composeService": "cloudflared",
+          "category": "infra"
+        },
+        "exe-sso-edge": {
+          "image": "update.askexe.com/askexe/nginx:alpine@sha256:20316569d8f81a160065d7d2a5eeffc7ca97d79022462ee255fd23fa103a6b5c",
+          "composeService": "exe-sso-edge",
+          "category": "infra"
+        },
+        "exe-otel-collector": {
+          "image": "update.askexe.com/askexe/otel-collector-contrib:0.114.0@sha256:37fa87091cfaaec7234a27e4e395a40c31c2bfaea97a349a4afef6d9e9681197",
+          "composeService": "exe-otel-collector",
+          "category": "infra"
+        }
+      },
+      "rolloutStage": "ga"
     }
   },
   "signature": {
     "keyId": "exe-stack-1",
     "alg": "ed25519",
-    "signature": "VW+ZpPYfHUN1/Y5uUEfyQwltQ89sP4RQJb/riKJVitTnUnJJBjbh/ohiVgx+N9Iltl7iItKabnYyIDjtxbp+AQ=="
+    "signature": "pm9jH5HQp+Wo+eSqsFKBYekhFmSFUdJp1YYyBMqaufsnbOxj7JXakBGL4ssrzzi8s+xuNRY6SVXgXTT4biIpAg=="
   }
 }

package/dist/.dist-verified.json

@@ -1,6 +1,6 @@
 {
   "version": 1,
-  "verified_at": "2026-08-08T13:21:22.734Z",
-  "manifest_sha256": "65ad07af0fc465cc0be08a2fba13ea3c07499aec441fbcda18142d607d4b4047",
-  "package_version": "0.9.362"
+  "verified_at": "2026-08-13T09:09:34.865Z",
+  "manifest_sha256": "7b888c6c383a6b1593354b24c308b42228573a170b04256dff851cca5050e317",
+  "package_version": "0.9.365"
 }

package/dist/{active-agent-BPNEBKHI.js → active-agent-C6DPH43L.js}

@@ -4,21 +4,24 @@ import {
   getActiveAgent,
   getAllActiveAgents,
   resolveActiveAgentFromTmuxSession,
+  resolveAgentAttribution,
+  resolveAgentForPayload,
   writeActiveAgent
-} from "./chunk-23KWUA7Z.js";
+} from "./chunk-ZNEBZCZR.js";
+import "./chunk-2ADYTOHQ.js";
 import "./chunk-CVYC6DUW.js";
 import "./chunk-GJV3WDWM.js";
-import "./chunk-HLU52KTO.js";
+import "./chunk-BRLS5OLZ.js";
 import "./chunk-TKDITWDN.js";
 import "./chunk-BBMTVAE3.js";
 import "./chunk-5YEUPUV4.js";
-import "./chunk-Q7J2SQJ6.js";
+import "./chunk-NO3M2AFM.js";
 import "./chunk-YYB5PMTK.js";
-import "./chunk-BRZR76TS.js";
+import "./chunk-NJFJWQNN.js";
 import "./chunk-V3W3SATA.js";
 import "./chunk-JY5GAZYC.js";
 import "./chunk-FXU7JOXK.js";
-import "./chunk-BRIZ6OZ3.js";
+import "./chunk-QMSEL5YS.js";
 import "./chunk-HSGBZSCA.js";
 import "./chunk-JKKZGDLP.js";
 import "./chunk-MLKGABMK.js";
@@ -28,5 +31,7 @@ export {
   getActiveAgent,
   getAllActiveAgents,
   resolveActiveAgentFromTmuxSession,
+  resolveAgentAttribution,
+  resolveAgentForPayload,
   writeActiveAgent
 };

