@askexenow/exe-os 0.9.365 → 0.9.367

package/dist/{chunk-4QKKLK3C.js → chunk-BQYQES2Z.js}

@@ -1,6 +1,6 @@
 import {
   WORK_STATE_HEARTBEAT_TOOL
-} from "./chunk-QYECRPGD.js";
+} from "./chunk-JLYHJJHU.js";
 import {
   extractKeywords,
   keywordsToString
@@ -12,7 +12,7 @@ import {
   findScopedDuplicate,
   governMemoryRecord,
   schedulePostWriteMemoryHygiene
-} from "./chunk-7DMCAGSC.js";
+} from "./chunk-WM7Y5ZV2.js";
 import {
   orgBus
 } from "./chunk-MP2AFCGL.js";
@@ -23,7 +23,7 @@ import {
   initPostgresOnlyDatabase,
   initTurso,
   isDaemonRoutingActive
-} from "./chunk-BRLS5OLZ.js";
+} from "./chunk-HSBKV5LB.js";
 import {
   isPostgresBackendEnabled
 } from "./chunk-YYB5PMTK.js";
@@ -82,7 +82,7 @@ function recordShardFailure(project, error) {
       `[store] Shard circuit OPEN for "${project}" after ${state.failures} consecutive failures. Will retry in ${SHARD_CB_COOLDOWN_MS / 6e4}min. Last error: ${error}
 `
     );
-    void import("./orchestration-events-GMRGGBMN.js").then(({ recordOrchestrationEventBestEffort }) => {
+    void import("./orchestration-events-HVG56HJ5.js").then(({ recordOrchestrationEventBestEffort }) => {
       recordOrchestrationEventBestEffort({
         eventType: "shard.circuit_open",
         source: "store.recordShardFailure",
@@ -186,7 +186,7 @@ async function initStore(options) {
     );
     _nextVersion = (Number(vResult.rows[0]?.max_v) || 0) + 1;
     try {
-      const { loadGlobalProcedures } = await import("./global-procedures-ZOFTOXIR.js");
+      const { loadGlobalProcedures } = await import("./global-procedures-XDNA3TNA.js");
       await loadGlobalProcedures();
     } catch (e) {
       logStoreWarn("catch", e);
@@ -314,7 +314,7 @@ async function writeMemory(record) {
     founder_id: record.founder_id ?? null
   };
   try {
-    const { checkMemoryPoisoning } = await import("./memory-poisoning-defense-IPO4ADRL.js");
+    const { checkMemoryPoisoning } = await import("./memory-poisoning-defense-TPXSRJTQ.js");
     const poisonResult = await checkMemoryPoisoning({
       memoryId: dbRow.id,
       vector: Array.isArray(dbRow.vector) ? dbRow.vector : void 0,
@@ -513,19 +513,19 @@ async function flushBatch() {
     _nextVersion = baseVersion;
     if (insertedBatch.length > 0) {
       try {
-        const { insertMemoryCardsForBatch } = await import("./memory-cards-K2OSX4AW.js");
+        const { insertMemoryCardsForBatch } = await import("./memory-cards-3QTXI2SG.js");
         await insertMemoryCardsForBatch(insertedBatch);
       } catch (e) {
         logStoreWarn("catch", e);
       }
       try {
-        const { insertOntologyForBatch } = await import("./agentic-ontology-CARDCG37.js");
+        const { insertOntologyForBatch } = await import("./agentic-ontology-5FMQWGDZ.js");
         await insertOntologyForBatch(insertedBatch);
       } catch (e) {
         logStoreWarn("catch", e);
       }
       try {
-        const { extractGraphForBatch } = await import("./memory-graph-extractor-YLTSKLSY.js");
+        const { extractGraphForBatch } = await import("./memory-graph-extractor-7GAILMYG.js");
         await extractGraphForBatch(insertedBatch);
       } catch (e) {
         logStoreWarn("catch", e);
@@ -665,7 +665,7 @@ async function searchMemories(queryVector, agentId, options) {
     args.push(activeEmbeddingModel);
   }
   try {
-    const { founderScopeFilter } = await import("./founder-context-U2SZPLYV.js");
+    const { founderScopeFilter } = await import("./founder-context-KUXSNXKS.js");
     const founderFilter = founderScopeFilter(options?.founderId);
     sql += founderFilter.sql;
     args.push(...founderFilter.args.filter((a) => a !== null));

package/dist/{chunk-WYLFDSIE.js → chunk-BTMX2D4X.js}

@@ -4,7 +4,7 @@ import {
 } from "./chunk-NEHOQ3P2.js";
 import {
   isCrdtSyncEnabled
-} from "./chunk-3THNS2T7.js";
+} from "./chunk-62U63R3E.js";
 import {
   orgMembershipsPath,
   orgModeActive
@@ -25,7 +25,7 @@ import {
 import {
   GHOST_BEHAVIOR_SQL,
   isGhostBehaviorRow
-} from "./chunk-O2MEBF23.js";
+} from "./chunk-WBKIU6UJ.js";
 import {
   retryOnDaemonTransportError
 } from "./chunk-VMJ2UH4S.js";
@@ -41,10 +41,10 @@ import {
   loadEmployees,
   registerBinSymlinks,
   saveEmployees
-} from "./chunk-BRLS5OLZ.js";
+} from "./chunk-HSBKV5LB.js";
 import {
   loadDeviceId
-} from "./chunk-ZDUO6QBH.js";
+} from "./chunk-F3PIHVVY.js";
 import {
   EXE_AI_DIR
 } from "./chunk-QMSEL5YS.js";
@@ -1024,7 +1024,7 @@ async function cloudSync(config, options) {
       pullResult = await cloudPull(lastPullVersion, config);
       if (pullResult.records.length > 0) {
         if (shouldUseCrdtMergeForCloudSync()) {
-          const { initCrdtDoc, importExistingMemories, readAllMemories } = await import("./crdt-sync-LIJLZKFE.js");
+          const { initCrdtDoc, importExistingMemories, readAllMemories } = await import("./crdt-sync-FGH4SBFW.js");
           initCrdtDoc();
           importExistingMemories(
             pullResult.records.map((rec) => ({

package/dist/chunk-BTSWFMEH.js

@@ -0,0 +1,14 @@
+// src/lib/session-scope-token.ts
+var VALID_SESSION_SCOPE_RE = /^[a-zA-Z0-9_]+$/;
+function isValidSessionScope(scope) {
+  return typeof scope === "string" && scope.length > 0 && scope.length <= 64 && VALID_SESSION_SCOPE_RE.test(scope);
+}
+function sanitizeSessionScope(scope) {
+  return isValidSessionScope(scope) ? scope : null;
+}
+
+export {
+  VALID_SESSION_SCOPE_RE,
+  isValidSessionScope,
+  sanitizeSessionScope
+};

package/dist/{chunk-EKVTRI3N.js → chunk-BY3V5CLX.js}

@@ -5,14 +5,14 @@ import {
   EXE_HOOKS,
   isLegacyHomeDirHookCommand,
   isLegacySplitPostToolCommand
-} from "./chunk-L3TB7CC3.js";
+} from "./chunk-KM6XSFHP.js";
 import {
   buildClaudeHttpMcpEntry,
   buildClaudeStdioProxyMcpEntry
-} from "./chunk-EWCEUO65.js";
+} from "./chunk-JFOZHVNO.js";
 import {
   ensureAllAgentSymlinks
-} from "./chunk-ESTR7QUP.js";
+} from "./chunk-6MCUXRIP.js";
 import {
   MCP_LEGACY_KEY,
   MCP_PRIMARY_KEY
@@ -641,6 +641,7 @@ async function mergeHooks(packageRoot, homeDir = os.homedir()) {
     "update_task",
     "close_task",
     "checkpoint_task",
+    "claim",
     // Behaviors
     "store_behavior",
     "deactivate_behavior",
@@ -922,7 +923,7 @@ async function runInstaller(homeDir) {
     );
   }
   try {
-    const { generateAgentDefs, summarizeAgentDefResults } = await import("./agent-defs-generator-X7TVMPVB.js");
+    const { generateAgentDefs, summarizeAgentDefResults } = await import("./agent-defs-generator-MLPRGY75.js");
     const defResults = generateAgentDefs({ homeDir: resolvedHome });
     process.stderr.write(`Agent definitions: ${summarizeAgentDefResults(defResults)}
 `);