package/dist/{active-agent-3FV5V7SS.js → active-agent-MGF7J3HB.js}

@@ -5,21 +5,24 @@ import {
   getActiveAgent,
   getAllActiveAgents,
   resolveActiveAgentFromTmuxSession,
+  resolveAgentAttribution,
+  resolveAgentForPayload,
   writeActiveAgent
-} from "./chunk-23KWUA7Z.js";
+} from "./chunk-ZNEBZCZR.js";
+import "./chunk-2ADYTOHQ.js";
 import "./chunk-CVYC6DUW.js";
 import "./chunk-GJV3WDWM.js";
-import "./chunk-HLU52KTO.js";
+import "./chunk-BRLS5OLZ.js";
 import "./chunk-TKDITWDN.js";
 import "./chunk-BBMTVAE3.js";
 import "./chunk-5YEUPUV4.js";
-import "./chunk-Q7J2SQJ6.js";
+import "./chunk-NO3M2AFM.js";
 import "./chunk-YYB5PMTK.js";
-import "./chunk-BRZR76TS.js";
+import "./chunk-NJFJWQNN.js";
 import "./chunk-V3W3SATA.js";
 import "./chunk-JY5GAZYC.js";
 import "./chunk-FXU7JOXK.js";
-import "./chunk-BRIZ6OZ3.js";
+import "./chunk-QMSEL5YS.js";
 import "./chunk-HSGBZSCA.js";
 import "./chunk-JKKZGDLP.js";
 import "./chunk-MLKGABMK.js";
@@ -29,5 +32,7 @@ export {
   getActiveAgent,
   getAllActiveAgents,
   resolveActiveAgentFromTmuxSession,
+  resolveAgentAttribution,
+  resolveAgentForPayload,
   writeActiveAgent
 };