package/dist/{chunk-ZSZPMUNX.js → chunk-CKKLSY7B.js}

@@ -1,3 +1,8 @@
+import {
+  clearDeployStalenessAlert,
+  evaluateDeployStaleness,
+  writeDeployStalenessAlert
+} from "./chunk-TX3Q2GIL.js";
 import {
   REVISION_LABEL,
   VERSION_LABEL,
@@ -6,7 +11,7 @@ import {
 } from "./chunk-L25OAFOU.js";
 import {
   loadLicense
-} from "./chunk-ZDUO6QBH.js";
+} from "./chunk-F3PIHVVY.js";
 
 // src/lib/stack-update.ts
 import { execFileSync, spawnSync as spawnSync2 } from "child_process";
@@ -411,6 +416,7 @@ async function rollbackStackUpdate(options) {
   const backupComposeFile = lockData?.backupComposeFile;
   const backupComposeOverrideFile = lockData?.backupComposeOverrideFile;
   const composeOverrideFile = composeOverrideFileFor(options.composeFile);
+  let composeRestored = false;
   if (!options.serviceName) {
     try {
       if (existsSync(options.composeFile)) {
@@ -420,6 +426,7 @@ async function rollbackStackUpdate(options) {
     }
     if (backupComposeFile && existsSync(backupComposeFile)) {
       copyFileSync(backupComposeFile, options.composeFile);
+      composeRestored = true;
       console.log(`[stack-update] Restored docker-compose.yml from ${backupComposeFile}`);
     } else {
       console.log("[stack-update] No backed-up docker-compose.yml in lock \u2014 rolling back image tags via .env on the current compose.");
@@ -439,19 +446,60 @@ async function rollbackStackUpdate(options) {
   }
   const scopedServiceNames = options.serviceName ? Object.entries(lockData?.services ?? {}).filter(([name, service]) => name === options.serviceName || (service.composeService ?? name) === options.serviceName).map(([name]) => name) : [];
   const rollbackEnvRaw = readFileSync(rollbackEnv, "utf8");
+  const rollbackEnvMap = parseEnv(rollbackEnvRaw);
+  const preUpdateImageDefaults = lockData?.preUpdateImageDefaults ?? {};
   if (scopedServiceNames.length > 0 && lockData?.services) {
-    const rollbackEnvMap = parseEnv(rollbackEnvRaw);
     const scopedEnvKeys = scopedServiceNames.map((serviceName) => lockData.services[serviceName].env).filter((key) => Boolean(key));
     const mutatedEnvKeys = lockData.mutatedEnvKeys ?? [];
     const restoreEnvKeys = [.../* @__PURE__ */ new Set([...scopedEnvKeys, ...mutatedEnvKeys])];
-    const scopedUpdates = Object.fromEntries(
-      restoreEnvKeys.map((key) => [key, rollbackEnvMap.get(key) ?? ""])
-    );
+    const scopedUpdates = {};
+    const scopedRemovals = [];
+    const scopedRepins = [];
+    for (const key of restoreEnvKeys) {
+      const previous = rollbackEnvMap.get(key);
+      if (previous !== void 0) {
+        scopedUpdates[key] = previous;
+        continue;
+      }
+      const previousDefault = preUpdateImageDefaults[key];
+      if (previousDefault !== void 0) {
+        scopedUpdates[key] = previousDefault;
+        scopedRepins.push(key);
+        continue;
+      }
+      scopedRemovals.push(key);
+    }
     console.log(`[stack-update] Restoring env keys for service ${scopedServiceNames.join(", ")} from ${rollbackEnv}: ${restoreEnvKeys.join(", ")}`);
-    writeSecretFile(options.envFile, patchEnv(readFileSync(options.envFile, "utf8"), scopedUpdates));
+    if (scopedRepins.length > 0) {
+      console.log(`[stack-update] Re-pinning previously-unset image var(s) to their pre-update compose default so the service does not stay on the new image: ${scopedRepins.join(", ")}`);
+    }
+    if (scopedRemovals.length > 0) {
+      console.log(`[stack-update] Removing env key(s) that did not exist before the update: ${scopedRemovals.join(", ")}`);
+    }
+    const patched = patchEnv(readFileSync(options.envFile, "utf8"), scopedUpdates);
+    writeSecretFile(options.envFile, removeEnvKeys(patched, scopedRemovals));