package/dist/agent-defs-generator-X7TVMPVB.js

@@ -0,0 +1,240 @@
+import {
+  loadAgentConfig
+} from "./chunk-XTWHNLGD.js";
+import "./chunk-AM7S2TY6.js";
+import {
+  loadEmployeesSync,
+  validateEmployeeName
+} from "./chunk-BRLS5OLZ.js";
+import "./chunk-TKDITWDN.js";
+import "./chunk-BBMTVAE3.js";
+import "./chunk-5YEUPUV4.js";
+import "./chunk-NO3M2AFM.js";
+import "./chunk-YYB5PMTK.js";
+import "./chunk-NJFJWQNN.js";
+import "./chunk-V3W3SATA.js";
+import "./chunk-JY5GAZYC.js";
+import "./chunk-FXU7JOXK.js";
+import "./chunk-WNBZJSQT.js";
+import "./chunk-QMSEL5YS.js";
+import "./chunk-HSGBZSCA.js";
+import "./chunk-JKKZGDLP.js";
+import "./chunk-MLKGABMK.js";
+
+// src/adapters/claude/agent-defs-generator.ts
+import {
+  existsSync,
+  lstatSync,
+  mkdirSync,
+  readFileSync,
+  readlinkSync,
+  renameSync,
+  unlinkSync,
+  writeFileSync
+} from "fs";
+import os from "os";
+import path from "path";
+import { randomBytes } from "crypto";
+var AGENT_DEF_MARKER = "<!-- generated-by: exe-os agent-defs-generator -->";
+function parseIdentityFile(raw) {
+  const match = raw.match(/^---\n([\s\S]*?)\n---\n?([\s\S]*)$/);
+  if (!match) return { fields: {}, body: raw.trim() };
+  const fields = {};
+  for (const line of match[1].split("\n")) {
+    const kv = line.match(/^(\w+):\s*(.+)$/);
+    if (kv) fields[kv[1]] = kv[2].trim();
+  }
+  return { fields, body: (match[2] ?? "").trim() };
+}
+function oneLine(value) {
+  return value.replace(/\s+/g, " ").replace(/"/g, "'").trim();
+}
+var CC_MODEL_ALIASES = /* @__PURE__ */ new Set(["opus", "sonnet", "haiku", "fable"]);
+var CC_EFFORT_VALUES = /* @__PURE__ */ new Set(["low", "medium", "high", "xhigh", "max"]);
+function toClaudeCodeFrontmatterModel(model) {
+  if (!model) return null;
+  const bare = model.trim().toLowerCase().replace(/\x1b\[[0-9;]*m/g, "").replace(/\[(?:0|1)m\]/g, "").replace(/^[a-z0-9.-]+\//, "").trim();
+  if (!bare) return null;
+  if (CC_MODEL_ALIASES.has(bare)) return bare;
+  if (/^claude-(opus|sonnet|haiku|fable)-\d+(?:[.-]\d+)*-\d{8}$/.test(bare)) return bare;
+  const family = bare.match(/^claude-(opus|sonnet|haiku|fable)-\d/);
+  if (family) return family[1];
+  return null;
+}
+function toClaudeCodeFrontmatterEffort(effort) {
+  if (!effort) return void 0;
+  const v = effort.trim().toLowerCase();
+  return CC_EFFORT_VALUES.has(v) ? v : void 0;
+}
+function renderAgentDef(input) {
+  const lines = ["---", `name: ${input.name}`, `description: ${oneLine(input.description)}`];
+  if (input.model) lines.push(`model: ${input.model}`);
+  if (input.effort) lines.push(`effort: ${input.effort}`);
+  lines.push(
+    "---",
+    AGENT_DEF_MARKER,
+    "",
+    '[generated bootstrap] FIRST ACTION: run Bash("true") before any real work so exe-os can deliver your employee memory brief.',
+    "",
+    input.body,
+    ""
+  );
+  return lines.join("\n");
+}
+function isGeneratedAgentDef(raw) {
+  if (!raw.startsWith("---\n")) return false;
+  const fmEnd = raw.indexOf("\n---\n");
+  if (fmEnd < 0) return false;
+  const afterFrontmatter = raw.slice(fmEnd + "\n---\n".length);
+  const firstLine = afterFrontmatter.split("\n", 1)[0] ?? "";
+  return firstLine.trim() === AGENT_DEF_MARKER;
+}
+function isContainedIn(child, dir) {
+  return path.resolve(child).startsWith(path.resolve(dir) + path.sep);
+}
+function isOurIdentitySymlink(linkTarget, identityDir, agentId) {
+  const expected = path.join(identityDir, `${agentId}.md`);
+  return path.resolve(linkTarget) === path.resolve(expected) || linkTarget === expected;
+}
+function generateAgentDefs(options = {}) {
+  const homeDir = options.homeDir ?? os.homedir();
+  const identityDir = path.join(homeDir, ".exe-os", "identity");
+  const rosterPath = path.join(homeDir, ".exe-os", "exe-employees.json");
+  const employees = options.employees ?? loadEmployeesSync(rosterPath);
+  let agentConfig = {};
+  try {
+    agentConfig = options.agentConfig ?? loadAgentConfig();
+  } catch {
+  }
+  const agentsDir = path.join(homeDir, ".claude", "agents");
+  const results = [];
+  for (const emp of employees) {
+    const name = String(emp.name ?? "").toLowerCase();
+    const validation = validateEmployeeName(name);
+    if (!validation.valid) {
+      process.stderr.write(
+        `[agent-defs] skipping invalid roster name ${JSON.stringify(emp.name)}: ${validation.error}
+`
+      );
+      results.push({ agentId: name, action: "skipped", path: "", reason: "invalid_name" });
+      continue;
+    }
+    const identityPath = path.join(identityDir, `${name}.md`);