   } else {
     console.log(`[stack-update] Restoring env from ${rollbackEnv}`);
     writeSecretFile(options.envFile, rollbackEnvRaw);
+    if (!composeRestored) {
+      const touched = /* @__PURE__ */ new Set([
+        ...lockData?.mutatedEnvKeys ?? [],
+        ...Object.values(lockData?.services ?? {}).map((svc) => svc.env).filter((k) => Boolean(k))
+      ]);
+      const repins = {};
+      for (const [key, image] of Object.entries(preUpdateImageDefaults)) {
+        if (touched.size > 0 && !touched.has(key)) continue;
+        if (rollbackEnvMap.has(key)) continue;
+        repins[key] = image;
+      }
+      const repinKeys = Object.keys(repins);
+      if (repinKeys.length > 0) {
+        console.log(
+          `[stack-update] No pre-update compose to restore \u2014 re-pinning previously-unset image var(s) to their pre-update default so the service is not left on the NEW image: ${repinKeys.join(", ")}`
+        );
+        writeSecretFile(options.envFile, patchEnv(readFileSync(options.envFile, "utf8"), repins));
+      }
+    }
   }
   const composeArgs = composeArgsForStack(options.composeFile, options.envFile);
   if (lockData?.services) {
@@ -754,6 +802,59 @@ function patchEnv(raw, updates) {
   }
   return patched.join("\n").replace(/\n*$/, "\n");
 }
+function removeEnvKeys(raw, keys) {
+  if (keys.length === 0) return raw;
+  const drop = new Set(keys);
+  const kept = raw.replace(/\n$/, "").split(/\r?\n/).filter((line) => {
+    const idx = line.indexOf("=");
+    if (idx <= 0 || line.trim().startsWith("#")) return true;
+    return !drop.has(line.slice(0, idx).trim());
+  });
+  return kept.join("\n").replace(/\n*$/, "\n");
+}
+function expandComposeExpression(expr, env) {
+  let out = "";
+  for (let i = 0; i < expr.length; ) {
+    if (expr[i] === "$" && expr[i + 1] === "{") {
+      let depth = 1;
+      let j = i + 2;
+      for (; j < expr.length && depth > 0; j++) {
+        if (expr[j] === "{" && expr[j - 1] === "$") depth++;
+        else if (expr[j] === "}") depth--;
+      }
+      const body = expr.slice(i + 2, j - 1);
+      const sep = /^([A-Za-z_][A-Za-z0-9_]*)(:?-)?([\s\S]*)$/.exec(body);
+      if (sep) {
+        const [, name, operator, fallback] = sep;
+        const value = env.get(name);
+        const unset = operator === ":-" ? value === void 0 || value === "" : value === void 0;
+        out += unset && operator ? expandComposeExpression(fallback, env) : value ?? "";
+      }
+      i = j;
+      continue;
+    }
+    out += expr[i];
+    i++;
+  }
+  return out;
+}
+function snapshotComposeImageDefaults(composeRaw, env) {
+  const defaults = {};
+  for (const line of composeRaw.split(/\r?\n/)) {
+    const image = /^\s*image:\s*(\S.*?)\s*$/.exec(line);
+    if (!image) continue;
+    let expr = image[1];
+    for (; ; ) {
+      const head = /^\$\{([A-Za-z_][A-Za-z0-9_]*):?-([\s\S]*)\}$/.exec(expr);
+      if (!head) break;
+      const [, name, fallback] = head;
+      const resolved = expandComposeExpression(fallback, env);
+      if (resolved) defaults[name] = resolved;
+      expr = fallback;
+    }
+  }
+  return defaults;
+}
 var EXE_OS_ALLOW_IMAGE_OVERRIDE_DOC = "EXE_OS_ALLOW_IMAGE_OVERRIDE=1 (documented break-glass; manifest pin is authoritative for production)";
 function isBreakGlassImageOverrideEnabled(processEnv) {
   const v = (processEnv.EXE_OS_ALLOW_IMAGE_OVERRIDE ?? "").trim().toLowerCase();
@@ -1596,6 +1697,7 @@ function backupStackConfig(stackDir, composeFile, envRaw, now = () => /* @__PURE
   const backupEnvFile = path.join(updateBackupDir, "env.bak");
   writeSecretFile(backupEnvFile, envRaw);
   let backupComposeFile;
+  let preUpdateImageDefaults;