+    const destPath = path.join(agentsDir, `${name}.md`);
+    if (!isContainedIn(identityPath, identityDir) || !isContainedIn(destPath, agentsDir)) {
+      process.stderr.write(`[agent-defs] path containment violation for ${JSON.stringify(name)} \u2014 skipping
+`);
+      results.push({ agentId: name, action: "skipped", path: destPath, reason: "path_escape" });
+      continue;
+    }
+    if (!existsSync(identityPath)) {
+      results.push({ agentId: name, action: "skipped", path: destPath, reason: "no_identity" });
+      continue;
+    }
+    let identityRaw;
+    try {
+      identityRaw = readFileSync(identityPath, "utf-8");
+    } catch {
+      results.push({ agentId: name, action: "skipped", path: destPath, reason: "identity_unreadable" });
+      continue;
+    }
+    const { fields, body } = parseIdentityFile(identityRaw);
+    const runtime = agentConfig[name];
+    const ccModel = runtime?.runtime === "claude" ? toClaudeCodeFrontmatterModel(runtime.model) : null;
+    if (runtime?.runtime === "claude" && runtime.model && !ccModel) {
+      process.stderr.write(
+        `[agent-defs] omitting non-Claude-Code model for ${name}: ${JSON.stringify(runtime.model)}
+`
+      );
+    }
+    const content = renderAgentDef({
+      name,
+      description: fields.title && fields.title !== emp.role ? `${fields.title} (${emp.role})` : emp.role,
+      model: ccModel ?? void 0,
+      // Couple effort to a present model (as before) and only emit CC-valid enum values.
+      effort: ccModel ? toClaudeCodeFrontmatterEffort(runtime?.reasoning_effort) : void 0,
+      body
+    });
+    let existing;
+    try {
+      const stat = lstatSync(destPath);
+      if (stat.isSymbolicLink()) {
+        let target = "";
+        try {
+          target = readlinkSync(destPath);
+        } catch {
+        }
+        existing = isOurIdentitySymlink(target, identityDir, name) ? { kind: "our_symlink" } : { kind: "foreign_symlink" };
+      } else {
+        existing = { kind: "file", raw: readFileSync(destPath, "utf-8") };
+      }
+    } catch {
+      existing = { kind: "absent" };
+    }
+    if (existing.kind === "foreign_symlink") {
+      results.push({ agentId: name, action: "skipped", path: destPath, reason: "foreign_symlink" });
+      continue;
+    }
+    if (existing.kind === "file") {
+      if (!isGeneratedAgentDef(existing.raw)) {
+        results.push({ agentId: name, action: "skipped", path: destPath, reason: "user_file" });
+        continue;
+      }
+      if (existing.raw === content) {
+        results.push({ agentId: name, action: "unchanged", path: destPath });
+        continue;
+      }
+    }
+    try {
+      mkdirSync(agentsDir, { recursive: true });
+      const tempPath = path.join(agentsDir, `.tmp-agent-def-${name}-${process.pid}-${randomBytes(4).toString("hex")}`);
+      writeFileSync(tempPath, content, "utf-8");
+      try {
+        let preStat;
+        try {
+          preStat = lstatSync(destPath);
+        } catch {
+          preStat = null;
+        }
+        if (preStat?.isSymbolicLink()) {
+          if (existing.kind !== "our_symlink") {
+            unlinkSync(tempPath);
+            results.push({ agentId: name, action: "skipped", path: destPath, reason: "symlink_appeared" });
+            continue;
+          }
+          unlinkSync(destPath);
+        }
+        renameSync(tempPath, destPath);
+      } catch (err) {
+        try {
+          unlinkSync(tempPath);
+        } catch {
+        }
+        throw err;
+      }
+      results.push({
+        agentId: name,
+        action: existing.kind === "file" ? "updated" : "created",
+        path: destPath
+      });
+    } catch (err) {
+      results.push({
+        agentId: name,
+        action: "skipped",
+        path: destPath,
+        reason: `write_failed:${err instanceof Error ? err.message : String(err)}`
+      });
+    }
+  }
+  return results;
+}
+function summarizeAgentDefResults(results) {
+  const count = (action) => results.filter((r) => r.action === action).length;
+  return `${count("created")} created, ${count("updated")} updated, ${count("unchanged")} unchanged, ${count("skipped")} skipped`;
+}
+export {
+  AGENT_DEF_MARKER,
+  generateAgentDefs,
+  isGeneratedAgentDef,
+  summarizeAgentDefResults
+};

package/dist/{agentic-ontology-RCVCJ6WB.js → agentic-ontology-CARDCG37.js}

@@ -10,7 +10,7 @@ import {
   insertOntologyForMemory,
   ontologyPayload,
   stableId
-} from "./chunk-YAZ5ECEG.js";
+} from "./chunk-3NBWARKC.js";
 import "./chunk-MLKGABMK.js";
 export {
   ONTOLOGY_YIELD_EVERY,