   try {
     if (existsSync(composeFile)) {
       backupComposeFile = path.join(updateBackupDir, "docker-compose.yml.bak");
@@ -1604,6 +1706,13 @@ function backupStackConfig(stackDir, composeFile, envRaw, now = () => /* @__PURE
   } catch {
     backupComposeFile = void 0;
   }
+  try {
+    if (existsSync(composeFile)) {
+      preUpdateImageDefaults = snapshotComposeImageDefaults(readFileSync(composeFile, "utf8"), parseEnv(envRaw));
+    }
+  } catch {
+    preUpdateImageDefaults = void 0;
+  }
   const composeOverrideFile = composeOverrideFileFor(composeFile);
   const hadComposeOverrideFile = existsSync(composeOverrideFile);
   let backupComposeOverrideFile;
@@ -1649,7 +1758,7 @@ function backupStackConfig(stackDir, composeFile, envRaw, now = () => /* @__PURE
   } catch {
   }
   console.log(`[stack-update] Config backed up to ${updateBackupDir}`);
-  return { updateBackupDir, backupEnvFile, backupComposeFile, backupComposeOverrideFile, hadComposeOverrideFile };
+  return { updateBackupDir, backupEnvFile, backupComposeFile, backupComposeOverrideFile, hadComposeOverrideFile, preUpdateImageDefaults };
 }
 function installDockerUbuntu(exec) {
   if (process.platform !== "linux") throw new Error("Docker auto-install is only supported on Linux. Install Docker manually, then retry.");
@@ -2420,6 +2529,9 @@ ${lines.join("\n")}`
     backupComposeOverrideFile: resumeLock?.backupComposeOverrideFile ?? backupComposeOverrideFile,
     hadComposeOverrideFile: resumeLock?.hadComposeOverrideFile ?? hadComposeOverrideFile,
     mutatedEnvKeys: [.../* @__PURE__ */ new Set([...resumeLock?.mutatedEnvKeys ?? [], ...mutatedEnvKeys])],
+    // Bug 879aad12: preserve the FIRST snapshot across --resume; the compose on
+    // disk may already be the new template by the time a resume runs.
+    preUpdateImageDefaults: resumeLock?.preUpdateImageDefaults ?? configBackup.preUpdateImageDefaults,
     services: { ...fullTargetPlan.release.services, ...resumeLock?.services ?? {}, ...plan.release.services },
     serviceStatus: initialServiceStatus
   });
@@ -2827,8 +2939,10 @@ Fix these before the stack is safe to operate.`);
       backupComposeOverrideFile: finalLock.backupComposeOverrideFile ?? backupComposeOverrideFile,
       hadComposeOverrideFile: finalLock.hadComposeOverrideFile ?? hadComposeOverrideFile,
       mutatedEnvKeys: finalLock.mutatedEnvKeys ?? mutatedEnvKeys,
+      preUpdateImageDefaults: finalLock.preUpdateImageDefaults ?? configBackup.preUpdateImageDefaults,
       services: { ...fullTargetPlan.release.services, ...finalLock.services ?? {}, ...plan.release.services }
     });
+    clearDeployStalenessAlert();
     await postDeployAudit(options, "success", plan.targetVersion, previousVersion, void 0, { changes: plan.changes.length });
     return { status: "updated", targetVersion: plan.targetVersion, changes: plan.changes, backupEnvFile, lockFile, serviceStatus: readStackUpdateLock(lockFile)?.serviceStatus };
   } catch (err) {
@@ -2868,6 +2982,8 @@ Fix these before the stack is safe to operate.`);
         }
       }
     }
+    const staleness = evaluateDeployStaleness(readStackUpdateLock(lockFile), now);
+    if (staleness) writeDeployStalenessAlert(staleness);
     await postDeployAudit(options, "failed", plan.targetVersion, previousVersion, reason, { rollbackAttempted: true });
     throw new Error(`Stack update failed and rollback was attempted: ${reason}`);
   } finally {
@@ -3416,6 +3532,9 @@ export {
   reportStackManifestSource,
   parseEnv,
   patchEnv,
+  removeEnvKeys,
+  expandComposeExpression,
+  snapshotComposeImageDefaults,
   resolveServerImageOverride,
   applyServerImageOverrideResolution,
   parseRequiredEnvRefs,

package/dist/{chunk-6Q263OZE.js → chunk-CTPG4KYZ.js}

@@ -212,7 +212,7 @@ async function main(args) {
   console.log("[health-gate] Starting rollback...");
   restorePreDeployBackup();
   try {
-    const { rollbackStackUpdate, defaultStackPaths } = await import("./stack-update-LLX5KT7G.js");
+    const { rollbackStackUpdate, defaultStackPaths } = await import("./stack-update-SJ43IEQE.js");
     const paths = defaultStackPaths();
     await rollbackStackUpdate({
       manifestRef: paths.manifestRef,

package/dist/{chunk-C3UAQ3JG.js → chunk-CX4MVEM3.js}

@@ -1,6 +1,6 @@
 import {
   getClient
-} from "./chunk-BRLS5OLZ.js";
+} from "./chunk-HSBKV5LB.js";
 
 // src/lib/skill-refinement.ts
 import crypto from "crypto";

package/dist/{chunk-DEFSN2FQ.js → chunk-CYNL3ZFD.js}

@@ -1,21 +1,21 @@
 import {
   cleanupCardsForMemories,
   cleanupGraphLinksForMemories
-} from "./chunk-EWZYFG5Q.js";
+} from "./chunk-53LCVVX5.js";
 import {
   resolveAnthropicAuth
 } from "./chunk-VGMACSEV.js";
 import {
   buildSystemStateExclusionFilter,
   vectorToBlob
-} from "./chunk-4QKKLK3C.js";
+} from "./chunk-BQYQES2Z.js";
 import {
   extractKeywords,
   keywordsToString
 } from "./chunk-CHCA3ZM2.js";
 import {
   isCoordinatorName
-} from "./chunk-BRLS5OLZ.js";
+} from "./chunk-HSBKV5LB.js";
 
 // src/lib/consolidation.ts
 import { randomUUID } from "crypto";

package/dist/{chunk-RD4E5G3B.js → chunk-DTTISDTI.js}

@@ -1,6 +1,6 @@
 import {
   getClient
-} from "./chunk-BRLS5OLZ.js";
+} from "./chunk-HSBKV5LB.js";
 import {
   loadConfig
 } from "./chunk-QMSEL5YS.js";

package/dist/{chunk-ZRKEUCUZ.js → chunk-DXCTHNEF.js}

@@ -1,12 +1,12 @@
 import {
   isPaneBusy
-} from "./chunk-ZEKCHV43.js";
+} from "./chunk-XAMLDTRA.js";
 import {
   recordSessionKill
-} from "./chunk-ANPE3TT3.js";
+} from "./chunk-YA4PM3MV.js";
 import {
   updateTask
-} from "./chunk-AGQAGOQN.js";
+} from "./chunk-ZZ3JQM5I.js";
 import {
   BUSY_PATTERN,
   countPendingReviews,
@@ -15,7 +15,6 @@ import {
   getSessionState,
   getSessionStateAsync,
   isExeSession,
-  isValidSessionScope,
   queryTaskRows,
   queueIntercom,
   sendIntercomAsync,
@@ -23,14 +22,17 @@ import {
   sessionScopeFilter,
   strictSessionScopeFilter,
   writeNotification
-} from "./chunk-ORNCMRIX.js";
+} from "./chunk-QX33D4CH.js";
+import {
+  isValidSessionScope
+} from "./chunk-BTSWFMEH.js";
 import {
   LEASE_MINUTES,
   isLeaseExpired
 } from "./chunk-E23LNUWJ.js";
 import {
   listSessions
-} from "./chunk-EHHMNKOA.js";
+} from "./chunk-XKFMNAJ7.js";
 import {
   capturePaneLinesAsync,
   listTmuxSessions,
@@ -42,7 +44,7 @@ import {
 } from "./chunk-UXLO7VHX.js";
 import {
   recordOrchestrationEventBestEffort
-} from "./chunk-WR75WUEP.js";
+} from "./chunk-UI3K73LD.js";
 import {
   checkDispatchStatus,
   readTerminalLauncherFailure,
@@ -62,7 +64,7 @@ import {
   getCoordinatorName,
   isCoordinatorName,
   shouldAutoInstance
-} from "./chunk-BRLS5OLZ.js";
+} from "./chunk-HSBKV5LB.js";
 import {
   eventLoopBlockedMarkerPath
 } from "./chunk-JY5GAZYC.js";
@@ -3457,7 +3459,7 @@ async function reapOrphanedWorktrees(deps, nowMs = Date.now()) {
 }
 async function createWorktreeReaperRealDeps() {
   const { getPaneCwdAsync } = await import("./lib/tmux-status.js");
-  const { getGitRootAsync, isWorktreeDirtyAsync } = await import("./worktree-H3YFJ3NU.js");
+  const { getGitRootAsync, isWorktreeDirtyAsync } = await import("./worktree-3TUKIZWY.js");
   const { statSync: statSync3 } = await import("fs");
   const { basename: basename2 } = await import("path");
   const { promisify: promisify2 } = await import("util");
@@ -3700,7 +3702,7 @@ async function gcStaleCheckpoints() {
 }
 async function pollTaskGroupBarriers() {
   try {
-    const { checkAndFireBarriers } = await import("./tasks-crud-W7VGWRUV.js");
+    const { checkAndFireBarriers } = await import("./tasks-crud-ZU6RZDEZ.js");
     const firedGroupIds = await checkAndFireBarriers();
     if (firedGroupIds.length === 0) return 0;
     const { getClient } = await import("./lib/database.js");

package/dist/{chunk-KSVLBATT.js → chunk-E5QQZDQN.js}

@@ -5,6 +5,47 @@ import {
   checkPermission
 } from "./chunk-2O2UKMUE.js";
 
+// src/runtime/stall-detection.ts
+import { createHash } from "crypto";
+var STALL_LIMITS = {
+  /**
+   * Consecutive identical (calls + results) turns before the loop is declared
+   * stalled. Three, not two: a legitimate retry of a transient failure is common
+   * and should be allowed exactly once. A third identical outcome is not a retry,
+   * it is a loop.
+   */
+  maxIdenticalTurns: 3
+};
+function createStallState() {
+  return { lastSignature: null, repeats: 0 };
+}
+function turnSignature(calls, results) {
+  if (calls.length === 0) return null;
+  const payload = JSON.stringify({
+    calls: calls.map((c) => [c.name, stableStringify(c.input)]),
+    results: results.map((r) => [r.content, Boolean(r.isError)])
+  });
+  return createHash("sha256").update(payload).digest("hex").slice(0, 32);
+}
+function stableStringify(value) {
+  if (value === null || typeof value !== "object") return JSON.stringify(value) ?? "null";
+  if (Array.isArray(value)) return `[${value.map(stableStringify).join(",")}]`;
+  const obj = value;
+  return `{${Object.keys(obj).sort().map((k) => `${JSON.stringify(k)}:${stableStringify(obj[k])}`).join(",")}}`;
+}
+function recordTurn(state, signature) {
+  if (signature === null) return createStallState();
+  if (signature === state.lastSignature) return { lastSignature: signature, repeats: state.repeats + 1 };
+  return { lastSignature: signature, repeats: 1 };
+}
+function isStalled(state) {
+  return state.repeats >= STALL_LIMITS.maxIdenticalTurns;
+}
+function stallReason(state, toolNames = []) {
+  const tools = toolNames.length > 0 ? ` (${[...new Set(toolNames)].join(", ")})` : "";
+  return `Agent stalled: the same tool call and the same result${tools} repeated ${state.repeats} turns in a row with no progress. Stopping instead of burning the remaining turn budget on an identical retry.`;
+}
+
 // src/runtime/compact.ts
 var COMPACTION_THRESHOLD = 0.85;
 var KEEP_RECENT_MESSAGES = 10;
@@ -322,6 +363,7 @@ async function* agentLoop(userMessage, history, config) {
   const allowedTools = config.tools.toAllowedNormalizedTools(config.permissions);
   const contextManager = createContextManager(config.model, config.hooks);
   let denialState = createDenialTrackingState();
+  let stallState = createStallState();
   let turns = 0;
   let activeModel = config.model;
   let routedToFallback = false;
@@ -462,6 +504,17 @@ async function* agentLoop(userMessage, history, config) {
     }
     messages.push({ role: "user", content: toolResults });
     yield { type: "turn_complete", turn: turns, usage: response.usage };
+    stallState = recordTurn(stallState, turnSignature(
+      toolUseBlocks.map((b) => ({ name: b.name, input: b.input })),
+      toolResults.map((r) => ({
+        content: typeof r.content === "string" ? r.content : "",
+        isError: Boolean(r.is_error)
+      }))
+    ));
+    if (isStalled(stallState)) {
+      yield { type: "error", error: new Error(stallReason(stallState, toolUseBlocks.map((b) => b.name))) };
+      break;
+    }
   }
   yield { type: "done", totalUsage, turns };
 }

package/dist/{chunk-DQ5KHWFD.js → chunk-EDZ5URGR.js}

@@ -1,6 +1,6 @@
 import {
   processCRMEvent
-} from "./chunk-UY6HRDB2.js";
+} from "./chunk-YNPOELAN.js";
 
 // src/gateway/adapters/crm-webhook.ts
 function parseTwentyWebhook(payload) {

package/dist/{chunk-ZDUO6QBH.js → chunk-F3PIHVVY.js}

@@ -3,7 +3,7 @@ import {
 } from "./chunk-A7XLR3K7.js";
 import {
   getDeviceInfo
-} from "./chunk-VS4LPG66.js";
+} from "./chunk-65ZSFW3O.js";
 import {
   EXE_AI_DIR
 } from "./chunk-QMSEL5YS.js";

package/dist/{chunk-EJ4522YM.js → chunk-FSIAGX55.js}

@@ -1,6 +1,6 @@
 import {
   createReminder
-} from "./chunk-RD4E5G3B.js";
+} from "./chunk-DTTISDTI.js";
 
 // src/mcp/tools/create-reminder.ts
 import { z } from "zod";

package/dist/{chunk-RVWALVDT.js → chunk-GUOMZ3JM.js}

@@ -3,11 +3,11 @@ import {
 } from "./chunk-75H4R62K.js";
 import {
   initStore
-} from "./chunk-4QKKLK3C.js";
+} from "./chunk-BQYQES2Z.js";
 import {
   getClient,
   isInitialized
-} from "./chunk-BRLS5OLZ.js";
+} from "./chunk-HSBKV5LB.js";
 
 // src/lib/schedules.ts
 import crypto from "crypto";